RRVAMC-PWS_WaaS-Final.docx

ATTACHMENT A – List of Supplies to be Relocated to Contractor Facility

1.0 BACKGROUND

The Veterans Health Administration (VHA) Robley Rex VA Medical Center (RRVAMC) requires warehousing support services to supplement existing capacity.

The Louisville VAMC (Dept. of VHA) requires a warehousing support service, aka Warehouse as a Service (WaaS), managed and staffed by contract-awarded personnel, to provide comprehensive warehousing support services at a minimum during the period 01 August 2026 through 30 September 2027. The warehouse will support the storage, management, and distribution of medical and non-medical supplies critical for VA operations. Contractor shall provide the necessary storage, labor, transportation, equipment, and supplies to meet the required services in this PWS.

· The warehouse shall be up to 20,000 square feet and have a minimum of 22' high ceiling capable of accommodating multi-level shelving (minimum 2 shelves high). Warehouse includes a secure storage space with at least 1 loading dock.

· Of the 20,000 square foot space, a minimum area of 1,000 square feet shall be secured with specific security requirements for information technology (IT) equipment; and a minimum area of appx. 1,000 square feet must be made available for administrative office space to include a break room/kitchen, bathroom(s) for VA personnel.

Louisville VAMC Supply Chain Management Staff shall have access and coordination including:

Primary Staff from Government shall have use of a the WaaS would be: the Supply Chain Management Staff… Leadership, Warehouse Supervisor, Material Handlers… during regular duty hours.

Secondary Staff would be those Facility Maintenance Staff that could have requirements after normal duty hours (i.e. electrician, electronics tech, flooring contractor, OI & T tech, plumber, and carpenter, not all-inclusive) shall perform their assigned duties as-needed.

Overall, during regular work times [8:00AM - 4:30PM, Monday – Friday, excluding weekends and federal holidays], at a minimum, the RRVAMC will always have two personnel on site.

Special Requirements shall include as follows:

· The C&A requirements do not apply, and a Security Accreditation Package is not required.

· Standard Security requirements, w/ Specifics for holding/warehousing VA IT Equipment so that double-lock security requirement (specific room or cage within the warehouse would be acceptable) is addressed.

· Temperature and humidity control.

· Emergent requests include, but are not limited to, support services for patient

2.0 SCOPE OF WORK

2.1 The contract shall provide the VHA with all warehousing services necessary and ensure continuity of access to, and delivery of, VA procured healthcare supplies (including Personal Protection Equipment [PPE]), such as masks, isolation gowns, etc.) to Veterans. The Contractor is to safeguard all government healthcare supplies and equipment that may be housed in the Contractor location.

2.2 In support of this initiative, the contractor shall provide a full range of logistical support services and warehouse operations such as receiving, inventory management, staging, and delivery for VA Warehousing in support of the RRVAMC. The Contractor shall receive, oversee, process, store, and repackage property if needed (e.g. medical supplies and equipment) and schedule deliveries and pickup among other tasks. Contractor shall unpackage, store, repackage, and deliver property to the identified location. This includes movement from one location to another, receipt of new deliveries, and relocating property. All deliveries will be inspected and accepted by VA employee prior to storage in contractor facility.

2.3 Contractor shall be responsible for using the proper equipment to ensure efficient and careful transportation of equipment, furniture, and any other stored items. Proper equipment will include but will not be limited to closed moving vans with lift gates, closed security carriers for transporting equipment, rubber-wheeled dollies (in good condition and free of grease and dirt), aluminum or magnesium ramps of various sizes, cartons and bins, motorized pallet jacks, and a safe jack.

2.4 The warehouse facility shall be owned/leased by the contractor and shall ideally be located within 30 minutes driving distance of the RRVAMC as government expects daily deliveries between RRVAMC and the new contractor warehouse site. The Contractor shall have storage facilities sufficient to contain VA items in secure and climate-controlled conditions that will preserve the operability of the items stored.

2.5 Contractor shall comply with all applicable Federal, State, local and industry safety, i.e., OSHA, Department of Labor (DOL), and health standards, regulations and statutes pertaining to the operation of the warehouse and/or distribution of commodities, including healthcare supplies, identified herein. The facility must be kept clean and uncluttered (i.e. no visible dust on products), cleaned at least once weekly to avoid contamination. VA equipment is to be wrapped with stretch wrap and covered for protection against damage. Contractor is to manage pest control; the facility is to remain free of insects, rodents, and other vermin.

2.6 Contractor's facility shall meet all industry standards for fire alarms and suppression systems for the commodities being warehoused. Facility shall also have individual 24/7 monitored alarm access and shall comply in accordance with the Code of Federal Regulations (CFR) Title 21, to maintain inventory in controlled warehouse storage.

2.7 VA Medical/Surgical Supplies/equipment shall be segregated by a cage or other defining material for quick identification purposes. Supplies shall be stored in a temperature-controlled environment. Storage locations must be a stable environment without extreme changes in temperature and humidity. Items stored within these locations must comply with temperature and humidity requirements in accordance with manufacturer specifications. At a minimum, supply storage areas must meet the following specifications: Relative Humidity < 75 %, Temperature 64 – 78 degrees Fahrenheit.

2.8 Contractor shall be responsible for relocating for storage VA identified racking, dunnage, equipment and supplies from the current location of 1700 Mellwood Ave, Louisville, KY 40206, to Contractor’s facility NLT 21 September 2026, this allows Government sufficient time to ensure no accountability of equipment, supplies, etc. before turning the existing warehouse back to the current lessor.

2.9 Contractor shall receive and process up to potentially 20 pallets daily, Monday through Friday. The Contractor shall have the means to pick up VA items from RRVAMC, deliver those items to the Contractor’s storage facility, and have the means to deliver stored items to VA facilities as directed. To properly receive and deliver items the Contractor’s facility must have a functional receiving dock. Deliveries shall incorporate sufficient packing to comply with all applicable federal and/or state standards relating to shipment of these products. Transportation vehicle used to deliver products should complement the dock configuration so products are off-loaded efficiently, and products removed from the truck/transportation vehicle by the contractor with contractor material handling equipment; no government furnished equipment will be provided.

2.10 Contractor shall provide delivery of Medical/Surgical Supplies/Equipment from the warehouse facility to the medical facility listed in this contract. Delivery will be needed in emergency and non-emergency cases, as needed and requested by the VA.

2.10.1 Regular/routine deliveries, after proper notification utilizing agreed upon method, are to be made Monday through Friday, next business day. Routine deliveries are to be made during normal business hours. A standard delivery will consist of up to 10 pallets.

2.10.2 Emergency Deliveries are to be made within four hours of request. If the VA requests an emergency item, and it can be added to the regular delivery, the contractor shall add the item to the regular delivery for a single, regular delivery fee. If the VA requests an emergency delivery outside of the regular delivery timeframe, the contractor shall have the capability of delivering supplies 24 hours a day, 7 days a week on an emergency basis. It is anticipated this will occur rarely.

2.11 At the request of the VA, supplies and equipment may be available via will call. Will call orders may be picked up by government employees identified by the VA COR.

2.12 Contractor shall maintain an electronic database of all merchandise stored and cross reference this data with VA IFCAP numbers. Information shall contain item description, stock number, case quantities on hand, packaging multiples, vendor information, quantity per pallet, and pallet count. Contractor shall provide and maintain an up-to-date web-based inventory management system that can be accessed by key VA personnel. The web-based inventory system is subject to the approval of the VA and must comply with all federal and VA IT policies and requirements. For example, it must have a username and password protection.

2.13 Contractor shall provide an electronic mechanism to request all medical/surgical supplies/equipment for usage at VA LOU VAMC. This tool is also subject to the approval of the VA and must comply with all federal and VA IT policies and requirements.

2.14 Access Control Log shall include: All individuals (contractor personnel or VA Employee) are to sign-in and sign-out when accessing space where VA supplies or equipment are stored. A copy of the log is to be provided to the COR monthly. Log is to be made available on demand if requested.

2.15 Contractor shall provide full access for VA personnel for warehouse inspection during normal business hours. In addition, access via individual keyed entry to the supply/products shall be available 24/7. If emergency access is required, the VA will ensure appropriate communication will take place with the contractor.

2.16 Examples of types of Medical/Surgical supplies/devices/equipment The following list of items provides examples of the types of medical devices and supplies that may need to be stored under this contract in the future. This list is not all inclusive.

Item

Item

Beds, Electric, ICU Capable

IV Poles

Ventilators, Bedside/Intensive Care

Cavi-wipes

Ventilators, Transport

N95 Masks

Ventilators, Noninvasive Positive Pressure

KN95 Masks

Infusion Controllers

Face Shields

Infusion Pumps, Analgesic, Patient-Controlled

Disposable Gowns

Monitors, Physio, Bedside

Reusable Gowns

Defibrillators, Cardiac

Lab Kits

Electrocardiograph: EKG

Virex

Hospital Stretchers

Surgical Masks

Oxygen Concentrators

Gloves

Thermometers

Bouffant Caps

Portable Generator

Shoe Covers

Portable HVAC

Water Jugs

Cots

ECG Electrodes

Air Cleaners

Hand Sanitizer

Portable Toilet, Portable Sinks

Urinal

Flooring

O2 Tubing

Traffic Signs

Gowns

Toilet Paper

Socks

Hi Flow Nasal Cannula

BP Cuffs

Art Line Supplies

Temp Probes

Humidifier and Connectors

Pulse Ox Cables

Ventilator Supplies

Personal Care Items

Needles

Peri-Care Wipes

IV Supplies

Feeding Tube Supplies

PAPRs and PAPR Supplies (mask, hoses, and filters)

Pajamas

2.17 Contractor shall provide complete warehouse management services for an average of 340 pallets for up to 32 line items with expansion capabilities up to a maximum of 600 pallets. A standard pallet is 40x48 inches, with a maximum height of 7 feet (approximately 86.5 cubic feet per pallet). See Attachment A for the list of current supplies and units to be relocated and stored at contractor facility.

3.0 PERFORMANCE PERIOD

The period of performance (PoP) follows:

· Tentatively August 1, 2026 through July 31, 2027 with a one-year option period from August 1, 2027 through July 31, 2028.

Federal Holidays: The Contractor shall not be required to perform duties on Federal holidays as observed by the RRVAMC and any other day specifically declared by the President of the United States to be a Federal holiday.

4.0 PLACE OF PERFORMANCE

Tasks under this contract shall be performed at Contractor Facility and commodities delivered to the designated VA facility located at RRVAMC and/or our future location at 4906 Brownsboro Road, Louisville KY 40222.

5.0 KICKOFF MEETING

The Government will host a kickoff meeting within three (3) business days after contract award (if required).

6.0 TASKS AND DELIVERABLES

The Contractor shall perform the Tasks contained herein. The Contractor shall provide all labor resources necessary to accomplish the deliverables described herein.

6.1 PROJECT MANAGEMENT

The Contractor shall appoint an Onsite Supervisor who will be the single point of contact between the Contractor and the Government. The Onsite Supervisor shall be responsible for ensuring that the deliverables set forth in this document are delivered on schedule and that they meet the requirements of the PWS. Onsite Supervisor shall provide management briefings, as required. The onsite supervisor or designee shall always be available when contract work is in progress to receive notices, reports or requests from the Contracting Officer’s Representative (COR).

Deliverable 001: Daily Inbound/Outbound Delivery Report to include times of deliveries (time/date requested, and time/date delivered) Deliverable 002: Weekly On-hand Status Report Deliverable 003: Monthly inspection reports of product inventory for expiration dates. Notify the COR of any product that expires within 12 months.

Deliverable 004: Stock rotation by pulling orders from the oldest available stock for any order received and replacing it with fresh product from VA inventory utilizing first-in-first-out. Stock items that are rotated and have a different expiration date than previously reported must be highlighted on the monthly report.

Deliverable 005: Monthly report on environmental monitors – temperature, humidity, pest control maintenance, cleaning schedules Deliverable 006: Daily discrepancy/damaged goods report Deliverable 007: Access Control Log – copy provided monthly to the COR

6.2 WAREHOUSE OPERATIONS AND LOGISTICS SUPPORT SERVICES

Contractor shall provide the following warehouse operations and logistics support services.

6.2.1 RISKS ASSET MANAGEMENT

The Contractor shall provide Receipt, Inventory, Integration, and Delivery support using multiple asset management processes and systems, as required.

6.2.2 MONTHLY WAREHOUSE OPERATIONS SERVICES

6.2.2.1 RECEIPT

· Review accuracy of all assets delivered to warehouse are in accordance with approved invoice or associated Bill of Lading, including verification of asset counts.

· Inspect deliveries for damages, document condition upon receipt and notify COR of any discrepancies.

· Deliverable 001 – Daily Inbound/Outbound Delivery Report

6.2.2.2 INVENTORY

· Track all packages from receipt to delivery.

· Open packages and check received goods and materials, as required.

· Initiate inventory within the contractor web-based inventory management system described in 2.11.

· Deliverable 002 – Weekly On-hand Status Report

6.2.2.3 INTEGRATION

· Store assets and ability to quickly retrieve stored assets upon request.

· Capture assets by pallet and rack location within the designated staging facility.

· Verify assets using inventories and inventory verification processes.

· Deliverable 002 – Weekly On-hand Status Report

· Deliverable 003 – Report of product inventory with expiration dates

6.2.2.4 SHIPPING/DELIVERY

· Provide detailed inventory lists and enable supply transactions.

6.2.2.5. INSPECTION

· Regular Inspection and Maintenance: The Contractor shall regularly inspect and maintain stored VA items in accordance with manufacturers’ requirements.

· Deliverable 005 – Environmental Monitors Report – to include at a minimum temperature, humidity, pest control, cleaning

6.2.3. MONTHLY OFFSITE STORAGE FACILITY RENTAL of required utilized rented square footage.

6.2.4 ROUTINE PICKUP/DELIVERY SERVICES

6.2.5 EMERGENCY PICKUP/DELIVERY SERVICES

7.0 MANAGEMENT PLAN, AND SAFETY PLAN

The Contractor's General Management Plan and Warehouse Safety Plan, as presented in its proposal, will be incorporated as part of the contract award and implemented upon award.

8.0 DRESS CODE

Contractor shall maintain a neat and professional appearance including good personal hygiene. Facial hair must be neat and trimmed and shall not impede safety attire application. All contractors are required to wear designated safety apparel per National and State guidance within the facility until otherwise directed. All contractors shall wear closed-toed shoes and safety attire as required in performance of warehouse operations.

9.0 SCHEDULE FOR DELIVERABLES

Note: Deliverables with due dates falling on a weekend or holiday shall be submitted the previous Government workday before the weekend or holiday unless an emergency delivery is requested.

Number

10.0 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor will deliver documentation in electronic format, unless otherwise directed.

11.0 CONTRACTOR PERSONNEL SECURITY

12.0 CONTRACTOR PERSONNEL NON-SECURITY REQUIREMENTS

13.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Purpose: To ensure the Government has an effective and systematic method of surveillance for the services herein. This plan will serve as a tool to verify the Contractor is performing all services required in a timely, accurate, and complete fashion.

Performance measures for this initiative are defined in the table below:

Standard

Levels

Minimum Quality Standard - Performance will meet standard 90% of the time

Minimum Quality Standard - Performance will meet standard 95% of the time

Minimum Quality Standard - Performance will meet standard 100% of the time

Minimum Quality Standard - All deliverables are met 98% of the time.

Disincentives Negative CPARs reporting

14.0 NON-PERSONAL SERVICES CONTRACT

This contract is a non-personal services contract as defined in the FAR at subpart 37.101. It is understood and agreed that the Contractor and/or Contractor's employees and subcontractors:

A. shall perform the services specified herein as independent contractors, not as employees of the government;

B. shall be responsible for their own management and administration of the work required and bear sole responsibility for complying with any and all technical, schedule, or financial requirements or constraints attendant to the performance of this contract;

C. shall be free from supervision or control by any government employee with respect to the manner or method of performance of the services specified; but D. shall, pursuant to the government's right and obligation to inspect, accept or reject the work, comply with such general direction of the Contracting Officer, or the duly authorized representative of the Contracting Officer, as is necessary to ensure accomplishment of the contract objectives.

15.0 VA INFORMATION CUSTODIAL LANGUAGE

A. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

B. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

C. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

D. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

E. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

F. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

G. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

H. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

I. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

J. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: i. in response to a qualifying order of a court of competent jurisdiction after notification to VA CO ii. with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

K. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

L. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

M. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

N. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

O. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

P. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of VA CO.

16.0 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

A. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliates of contractor/subcontractor and agents of contractor/subcontractor.

B. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

C. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

D. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

E. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

1. Contractor/subcontractor personnel no longer have a need for access to VA information or VA information systems.

2. Contractor/subcontractor personnel are terminated, suspended, or otherwise have their work on a VA project discontinued for any reason.

3. Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

4. Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

5. Contractor/subcontractor personnel have their authorization to work in the United States revoked.

6. Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

F. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include: removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

G. Contractors/subcontractors who no longer require VA access will return VA-issued property to VA. This property includes documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

H. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

1. VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

2. Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

3. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

I. The contractor shall provide the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

J. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

17.0 SECURITY INCIDENT INVESTIGATION

A. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

B. Violation of this section shall be investigated in accordance with VA Handbook 6500.6.

18.0 RECORDS MANAGEMENT OBLIGATIONS

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” As defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. Includes Department of Veterans Affairs (VA) records.

2. Does not include personal materials.

3. Applies to records created, received, or maintained by Contractors pursuant to their VA contract.

4. May include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government. These records must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. The VA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of the VA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the VA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the Statement of Work (SOW) or Performance Work Statement (PWS). The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/ or equipment is no longer required, it shall be returned to the VAs control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the Statement of Work (SOW) or Performance Work Statement (PWS). Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and the VAs guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with the VAs policy.

8. The Contractor shall not create or maintain any records containing any non-public VA information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. The VA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which the VA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.

D. Flowdown of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this Statement of Work (SOW) or Performance Work Statement (PWS) and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

PERFORMANCE WORK STATEMENT (PWS)

(PWS) Warehouse as a Service

Warehouse Contents:

Item Groups and Capital Assets

Item Group

$ 1,832,000.00

Capital Assets

Est. Value

Ea./3 Tier

$ 105,100.00

Warehouse Contents (Commodity Group Items and Capital Assets) TOTAL:

$ 1,937,100.00