PWS RCV Incineration Services FY 2025 revised final 625 DRAFT.docx

1.0 INTRODUCTION

The Department of Veterans Affairs (VA), Financial Services Center (FSC), Records Center & Vault (RCV) requires off-site incineration services for 25,200 lbs. of microfilm records (16-mm microfilm reels, 4” film rolls, and 4” x 6” film sheets) that have met agency retention. The records contain personal identifiable information (PII) and must be destroyed to satisfy NIST 800-88 hard copy microform standards.

The 16 pallets of banded/shrink-wrapped records consist of 722 sealed, 1-cubic ft. corrugated boxes, that are ready for immediate pickup at the RCV dock located in Neosho, Missouri. The filmed images are administrative financial/payment records from the 1950s through the 1990s. The plastic and paper boxes and sleeves containing individual microfilm reels and sheets must be burned with the film.

Contractor is responsible for all costs associated with this effort upon retrieval of the palletized records from the VA. This includes but is not limited to subcontractor requirements for film to be analyzed prior to incineration, shipping film between contractor’s secure storage and incineration sites, etc.

Contractor shall provide with their proposal:

· proof they are bonded, insured, and have a current NAID AAA or ISO 9000:2015 certification;

· verification contractor/subcontractors meet all requirements of VA Directive 6371, Appendix A, Minimum Standards for Information Destruction;

· physical locations of contractor temporary storage and incineration sites for VA records; and,

· whether testing/composition analysis of film prior to incineration is required.

The Government will not exercise any supervision or control over the contract service providers. The Contractor shall perform to the standards specified in this Performance Work Statement (PWS). Contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and nonpersonal services necessary as defined in the PWS. The VA Contracting Officer (CO) will assign a VA Contracting Officer’s Representative (COR) to monitor contractor’s performance.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the most recent versions of the following:

1. 5 U.S.C. § 552a, as amended, The Privacy Act of 1974

2. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964

3. VA Directive 6300, Records and Information Management

4. VA Handbook, 6300.1, Records Management Procedures

5. VA Directive 6371, Destruction of Temporary Paper Records

6. VA Handbook 6500, VA Information Security Program

7. VA Handbook 6500.1, Electronic Media Sanitization

8. VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information (SPI)

9. VA Handbook 6500.3, Assessment, Authorization, And Continuous Monitoring of VA Information Systems

10. VA Handbook 6500.6, Contract Security

11. VA Directive 6502, VA Enterprise Privacy Program

12. National Institute of Standards and Technology NIST 800-88 Guidelines for Media Sanitation.

13. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information

14. Federal Records Act, 44 U.S.C. Chapter 31

15. Freedom of Information Act, 5 U.S.C. §552

16. 36 CFR 1220.18, General Definitions

17. 41 CFR Part 101-45, Sale, Abandonment, or Destruction of Personal Property

18. Social Security Number (SSN) Fraud Prevention Act of 2017

3.0 PERFORMANCE DETAILS:

3.1 PERFORMANCE PERIOD

The period of performance (PoP) is completion within 45 days following award. See Price Schedule for period of performance dates.

3.2 PLACE OF PERFORMANCE

Incineration shall be completed no later than 14 days following record removal from the VA premises. The palletized and sealed box contents shall remain unopened in contractor’s secured storage area until incineration occurs. Contractor shall immediately notify the VA COR and return VA palletized records to contractor’s secured storage location if incineration is postponed due to scheduling conflicts, equipment breakdowns, etc. The VA prefers incineration services be performed within a 200-mile radius of the RCV’s Neosho, MO facility.

Pallet retrieval and incineration services shall occur on business days (Monday through Friday between the hours of 7:00 AM and 5:00 PM Central Standard Time) excluding federal holidays.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows. Under current definitions, five (5) are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

3.3 CONTRACT TYPE

Purchase Order will be Firm Fixed Price.

3.4 Travel

No travel is authorized.

3.5 Government Furnished Property/Equipment

The Government will not be furnishing any property and/or equipment as part of this requirement.

The Contractor shall furnish all personnel, supervision, facilities, materials, equipment, and services necessary to fulfill the requirements of this contract.

4.0 SPECIFIC TASKS AND DELIVERABLES

4.1 Task – Kick-off Meeting

The Contractor shall attend a Kick-Off Meeting with the Contracting Officer (CO), Contract Specialist (CS), and the COR no later than (NLT) five (5) business days after the date of award. The purpose of the Kick-Off Meeting is to discuss technical and contracting objectives of this contract. Kick-Off Meeting will be virtual. The Contractor shall coordinate the scheduling of the meeting, the agenda, and deliver meeting minutes. The Contractor shall present:

1. Agenda and kick off meeting minutes, and

2. Introduction of the Contractor’s team.

Deliverables):

The Contractor shall provide meeting minutes, and agenda.

4.2 Task – (CLIN 0001)

The Contractor shall provide incineration services for 25,200 lbs. of microfilm/microfiche to meet NIST 800-88 standards (reduce film to white ash, making recognition or reconstruction of the information impossible). Also, the contractor will be responsible for disposal of all packing materials including the 1-cubic ft. corrugated boxes and pallets, and ash of incinerated materials.

Contractor is responsible for paying all transportation and travel costs associated with the incineration services. This includes but is not limited to shipping and any contingencies upon departure of records from the RCV site through final destruction.

Allow for inspection upon request by a VA representative, of the contractor (and subcontractor or third party) facilities.

The contractor shall issue signed Interim “Certificate(s) of Destruction” when palletized records are retrieved and signed final Certificate(s) of Destruction once the retrieved boxes and their contents have been destroyed. (See Attachments A and B).

Deliverable(s):

A signed electronic (or hard copy) of the Interim Certificate of Destruction for each shipment of records retrieved for incineration. Issue to VA COR prior to departure from the RCV. A signed electronic Final Certificate of Destruction to VA COR for each shipment of records three (3) business days following completion of incineration services.

4.3 Task Other Required Documents

Contractor to provide VA CO and COR written documentation that Contractor is bonded, insured, and has a current NAID AAA or ISO 9000:2015 certification.

Provide chain of custody documentation that details physical locations the microfilm will be temporarily stored, processed, incinerated, and where ash is disposed.

Notify CO in advance for approval if subcontractor requires VA microfilm to be analyzed prior to incineration.

Verify in writing contractor and all subcontractors meet the requirements of VA Directive 6371, Appendix A, Minimum Standards for Information Destruction. The Contractor shall provide documentation that the contractor (or subcontractor or third party) who accepts custody of the temporary records can provide reasonable physical safeguards throughout the destruction process; or, if one or more subcontractors (or third parties) handle VA temporary records before final destruction, then the contractor shall provide documentation to the VA COR that all parties have sufficient reasonable safeguards for the temporary records and the same standards required of the primary contractor, throughout the destruction process.

The Contractor shall provide the below documents to the Contracting Officer’s Representative (COR):

1. Written electronic documentation for bonded, insured and NAID AAA or ISO 9000:2015 certified.

2. If applicable, notify both CO and COR in advance for approval if subcontractor requires VA microfilm be analyzed prior to incineration.

3. If applicable, written electronic documentation that identifies all subcontractors, and the chain of custody process including site names and physical addresses where the VA records will be temporarily stored, processed, and incinerated.

4.4 Deliverables:

Deliverables shall be scheduled with the CO/COR:

Not Separately Priced. Written verification to CO/COR five (5) business days after award and each recertification. Email to COR.

Not Separately Priced. Written verification to CO/COR five (5) business days after award and each recertification. Email to COR.

5.0 GENERAL REQUIREMENTS

5.1 SECURITY AND PRIVACY REQUIREMENTS

The records do not contain protected health information (PHI). A signed Business Associate Agreement (BAA) is not required.

5.1.1 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Records are financial/payment related and contain Personal Identifiable Information (PII). Records shall remain palletized in their sealed corrugated boxes until incineration services are performed.

Contractor Responsibilities:

a. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. Where damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident. Government shall not be held responsible for damage to Contractor’s equipment.

5.2 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless directed otherwise in the Deliverables 4.4 of the solicitation/contract. Acceptable electronic media include MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

5.3 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with this effort.

Performance Objective

of Performance

2. Responds within 24 hours to VA requests for project status and information.

3. Notifies VA COR in advance of potential problems.

Satisfactory or higher

B. Project Milestones and Schedule

1. Incineration is completed within contract period of performance timeframe.

2. Certificates of Destruction and invoices accurately completed and delivered in accordance with the established schedule.

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

5.4 FACILITY/RESOURCE PROVISIONS

For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A - ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

ADDENDUM A

A1.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall always wear visible identification while they are on the premises.

2. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A2.0 Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

5. Contractor shall train all their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to VA and Veteran financial/payment data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

ADDENDUM B

B1. GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

B2. VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

3. The Contractor/Subcontractor shall not make copies of VA information.

4. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

5. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The

Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

6. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above-mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

B3. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

B4. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The Contractor/Subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1) Nature of the event (loss, theft, unauthorized access);

2) Description of the event, including:

a) date of occurrence;

b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

3) Number of individuals affected or potentially affected;

4) Names of individuals or groups affected or potentially affected;

5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

6) Amount of time the data has been out of VA control;

7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

8) Known misuses of data containing sensitive personal information, if any;

9) Assessment of the potential harm to the affected individuals;

10) Data breach analysis as outlined in 6500.2 Handbook, Management of Breaches Involving Sensitive Personal Information, as appropriate; and

11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

Attachment A

Interim Certificate of Destruction

This certifies that the following materials were picked up from the Department of Veterans Affairs facility located at 11693 Lime Kiln Dr., Neosho, MO 64850, for incineration that will be performed to meet NIST 800-88 requirements.

Microfilm/Microfiche

All material shall be protected from disclosure in accordance with provisions of the Privacy Act and VA Directive 6300.1, Records Management Procedures. Release of this material or its contents prior to incineration is a violation of the Privacy Act of 1974 and VA regulations and could involve imposition of criminal penalties.

Print Name: _______________________ Print Name: _______________________

Signature: ________________________ Signature: ________________________

Attachment B

Final Certificate of Destruction

Company Name: _________________________________________________

Company Address: ________________________________________________

Phone Number: __________________________________________________

Truck/Trailer # ________________________________________________________

Total Pallets/Box Count __________________________________________________

Pickup Date: __________________________________________________________

On ___________________, pallet numbers __________ through __________, containing a total of __________ boxes of microfilm/microfiche were incinerated to meet NIST 800-88 standards at:

(insert contractor incineration site name and address):

Contractor Signature: ____________________________________

Date: ____________________________________ image1.jpeg