P09 PWS Water Tanks Cleaning and Inspection Services 28 Feb 2023.docx

PERFORMANCE WORK STATEMENT WATER TANKS CLEANING AND INSPECTION SERVICES AT VA CARIBBEAN HEALTHCARE SYSTEM

1.0 Introduction. This is a non-personal services contract to provide Water Tanks Cleaning and Inspection Services at Veterans Affairs (VA) Caribbean Healthcare Systems (VACHS). The government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government. The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the required service at VACHS as defined in this Performance Work Statement (PWS), section three (3.0) except for those items specified as Government-furnished property and services.

1.1 Scope. The Contractor shall perform these requirements in accordance with this PWS, manufacturer's manual, local, state, and federal laws and regulations, Veteran Affairs (VA) regulations, and the American Water Works Association (AWWA) Standard C652-19, Disinfection of Water Storage Facilities to perform water tanks cleaning, chemical products application, and disinfection. In addition, the contractor shall follow all accepted trade practices, standards or norms within the industry, local regulations standards and commonly accepted commercial practices. In the event of conflict between regulatory guidance, the most stringent requirement shall apply. The work covered under this requirement includes two (2) vertical ground supported 1,000,000-gallon water tanks and one (1) underground 200,000-gallon water tank.

2.0 General Requirements. This section describes the general requirements for this effort. The following sub-sections provide details of various considerations on this effort.

2.1 Non-Personal Services. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (CO) immediately.

2.1.1 Type of Contract. The Government will award a firm-fixed price contract.

2.1.2 Period of Performance. The period of performance for this effort will be a base year of 12 months and four (4) one-year option periods. The base period and options will be established after the effective date of contract award. Each option will be exercised at the government’s discretion. In addition, the resulting contract will have an additional option to extend the services for up to six (6) months at the government’s discretion.

2.1.3 Location and Hours of Work. The contractor shall provide the services at VACHS during the core hours of operation from 7:00 AM to 4:00 PM Monday through Friday, except during Federal Holidays. VACHS is located at 10 Casia St. San Juan, Puerto Rico.

2.1.4 Recognized Government Holidays. The Contractor will not be required to work on the legal public holidays listed below. Holidays occurring on weekends will be observed as directed by the published United States Office of Personnel Management (OPM) calendar.

2.2 Business Relations. Contractor has the responsibility to integrate and coordinate all activity needed to execute the requirement in this procurement. Poor quality performance and potential problems shall be provided with a corrective action plan to be submitted as fast as the situation required. This action include work provided by any subcontractor. All personnel assigned shall provide and maintain satisfactory customer service, professional conduct, and acceptable ethical behavior. Within the bounds of acquisition policy, the VACHS intends to work to find solutions that will be beneficial to both the Government and its Contractors.

2.3 Contract Administration and Management

2.3.1.1 Contracting Officer (CO). The CO is the only person authorized to direct changes in any of the requirements under this contract, and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely in the CO. In the event the contractor effects any such change at the direction of any person other than the CO, the change will be considered to have been made without authority and solely at the risk of the contractor. All contract administration will be affected by the CO. Communications pertaining to contractual administrative matters shall be addressed to the CO. No changes in or deviation from the terms and conditions shall be effected, without a written modification to the contract, executed by the CO authorizing such changes.

2.3.2 Contractor Employees. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work specified herein. The contractor shall ensure the labor categories/occupation code as defined by the Department of Labor are aligned to those tasks delineated in this PWS. The contractor shall comply with the minimum rates established in the applicable wage determination for this service. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

2.3.2.1 Contractor Identification. All contract personnel shall be identified as a Contractor (i.e., badge, company logo, or uniform). All contract personnel are required to identify themselves such that they avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all correspondence (documents, emails, etc.) or reports produced by the Contractor are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

2.3.3 Key Personnel. The contractor shall provide a point of contact to administer this contract. All key personnel shall have means of verbal and e-mail communication with the Government Technical Representative. Key personnel and alternates must be able to communicate fluently in English both verbally and in writing.

2.3.4 Personnel Qualification:

2.3.4.1 Contractor personnel shall have completed at least a one-year trade school and have five years successful experience in this field.

2.3.4.2 Contractor personnel working under this requirement shall have the following certifications (certifications to be provided within 10 calendar days after contract award):

a. OSHA 10-Hour General Industry

b. Confined Space

c. Fall Protection

d. Respiratory Protection

2.3.4.3 National Association of Corrosion Engineers (NACE). Cathodic protection system inspection and evaluation shall be performed by a NACE certified specialist.

2.3.5 Standards of Conduct. Standards of Conduct. Contractor personnel’s conduct shall not reflect discredit upon the Government. The Contractor shall ensure that personnel present a professional appearance. Contractor’s employees shall observe and comply with all local policies and procedures concerning fire, safety, environmental protection, sanitation, security, and possession of firearms or other lethal or illegal weapons or substances. The Contractor is responsible for ensuring that any contractor employees providing services under this contract conduct themselves and perform services in a professional, safe, and responsible manner. The contractor shall remove, from the job site, any employee for reasons of misconduct or security. The contractor shall ensure employee conduct complies with 41 U.S.C. 423, Procurement Integrity. The contractor shall also ensure that no contractor employees conduct political related activities or events on VACHS facilities.

2.3.6 Contractor personnel and property shall be subject to search and seizure upon entering and leaving the confines of VACHS facilities. The Contractor shall be responsible for assuring that all personnel authorized to perform work under this contract obtain facilities’ access as required. The Contractor shall provide to the Government Technical Representative a personnel roster listing. The Contractor shall always maintain an updated listing. New employees shall comply with the minimum requirements listed in this PWS. Contractor access to the VA facilities shall be exclusively for work in connection with this contract.

2.3.7 Contractor is responsible for the supervision of all their employees while on government property. It is the Contractor's responsibility to assure compliance with this PWS and requirements referenced in this contract. Provisions provided in the PWS are not intended to relieve the Contractor of this responsibility.

2.3.8 Contractor personnel may be required to interrupt their work at any time so as riot to interfere, with the normal functioning of the facility, including utility services, fire protection systems, and passage of facility patients, personnel, equipment, and carts.

2.3.9 Health and Safety. The contractor and its subcontractors, if any, shall comply with Public Law 91-596, Occupational Safety and Health Act (OSHA). In addition, all contractor’s personnel, and its subcontractors, if any, shall have the 10-hour Occupational Safety and Health Administration (OSHA) General Industry training and certifications to provide the services requested in this PWS. The contractor shall assume full responsibility and liability for compliance with all applicable regulations pertaining to the health and safety of personnel during the execution of work. All applicable standards of the OSHA shall be followed when working in accordance with this project.

2.3.9.1 Occupants Safety. The contractor shall take all safety precautions and safety measurement necessary to protect the lives and health of occupants of the building and user of the equipment. No process or materials shall be employed in such a manner that they will introduce additional hazards into occupied space. In addition, shall have in place and be responsible of enforcing it, a safety program/procedure, which shall be followed by their employees in the performance of their duties.

2.3.9.2 In performance of this contract, the Contractor shall follow Veterans Affairs Central Office (VACO) Directive 7710, Occupational Safety and Health, for safe work practices. The Contractor shall comply with VACHS smoking policy, which designates all space as non-smoking areas.

2.3.9.3 The Contractor is responsible for identifying, providing, and maintaining all personal protective equipment (PPE) required to perform the duties outlined in this requirement. In addition, the contractor is responsible for identifying and providing all applicable safety programs (i.e., lockout/tag out, universal precautions, etc.) required to perform the work. Training on required safety programs and the proper use of PPE's shall be provided, and documentation maintained by the contractor.

2.3.10 Materials and Equipment. All materials to be used in this contract, shall be in accordance with the Environmental Requirements section within this PWS. Contractor shall take very precaution to ensure that environmentally friendly products are used.

2.3.11 Contractor’s vehicles shall be used for their designated purpose only; in operable condition and shall meet all local, state, and federal safety regulations; operated in accordance with al medical center traffic regulations; identified by company name and logo. Due to limited space, the contractor can have a maximum of two (2) vehicles at any given time on VACHS premises.

2.3.12 Injury or Accident Reporting. The Contractor shall maintain an accurate record of accidents resulting in injury or death and accidents resulting in damage to government property, supplies, and equipment.

2.3.13 As defined by OSHA and all other regulatory requirements any incident of a major malfunction, accident or injury, a written report shall be submitted by the Contractor to VACHS within five (5) working days following the incident. The report shall state the cause, what, where and when and why the incident happened and the repairs and tests that were or are to be made to correct the cause of the incident.

2.4 Environmental Requirements.

2.4.1 Executive Orders (EOs) 13990, Protecting Public Health and the Environment and Restoring Science to Tackle the Climate Crisis and 14057, Catalyzing Clean Energy Industries and Jobs Through Federal Sustainability applies to this service. A copy of EO 13990 can be found at the Federal Register webpage at https://www.federalregister.gov/documents/2021/01/25/2021-01765/protecting-public-health-and-the-environment-and-restoring-science-to-tackle-the-climate-crisis; EO 14057 can be found at https://www.federalregister.gov/documents/2021/12/13/2021-27114/catalyzing-clean-energy-industries-and-jobs-through-federal-sustainability.

2.4.2 Environmental Compliance. The Contractor shall comply with all federal, state, local and facility environmental laws, rules, and plans.

2.4.3 All containers holding chemicals and/or cleaning solutions shall be properly labeled with the name and strength of the agent therein.

2.5 Liability and Responsibility for Damaged Property.

2.5.1 Damage to Government Property. The contractor shall be held responsible for cleaning up all spillage and/or leakage at no additional cost to the government. The contractor shall be held liable for damage or destruction of Government property (e.g., buildings, vehicles, sidewalks, fences, etc.) caused by the contractor, contractor personnel or representatives of the contractor in the performance of services on this contract. The contractor shall submit their damage report to the Government Technical Representative within 24 hours of damage and shall include the repairs and corrective action plan, as applicable. If the contractor fails to take the required corrective action, the government retains the right to exercise other rights or remedies available to the CO.

2.5.2 Damage to Privately-Owned Property. The Contractor shall be held liable for damage or destruction of privately owned property (e.g., privately owned vehicles), as defined in this PWS, caused by the contractor, contractor personnel or representatives of the contractor in the performance of services in this contract. The contractor shall take corrective action within 5 working days to repair damages or replace destroyed property. Contractor shall purchase and always maintain a general third-party liability insurance policy of not less than $500,000 per event coverage (See FAR Clause 52.228-5).

2.5.3 Damage Reports. The contractor shall submit a damage report to the CO and designated representative within 24 hours of damage or destruction to government property or privately owned property caused by the contractor, contractor personnel or representatives of the contractor. The damage report shall detail the facts and the extent of damages or destruction, and the corrective action taken by the contractor to repair damages or replace destroyed property.

2.6 Influenza vaccine.

2.6.1 “Flu Shot” is mandatory for all VHA employees and contractors as per VHA Directive 1192.0. Contractor shall provide a list of employees under contract performance with their vaccination compliance. This requirement is to be submitted annually. Employees and Contractors who are not vaccinated as per authorized exclusions on VHA Directive are to be documented as such and always required to wear healthcare face mask while on VHA premises.

2.7 Ensuring Adequate COVID-19 Safety Protocols for Federal Contractors.

2.7.1 Contractor employees who work in or travel to VHA locations must comply with the following:

2.7.1.1 Documentation requirements:

2.7.1.1.1 If fully vaccinated, shall show proof of vaccination.

NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS-319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination.

2.7.1.1.2 If unvaccinated and granted a medical or religious exception, shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved over-the-counter test.

2.7.1.1.3 Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by the Government Technical Representative or other hospital personnel.

2.7.1.1.4 Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

2.7.2 Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates.

2.7.2.1 Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

2.7.3 Contractor must immediately notify their Government Technical Representative or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.

2.7.4 All contractors’ employees and its representative, to include subcontractors, are required to wear surgical masks face covering during their time at the VACHS.

2.8 Addition and/or removal of work areas and services. VA reserves the right to add and/or remove locations within this contract. All changes, if any, will be made via a supplemental agreement to the contract.

3.0 Performance Requirements. The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform interior pressure washing, disinfection, and cleaning the following tanks on an annual basis:

Water Storage Tank T1

Water Storage Tank T2

Underground Concrete Cistern

3.1.1 The preference is to conduct the cleaning process outside of the hurricane season. Contractor shall minimize the water tanks downtime. The expected turn around per tank is one month.

3.2 Visual Inspection. Contractor shall perform an annual visual inspection for Water Storage Tanks T1 and T2. Visual inspection shall include interior welds, internal coating, and roof-column elements conditions. Contractor shall provide a preliminary report within 2-days after visual inspection is performed and prior starting cleaning/disinfection procedure. Contractor shall include the visual inspection report to final water tank report.

3.3 Cathodic Protection System. Contractor shall perform an annual inspection and evaluation of the existing cathodic protection system for Water Storage Tanks T1 and T2. Contractor shall perform a thorough and complete system evaluation including water tanks internal system elements.

3.4 Disinfection

3.4.1 Submittals. Prior to performing any disinfection procedure, the contractor shall submit method of disinfection to be used, including the exact type and amount of disinfecting agent to be used with a specific volume of water, the tools and method of application, and the intended amount of chlorine residual. The contractor shall also provide Occupational Safety and Health Administration (OSHA), National Sanitation Foundation/American National Standards Institute (NSF/ANSI).

3.4.1.1 Contractor shall provide a detailed work plan and site-specific safety plan within 5 days of contract award and commencement of option periods thereafter.

3.4.2 Testing. The contractor shall be responsible for all pre and post disinfection testing requirements in accordance with AWWA C652-19 and state, local, and federal guidelines. These tests shall confirm the appropriate parameters to confirm that the water quality is appropriate for distribution, including, but not limited to:

a. Total Haloacetic Acids HAA5

b. Total Trihalomethane (TTHMs)

c. Total Coliform

d. E. Coli

e. Chlorine Total

f. pH

g. Alkalinity

h. Turbidity

i. Odor

j. Specific conductance

k. Chlorine residual.

3.4.2.1 Samples shall be representative of the water quality in the tank and shall be sampled separately from the bottom, middle, and top of the tank. Bacteriological tests shall show no coliform and acceptable chlorine residual and PH after cleaning is complete. Should any test result come back out of compliance with the Safe Drinking Water Act or state, local, or federal guidelines regarding potability of water, the contractor shall repeat the disinfection and testing until satisfactory results are obtained. Sampling shall also include the “Optional Sampling and Testing” listed in section 5.1 of AWWA C652-19. A minimum of two pre and post disinfection test samples from each tank shall be taken and shall follow aseptic techniques for bacteria sampling.

3.4.2.2 The laboratory must be an accredited NELAP LAB and for Puerto Rico Department of Health Certified Laboratory for collection and analysis of microbiological and chemical water quality parameters. The testing lab shall be certified through the Environmental Laboratory Certification Program and lab approval must be obtained through the contracting officer.

3.5 Utilities. Contractor shall protect all TTHM system components (installed inside the tanks) from damages. Contractor will be responsible for any damages (physical and functionality) caused to this equipment during the maintenance work. Contractor shall remove equipment parts as needed to fulfill this requirement and re-install once work is completed. Contractor shall not operate any valves without VA consent.

3.6 Scheduling. The contractor shall provide at least two (2) weeks’ notice to the Government Technical Representative prior to performing the work. Designed areas for working space, materials storage and routes of access must be agreed upon by CO/Technical Representative. The cleaning process shall be performed outside of the hurricane season.

3.7 Reports. The contractor shall provide an annual written report verifying the procedure followed, disinfectant type and levels utilized, pre and post disinfection test results, recommendations for improvements to the overall health of the water tanks, and certification that all disinfection and testing procedures complied with AWWA C652-19 and all state, local, and federal guidelines. The final report shall be submitted to facility no more than 10 calendar days of the completion of the work. Preliminary reports shall be available to establish acceptance of work and test results with AWWA C562-19 and all state, local, and federal guidelines.

4.0 Performance Requirements Summary (PRS) Matrix

4.1 The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. The government expects the contractor to perform at a minimum, the identified acceptable levels throughout the life of the contract, and the contractor’s performance shall be given significant consideration when evaluating recommendations for future government contracts and or awards.

4.2 Method of Surveillance: The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards. The Government shall use these standards to determine Contractor performance and shall compare Contractor performance to the Acceptable Quality Level (AQL). Acceptable surveillance methods include: 100% inspection, random inspections, joint inspections, customer’s complaints, or any other appropriate method typically used in this industry. The government may use one or a combination of any of these surveillance methods.

acceptable level

acceptable level

acceptable level

acceptable level

acceptable level

4.3 Quality Assurance. The Government will evaluate the Contractor’s performance under the contract, IAW the PRS Matrix. The Government retains the right to inspect and test all services called for by the contract. The Government will perform inspections and tests in a manner that will not unduly delay the work. If any of the services performed do not conform to contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount.

4.4 Whenever the Government Technical Representative notifies the contractor of any deficiencies detected in the work performed, the contractor shall correct cited deficiencies within seventy-two (72) hours, or as otherwise authorized by the CO, after been notified without affecting the regularly scheduled work.

4.5 Upon satisfactory completion by the Contractor and acceptance of the work completed by the contractor in accordance with this Performance Work Statement, payment will be approved. Failure to complete the work stated in this PWS may result in unfavorable Contractor Performance Assessment Reporting System (CPARS) ratings.

4.6 Quality Control. The contractor shall maintain an effective Quality Control Program to ensure services are performed IAW this PWS. The purpose of this program is to identify, prevent, and ensure non-recurrence of defective services. At a minimum, the program shall include the following:

a. The name(s) of the individual(s) who will perform the services described in contract.

b. A checklist used in the inspection and performance verification of the services. The checklist shall include every requirement included in this PWS.

c. A schedule of the dates programmed for the service requested.

d. A system for identifying and correcting deficiencies in the quality of services before the level of performance becomes unacceptable and/or the Government Technical Representative identifies the deficiencies.

e. In addition to providing the documentation at the end of each service, the contractor is responsible to maintain the required documents of all the services conducted by the Contractor and the corrective actions taken. All documentation shall be made available to the Government during the term of the contract.

5.0 Government Furnish Items. No Government furnish items/services will be provided under this requirement.

6.0 Deliverables

7.0 Related Documents

7.1 Definitions

CONTRACTING OFFICER (CO): A Contracting Officer is a government employee who has authority to enter into, administer, and or terminate contracts, as well as make related determinations and findings on behalf of the Government. (Note: The only individual who can legally bind the Government.)

CONTRACTOR: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

DEFECTIVE SERVICE: A service output that does not meet the standard of performance associated with it in the Performance Work Statement

DELIVERABLE: A tangible or intangible object produced as a result of the project that is intended to be delivered to a customer (either internal or external). Examples of a deliverable are a report, a document, a server upgrade, or any other building block of an overall project.

FISCAL YEAR: A period beginning on October 1 and ending September 30 of the consecutive calendar year. The fiscal year is designated by the calendar year in which it ends.

GOVERNMENT FURNISHED PROPERTY (GFP): All equipment, goods and land possessed by the government and subsequently delivered or otherwise made available to the Contractor.

INSPECTION. Examining and testing supplies or services (including, when appropriate, raw materials, components, and intermediates assemblies) to determine whether they conform to contract requirements

MATERIAL. Property that may be consumed or expended during the performance of a contract, component parts of a higher assembly, or items that lose their individual identity through incorporation into an end-item. Material does not include equipment, special tooling, and special test equipment or real property.

MINOR DISCREPANCIES. Problems identified during maintenance checks that do not require significant time or significant materials to correct, such as loose wires or belts, hoses, clamps, coolant additives and other minor adjustments.

NON-PERSONAL SERVICES. The personnel rendering the services are not subject, either by the contract's terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the government and its employees. Non personal service contracts are authorized by the government in accordance with FAR 37.012, under general contracting authority, and do not require specific statutory authorization.

OCCUPATIONAL SAFETY AND HEALTH ADMINISTRATION (OSHA): Government agency part of the US Department of Labor with the primary responsibility for administrating the Occupational Safety and Health act of 1970. This act has the purpose of preservation of human resource.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

PROPERTY. All tangible property, both real and personal.

QUALITY ASSURANCE (QA): A procedure or set of procedures taken by the Government to ensure that services acquired under government contracts conform to the contract’s quality and quality requirements.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP): A plan specifying the surveillance methodology used by the Government Technical Representative for surveillance of the contractor’s performance.

QUALITY CONTROL (QC): Task performed by the contractor to ensure excellence of the organization’s output.

SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

7.2 Acronym

7.3 Applicable Directives and Publications

The following laws, regulations, policies, and procedures in effect on date of contract issuance and all subsequent changes or updates apply:

29 CFR, Part 1910 Occupational Safety and Health Standards

40 CFR Part 302 Protection of Environment, Designation, Reportable Quantities and Notification

AWWA C652-19 Disinfection of Water Storage Facilities.

EO 13990 Protecting Public Health and the Environment and Restoring Science to Tackle the Climate Crisis

EO 14042 Ensuring Adequate COVID Safety Protocols for Federal Contractors

EO 14057 Catalyzing Clean Energy Industries and Jobs Through Federal Sustainability

FIPS PUB 201-2 Personal Identity Verification (PIV) of Federal Employees and Contractors

HSPD 12 Homeland Security Presidential Directive 12 Policy for a Common Identification Standard for Federal Employees and Contractor

OMB M-05-24 Office of Management and Budget (OMB) Guidance Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors

SDWA Safe Drinking Water Act

VACO Directive 7710 Occupational Safety and Health

Page 1 of Page 1 of Technical Exhibit 1

1.0 VA INFORMATION CUSTODIAL LANGUAGE

A. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

B. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

C. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

D. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

2.0 SECURITY INCIDENT INVESTIGATION:

A. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the Government Technical Representative and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

B. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

C. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

D. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

3.0 LIQUIDATED DAMAGES FOR DATA BREACH:

A. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

B. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

4.0 SECURITY CONTROLS COMPLIANCE TESTING:

A. On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

5.0 TRAINING:

A. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

B. (1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

C. The contractor shall provide to the contracting officer and/or the Government Technical Representative a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

D. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

E. The Certification and Accreditation (C&A) requirements do not apply and a Security Accreditation Package is not required for this SOW.