PCD Shredding BPA SOW.docx

STATEMENT OF WORK

DOCUMENT DESTRUCTION-SHREDDING SERVICES

PACIFIC DISTRICT – NCA

INTRODUCTION: The Contractor shall provide document destruction services. Destruction will be accomplished only at the locations listed using a vehicle equipped for mobile shredding. Work is to be accomplished by bonded employees. Contractor is responsible for maintaining liability insurance for the duration of the contract, and for following all pertinent federal and state regulations about transportation and destruction of classified documentation. All documents shall be shredded on-site and removed from the following premises and transported to an appropriate location to be discarded or recycled. During shredding of the documents, it must be maintained in a secured container in a designated holding area, which will prevent any disclosure or unauthorized access. The destruction of the information must be witnessed either by a federal employee. The locations shall not be required to separate documents by color or grade of paper, nor remove paper clips and other fasteners. Contractor shall furnish keys for the containers provided under this contract. Each container provided shall have information on it listing the acceptable and non-acceptable items that may be placed inside.

Approximately Equipment Standards and Requirements by Location

1. GENERAL REQUIREMENTS:

a) All document shredding will take place on-site, during normal business hours, using a vehicle equipped for mobile shredding and be witnessed by COR.

b) No sensitive materials/records identified for shredding and destruction shall be removed from the cemetery property before properly shredded.

c) The Contractor will provide a written “Certificate of Destruction” to the Contracting Officer monthly to provide verification of the destruction of the contents of all containers and receptacles referenced.

d) Contractor shall meet the intent of VA Directive 6371 Destruction of Temporary paper Records. Document shredding shall meet the shredding guidelines outlined in NIST Special Publication 800-88 Revision 1, Table A-1. Shredding requirement should be aligned with the NIST required crosscut shred size. Destroy paper using crosscut shredders which produce particles that are 1mm x 5mm (0.04 in. x 0.2 in.) in size (or smaller) or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32-inch (2.4 mm) security screen. If shredding deviates from the above specification, PII must be safeguarded until it reaches the stage where it is rendered unreadable through additional means, such as burning or pulping.

e) The final shred size requirements must be met prior to release of the shred to an unprotected environment.

f) Prior to commencing performances of this service, the Contractor will submit a Contingency Plan that includes detailed procedures that will be used in the advent of equipment failure, or any other situations that prevent adherence to the planned schedule of performance, or requirements of this contract.

g) Containers will be replaced by the contractor on a as needed basis. To be provided at no charge.

h) Pick-up location and scheduling for all shredding services will be coordinated with the Contracting Officer Representative (COR) prior to commencement.

i) The contractor will label numerically in sequential order each piece of equipment with its current location (e.g., Facility, Build, and Room). This will be updated during the time of each service and provided to the Contracting Officer Representative (COR) prior to leaving.

j) At times certain facilities may require additional 65/95 Gallon Containers above what is included in the original contract. Appropriate modifications will be submitted to request that the contractor supplies the additional equipment either as a short-term or as a long-term alteration to the original contract.

k) The numbers of containers and drop off stations are estimates based on current requirements. The containers and drop off stations needed may be increased or decreased due to the changes in the number of shredding services required. Additional pickups may be required at more frequent intervals and will be determined/discussed with the COR as the need arises.

2. HOURS OF OPERATION:

a.) Normal Hours: The normal hours of operations at the locations are Monday through Friday from 8:00 am to 4:30 pm, excluding holidays. All work and services will be performed during normal hours of coverage and will be during the period agreed upon by the COR. There should be the capacity to start shredding at 7:00 or 7:30 am up to 4:00 pm, depending on location and volume. This will be communicated ahead of time by the COR.

b.) If a scheduled day for services falls on a Federal Holiday the contractor will provide services, the following day, or a day previous agreed upon with the COR. Also included would be any other day specifically declared by the President of the United States to be a National Holiday.

New Year's Day Martin Luther King's Birthday President's Day Memorial Day Juneteenth Day Fourth of July Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day c.) Communication & Coordination of Work with COR: Communication with the COR (or designee) is strongly encouraged. Burial activities at NCA shall take precedence over contract work activities. Work activity and noise cannot disturb Burial Services. Trucks and workmen are prohibited from passing through the service area during this period.

3. QUALITY CONTROL: The contractor is responsible for developing, implementing, and maintaining a contractor quality assurance program to ensure on-site document destruction meets proper save guarding of documents prior to destruction and disposal.

4. QUALITY ASSURANCE: The government will periodically evaluate the contractor's performance by having the COR monitor performance to ensure services are received. The COR will evaluate the contractor's performance through intermittent on-site inspections of the contractor's performance and receipt of complaints from facility personnel. The government is responsible for validating customer/facility complaints.

5. NOTE: No work other than that called for in this contract is authorized. The Contracting Officer is the only person authorized to enact changes/additions to this contract.

6. PAYMENT: Payments will be made monthly, in arrears, upon successful completion of the above listed requirements and after submission of a record of all services performed, and the receipt of properly prepared Certificates of Destruction and invoiced electronically. A properly prepared invoice shall include at a minimum, the Purchase Order Number, the Contract Number, and the period of performance relative to the invoice.

7. PRIVACY/SECURITY: The Contractor will observe and comply with the VA rules of Conduct and Standards. Contractor is responsible for ensuring all employees coming on station have read and are familiar with VA Directive 6371.

A. Privacy Act Documents: The contractor understands and agrees that property obtained under this contract may contain records previously maintained as a system of records subject to the Privacy Act. The contractor is subject to the provisions of the Privacy Act and is responsible for compliance with its provisions with respect to the handling and disposal of protected information. Additionally, all document destruction and documentation will be as required by the Health Insurance Portability and Accountability Act (HIPAA).

B. Document Destruction Reports. Document destruction reports will be submitted to the COR within 48 hours of pickup and will include the information required to meet HIPAA requirements. At a minimum the report will include:

i. - Date of document pickup.

ii. - Weight/tonnage picked up.

iii. - Date of Destruction.

iv. - Method of Destruction.

v. - Description of the disposed records: Confidential documents.

vi. - Statement that the documents were received secured.

vii. - Statement that the documents were destroyed in the normal course of business.

viii. - The signature of the individuals supervising and witnessing the destruction.

C. Shredding Bin Access. A document-shredding bin may be opened only by the authorized personnel. This provides implemented safeguards to limit incidental, and avoid prohibited uses and disclosures of privacy information, including in connection with the disposal of such information. Secured with a key lock or padlock, and only the Privacy officer or their delegate will be provided with copies of each key (2 keys per COR with an additional 4 sets of keys for the main facility).

8. CONTRACTOR PERSONNEL: The Contractor shall provide qualified employees. The Contractor shall be required to comply with all security requirements of the VA NCA. The Contractor is responsible for ensuring all employees possess all required licenses for operating all equipment used in the execution of this contract. The Contractor shall be responsible for coordinating with the COR and providing all information required of him or his employees for performance of work. The Contractor will be responsible to ensure Contractor employees providing work on this contract are fully trained and completely competent to perform the required work. Contractor personnel must wear a common uniform or identification with the contractor's name printed in neat and professional manner to be easily visible and readable.

a.) Contractor Responsibilities: The contractor is responsible for physical security and safeguarding all government documents. All vehicles/trucks utilized for Document Destruction/Shredding Services must be properly identified with contractor name.

9. PHYSICAL SECURITY: The contractor is responsible for safeguarding all government documents. All vehicles/trucks utilized for Document Destruction/Shredding Services must be properly identified with contractor name.

10. CONTRACTOR VEHICLES: All Contractor vehicles utilized in this contract shall be insured (up to the minimum coverage required by the respective State) and maintain current state vehicle registration. All Contractor employees shall possess a valid State Driver's license and have a clean driving record. The Contractor or his/her employees while performing under this contract shall use no personal vehicles.

11. PROTECTION OF GOVERNMENT PROPERTY: During work execution, the Contractor shall take special care to protect Government property. Contractor shall be responsible to meet all OSHA/Safety requirements in the performance of the work. This shall include but not be limited to taking all the necessary precautions to protect the patients, visitors and/or staff at each location. Contractor shall be held responsible for any injuries and/or damage, which may be caused because of the Contractors failure to adhere to these requirements.

12. IDENTIFICATION, PARKING, SMOKING & VA REGULATIONS: The Contractor's employees shall always wear visible identification while on the premises of the VA NCA. It is the responsibility of the Contractor to park in the appropriate designated parking areas. Information on parking is available from the COR. The VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions. Smoking is prohibited inside any buildings at the VA and is only allowed in designated areas. (A copy of the smoking policy/locations will be provided to the Contractor upon request.) Possession of weapons is prohibited. Enclosed containers, including tool kits, shall be subject to search. Violations of VA regulations may result in citation answerable in the United States (Federal) District Court, not a local district, state, or municipal court.

INFORMATION SYSTEM SECURITY AND PRIVACY

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG)and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

i. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

3. TRAINING. This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role- based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

4. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages— Reimbursement for Data Breach Costs.

(End of Work Statement)