S02 - Attachment 01 - SOW - 672-26-110 Repair Water Tanks Deficiencies - 23 Pages.docx

SCOPE OF WORK

PROJECT NO.: 672-26-110

REPAIR WATER TANKS DEFICIENCIES

1.0 FOREWORD

1.1. Provide all labor, materials, tools, equipment, and all other resources necessary for the construction of the proposed project at the VA Caribbean Healthcare System (VACHS) in accordance with the procurement documents and specifications.

1.2. This document does not relieve the Contractor of their professional responsibility to produce a correct, complete, and fully coordinated project.

1.3. The construction shall be in accordance with the contract documents, technical specifications, VA guides and regulations as well as this statement of work. VA design standards, VA master specifications, design manuals, space planning criteria, and/or other publications can be obtained online at: https://www.cfm.va.gov/til/.

2.0 PROJECT DESCRIPTION

2.1. The contractor shall provide all labor, equipment, materials, testing, and supervision required to perform repairs and rehabilitation of potable water storage tanks as identified in the API 653 Inspection Reports. All work shall be executed in compliance with the latest versions of AWWA D100, AWWA D102, AWWA C652, API 653, and all applicable OSHA, federal, state, and local regulations. The tanks are used for potable water storage, and all repair, coating, and disinfection work must maintain water quality integrity.

2.2. Contractor shall perform corrosion removal and steel repairs as identified in the inspection reports. Remove defective steel plates or sections exhibiting loss of structural integrity. All repairs shall be completed with steel plate meeting ASTM A36 or equivalent. Welding shall comply with AWS D1.1 Structural Welding Code. Steel repairs shall be inspected by a licensed structural engineer. Weld inspections shall include visual inspection and non-destructive testing (NDT) as required by API 653. Welders shall possess a minimum of five (5) years of experience and shall possess a AWS Certification.

2.3. The contractor shall replace deteriorated and corroded bolts as specified in the inspection reports. All replacement bolts, nuts, and washers shall be stainless steel or galvanized, meeting AWWA and ASTM standards. Torque bolts to manufacturer’s specifications.

2.4. During the construction, all worksite surroundings, areas and roads shall always remain operational.

2.5. The contractor shall repair and/or replace defective nozzles as indicated in the inspection report. Restore nozzle flanges and gaskets to ensure leak-free performance. All nozzle materials and coatings must be NSF/ANSI 61 certified for potable water use.

2.6. Contractor shall perform complete abrasive blasting of all interior tank surfaces in accordance with SSPC-SP10 (Near White Blast Cleaning). Following sandblasting, a licensed Structural Engineer shall perform a visual inspection of exposed steel to confirm condition and identify any additional repairs before coating application. A certified report shall be submitted to VA.

2.7. Contractor shall include a contingency allowance for immediate steel repairs identified during post-blast inspection. Repairs may include welding, plate replacement, stiffener installation, or other structural interventions necessary to restore tank integrity.

2.8. The contractor shall apply a three-coat epoxy lining system (primer, intermediate, finish) meeting AWWA D102 and certified under NSF/ANSI 61 for potable water. Minimum coating dry film thickness (DFT) shall comply with coating manufacturer recommendations. Coating thickness and adhesion testing shall be performed per SSPC and manufacturer specifications. Contractor shall provide coating submittals for approval prior to application. Final completion report with warranty documentation shall be submitted to VA.

2.9. Following completion of repairs and coatings, the contractor shall clean and disinfect the tanks per AWWA C652 – Disinfection of Water Storage Facilities. Disinfection procedures shall include filling, chlorination, and holding periods as required by the standard. Water samples shall be collected and tested by a certified laboratory to confirm compliance with EPA Safe Drinking Water Act standards prior to returning tanks to service. Disinfection procedure documentation and certified laboratory test results shall be submitted to VA.

2.10. The laboratory must be an accredited NELAP LAB and for Puerto Rico Department of Health Certified Laboratory for collection and analysis of microbiological and chemical water quality parameters. The testing laboratory shall be certified though the Environmental Laboratory Certification Program and approval must be obtained through the Contracting Officer.

2.11. The Contractor shall be responsible for all pre and post disinfection testing requirements. These tests shall confirm the appropriate parameters to confirm that the water quality is appropriate for distribution, including, but not limited to:

a. Total Haloacetic Acids HAA5

b. Total Trihalomethane (TTHMs)

c. Total Coliform

d. E. Coli

e. Chlorine Total

f. pH

g. Alkalinity

h. Turbidity

i. Odor

j. Specific conductance

k. Chlorine residual

2.12. Samples shall be representative of the water quality in the tank and shall be sampled separately from the bottom, middle, and top of the tank. Bacteriological tests shall show no coliform and acceptable chlorine residual and PH after cleaning is complete. Should any test result come back out of compliance with the Safe Drinking Water Act or state, local, or federal guidelines regarding potability of water, the contractor shall repeat the disinfection and testing until satisfactory results are obtained. Sampling shall also include the “Optional Sampling and Testing” listed in section 5.1 of AWWA C652-19. A minimum of two pre and post disinfection test samples from each tank shall be taken and shall follow aseptic techniques for bacteria sampling.

2.13. Contractor shall protect all TTHM system components (installed inside the tanks) from damages. Contractor will be responsible for any damages (physical and functionality) caused to this equipment during the maintenance work. Contractor shall remove equipment parts as needed to fulfill this requirement and re-install once work is completed. Contractor shall not operate any valves without VA consent.

2.14. All work shall be inspected and documented by a third-party NACE- certified coating inspector.

2.15. The contractor shall comply with all OSHA safety standards for confined space entry, fall protection, and hazardous materials handling. Proper ventilation and PPE shall be used during blasting and coating operations. Contractor shall submit a site-specific Health & Safety Plan prior to mobilization.

2.16. The contractor shall furnish all supervision, management, labor, materials, tools, equipment, quality control and safety measures to perform all operations necessary to accomplish all work as shown on the procurement documents (e.g., reports, technical specifications, etc.). Also, shall provide, furnish, and comply with all permit requirements.

2.17. The Contractor must have a proven experience of at least ten (10) years in management of construction projects of similar or major complexity to this one.

2.18. The designated Project Manager and the Project Superintendent by the contractor shall be a professional architect and/or engineer licensed in Puerto Rico. Also, shall have proved experience of at least ten (10) years in management and supervision of projects of similar or major complexity to this one.

2.19. There will be no staging area provided for this project within the VA facility or their premises. The contractor shall be responsible for providing a staging area outside the VA premises.

2.20. Prior to commence with the construction the contractor shall submit for approval a written safety plan. The safety plan shall be tailored to the project work and its specific safety risks (is not just the company general safety plan). The project safety plan and safety requirements shall be in accordance with the general requirements of the VA Master Specifications Division 01 Section 01 35 26.

2.21. The contractor shall be responsible for submitting progress reports on the project. The report must include, but not limited to summary of project situation, performed activities, activities pending to perform, updated schedule, and in case of delays include a catch-up plan among others.

2.22. Contractor shall be responsible for obtaining all state and federal permits required for construction and waste disposal.

2.23. Contractor shall comply with the Federal Government policy on waste recycling, disposition and shall present a Waste Management Plan to be approved by the facility Environmental Department. Environmental documentation services include: research of Federal, State, and municipal laws, regulations and permits concerning construction controls for environmental protection; the preparation of any required written assessment and reports, forms, and graphics; permit submission to regulatory agencies on behalf of the government; and ensuring that the documents and specifications include necessary information to mitigate any adverse environmental impacts.

2.24. The Contractor shall be responsible for all materials delivered and work performed until completion and acceptance of the entire job.

2.25. The Contractor shall prepare written minutes of each meeting with the Government concerning contractual and design matters. Copies of the minutes shall be furnished to the Contracting Officer and VA Project Manager within two calendar days of meeting for VA review. The Contractor shall prepare written records of phone conversations addressing mayor construction issues and furnish a copy to the Contracting Officer and VA Project Manager within five calendar days of contract.

2.26. Prior to any mobilization and construction, the Contractor shall request and have approved an Infection Control Construction Permit, a Construction Safety Certification, and an Interim Life Safety Measures Certification from the VA Medical Center. Also, the project schedule and construction phases must be approved by COR and VA Chief Engineering. Contractor shall provide all necessary environmental documents and related EQB approved permits for construction.

2.27. The Contractor shall immediately bring to the attention of the CO and VA Project Manager any discrepancy between the scope of work, reports, specifications, VA codes, VA manuals, national codes, regulations, or any other material used during the project. The most stringent condition will apply unless upon common consent between A/E and CO decide otherwise.

2.28. Before the construction begin a pre-construction meeting will be coordinated upon mutual consent and will be held in VACHS. To the meeting must attend Contractor, project manager, and VA personnel. The meeting will be used to establish and discuss the rules and procedures to follow during the construction process to avoid interference with the VACHS regulations and normal operations. The meeting agenda will include, but not limited to schedule and submittal requirements, project phases and coordination, site and safety issues, site protection, job site access and construction administration among others.

2.29. During the construction period multiple progress meetings will be held by mutual consent as deemed necessary. The progress meetings will be used to discuss project progress, pending actions and to update the Contracting Officer and VA Project Manager on the following meeting agenda items: approval of minutes of previous meetings, submittal status, review of off-site fabrication and delivery, requests for Information (RFI’s) and issues, modifications, work in progress and projected, schedule update (provide updated CPM schedule), status of project record documents and O&M Manuals, and other business relating to work.

2.30. All projects associated construction, and temporary work shall conform to the latest VA specifications, VA Standards, energy conservation methods, AWWA, API, EPA, OSHA, ADA, NFPA, NEC, ASHRAE, LIFE SAFETY CODE, IBC, local, Federal and industry requirements and regulations.

2.31. The Contractor shall comply with all applicable federal, state, and local requirements for protecting the safety of the contractor’s employees, building occupants and the environment. All applicable standards of the Occupational Safety and Health Administration (OSHA) shall be followed when working in accordance with this project. No process or materials shall be employed in such a manner that they will introduce additional hazards into occupied space.

2.32. All utility shutdowns or interruptions of medical services shall be requested to the VA project manager with three weeks in advance. Such request shall be accompanied by a work plan. The work plan will be evaluated and discussed between the project manager and the contractor. Once the work plan is satisfactory, the project manager will coordinate with the facility personnel and then will inform to contractor the date and duration in which the shutdown can be performed. Usually, the coordination takes from two to two and a half weeks. No shutdown or interruption will be performed without the previous authorization of the CO or VA project manager.

2.33. Selected Contractor shall complete an assessment of the existing conditions of the site that may be affected by the construction work. All damage to the new structures, architectural elements, and mechanical/electrical/plumbing components shall be repaired and/or replaced at no cost to the Government. The Contractor shall repair any damage occasioned by their installation and restore the premises to the same condition as existed prior to the time when any such alterations or additions were made. If components no longer exist or can’t be matched to the satisfaction of VA, the Contractor shall submit an alternate for approval and replace the entire affected system at no additional cost.

2.34. Due to coordination between the construction works and facility normal operations all utility shut-down and medical service interference takes some time before it can be performed. Usually takes from two to two and a half weeks. To avoid delays and to ensure the steady run of the construction works, the Contractor shall consider in the construction the least possible number of interruptions to medical services and/or utility shut down.

2.35. Contractor is responsible for obtaining all state and federal environmental permits necessary to perform construction activities and equipment commissioning.

2.36. All Contractor personnel must report to the Police Service to identify themselves upon entering the VACHS facility and must carry the identification card throughout the entire period while providing the service.

3.0 DEFINITIONS

3.1. Contracting Officer (CO): The services to be performed under this contract are subject to general supervision, direction, control, and approval of the Contracting Officer.

3.2. Contractor: This term, as used herein, refers to the contractor under this contract.

3.3. VA Project Manager (PM): The Contracting Officer's representative (COR) responsible for administering contracts under the immediate direction of the Contracting Officer and the Contracting Officer's authorized representative at the construction site. When more than one Project Manager is assigned to a construction project one is designated as being in charge and is called the "Senior Project Manager". The Project Manager is responsible for protecting the Government's interest in the execution of the construction contract work. His duties include surveillance of all construction work to assure compliance with the contract documents, interpretation of the contract documents, approval of changed work, approval of all submittals, samples, shop drawings, etc. The Senior Engineer recommends change order to CO based on all project fact findings for review and approval of CO, including all reviews as required. Should the VA require any additional work for which the contractor will incur additional cost or extended time, the contractor is to obtain the approval of the Contracting Officer before beginning any work approved by the Project Manager.

4.0 PROJECT SCHEDULE

4.1. The contractor shall complete the work required under this Scope of Work within seven hundred and thirty (730) calendar days from receipt of “Notice to Proceed” (NTP). The contractor is expected to develop an agreed upon timetable outlining the milestones for each specified task of the study.

4.2. Contractor shall schedule tank repairs outside of the hurricane season peak months (August to October). Contractor is expected to turnover tanks fully operational and in compliance for hurricane season peak months.

4.3. Working hours will vary depending on the tasks being accomplished. Work affecting hospital’s operations must be done after 5 p.m. in the afternoon and with timely advance coordination with VA’s Project Manager/COR.

4.4. The contractor shall develop a Critical Path Method (CPM) plan and schedule demonstrating fulfillment of the contract requirements (Project Schedule) and shall keep the Project Schedule up to date in accordance with the requirements of Division 01, Section 01 32 16.15 of the VA Master Specifications. Also, shall utilize the plan for scheduling, coordinating, and monitoring work under this contract (including all activities of subcontractors, equipment vendors, and suppliers among others). Conventional Critical Path Method (CPM) technique shall be utilized to satisfy both time and cost applications. In case of delays the DB-C shall propose a catch-up plan.

4.5. The schedule shall include a detailed construction stage sequence (including all construction phases and related activities) with durations, start and finish dates, early and late dates, total float, and resources. Also, shall include, but not limited to, the following periods: submittal processing, reviews, fabrication, delivery, coordination and preparation between phases, coordination and execution of shutdowns and all construction-related activities as well as all important milestones.

4.6. The Contractor shall specify how much allowance has been made for adverse weather in the schedule.

4.7. The Contractor shall specify the days of the week and the hours of construction operations during each phase of the work.

4.8. Breakdown the construction period in at least eight construction tasks as required, (e.g.: site preparation, demolition, equipment procurement, equipment/materials delivery, equipment installation, architectural finishes, tests, and final inspection, etc.).

5.0 RESPONSIBILITIES

5.1. The contractor includes all Joint-Venture (J/V) partners, consultants, and sub-contractors to the one firm. The contractor shall provide Architectural and Engineering disciplines for the preparation of construction documents, and construction contractor capabilities for construction of the project.

5.2. The contractor shall have comprehensive knowledge, experience, expertise, equipment and personnel to complete this work.

5.3. The RFP documents are intended to define existing conditions, certain required items, and design parameters to be included in the project. Contractor shall verify all existing conditions and consider any deviations from the documents prior to contract award. It is the Contractor’s responsibility to complete the documents and construction in a manner consistent with the intent of the RFP documents within the required time period (contract length).

5.4. The Contractor shall provide a detailed phasing schedule and written narrative, indicating specific dates for each step of the construction process in concurrence with the progress schedule.

5.5. The Contractor shall develop a complete set of as-built drawings at the end of the construction work and submit it for VA review and approval.

5.6. Project performance is to be developed in accordance with VA guides, standards, and requirements; local and federal codes; and other engineering standards and best practices. The constructor will develop a well-organized, practicable and complete construction phasing for the proposed project in order that the normal hospital operations will not be interrupted nor disturbed except by previous and timely coordination with VAMC Center Director through the Project Manager/Engineer/COR.

5.7. Contractor shall comply with the applicable construction project requirements (e.g. submission of final as-built drawings, shop drawings, tests, safety requirements, new material and equipment provision and installation requirements, Buy American Act, payment and performance bonds requirements; insurance requirements; progress payments and schedules, work inspection and supervision, daily logs requirements, material and workmanship, guaranty, cleaning up, accident prevention, and other requirements) included in the specifications.

5.8. The offeror is responsible for presenting a proposal that fully incorporates all items in the Statement of Work. No omissions or assumptions will be permitted. All concerns / questions shall be responded through Requests for Information prior proposals submission. The offeror shall deliver according to the full extent of the Scope of Work, even if already awarded the contract.

5.9. All vendor/contract personnel must report to the Police Service and identify themselves upon entering the VACHS facility. They shall abide by Police Service rules and personal identification verification (PIV) regulations and carry the identification card throughout the entire period while providing the service. This includes but is not limited to any other screening protocols the VA implements in response to any emergency at all VA facilities.

5.10. During the construction period multiple progress meetings will be held by mutual consent as deemed necessary. The progress meetings will be used to discuss project progress, pending actions and to update the Contracting Officer and VA Project Manager on the following meeting agenda items: approval of minutes of previous meetings, submittal status, review of off-site fabrication and delivery, requests for Information (RFI’s) and issues, modifications, work in progress and projected, schedule update (provide updated CPM schedule), status of project record documents and O&M Manuals, and other business relating to work.

5.11. All construction activities will be coordinated through the CO and VA project manager. VA will define the construction zone of the project along with the access to the projects. The construction zone shall be used by the contractor for project purposes only. The contractor shall strictly follow all the VA instructions to avoid conflicts with the regulations and normal operations of the VACHS.

5.12. The contractor shall visit the site before submitting his final proposal. Visits to the site shall be made by appointment with the VA Project Manager and upon mutual consent.

5.13. The contractor shall be responsible to perform all the required activities, surveys, assessments, technical studies, analyses, design, permits and construction documents as well as shall provide all technical expertise, labor, material, tools, equipment, and construction services that are deemed necessaries for the proper execution and delivery of complete construction.

5.14. The contractor shall take all necessary precautions to prevent damages to VA property as result of the execution of any stage or phase of the project. In case of damage, the contractor shall replace or restore the damaged property to its original condition.

5.15. The contractor shall provide a well-organized, complete, and competent project.

5.16. This document does not relieve the contractor from responsibility to comply with all the latest VA design standards, design manuals, national codes, federal requirements, and regulations.

5.17. The contractor shall comply with all the conditions established in all the required permits, including the environmental permits and regulations.

5.18. If available and upon request, VA will provide documents, reports or drawings of existing structures or components. VA will not guarantee the accuracy and completeness of the same. Consequently, the contractor is responsible for verifying and corroborating the accuracy and completeness of any report, drawing or document provided by VACHS that have an impact on the successful execution of this project.

5.19. Any related supporting system, apparatus, material or work not mentioned, or any incidental accessories necessary to make the work complete in all respects and ready for operation even if not particularly specified, shall be furnished, delivered and installed by the Contractor without additional cost to the Government.

5.20. The construction of the proposed project shall always allow for full operation of the existing generator farm and maintaining the operations of all existing utility services and fire exits. In addition, it should maintain free and unobstructed access to facility emergency vehicles and for fire, police, and other emergency response forces in accordance with NFPA 241. Open excavations, trenches, etc. shall be protected with fences, covers, and railings to always maintain safe pedestrian and vehicular traffic passage.

5.20.1. Protect and cover routes from all existing exterior exits to the perimeter of the construction limits.

5.20.2. Provide temporary utility connections including power, site lighting, and other services without operational disruption to the existing buildings and site facilities.

5.20.3. Use of reflective stop paddles and other types of portable signs to increase visibility to warn drivers of the presence of guards and visitors/staff pedestrians.

5.20.4. Provide appropriate way-finding signage.

5.20.5. Coordinate all activities within the facility with the VA Project Manager. Ensure all work within and adjacent to the construction area is properly and timely coordinated with VA. The operation of the facility shall not be interrupted.

5.20.6. Prior to any work being performed, method and scheduling of required cutting, altering, and removal of existing roads, walks and entrances must be submitted for timely review and approval to the VA Project Manager.

5.21. Contractor shall submit a list key personnel (Project Manager, Superintendent, Quality Control Manager, etc.) to be involved in this project and supply a brief statement of qualifications/biographical data including name of individual, company position, years with the company, work and educational background, experience applicable to this project, tasks to be assigned on this project, percentage of workweek to be committed to this project, and authority of that individual to act on behalf of the Contractor. All key personnel shall submit evidence of their OSHA 30-hour construction training. VA expects to have a Project Manager and Superintendent on-site fully devoted to this project.

6.0 GUARANTEE

6.1. The Contractor guarantees the installation against defective material, workmanship, and performance for a period of one year, said guarantee to run from date of acceptance of the project by the Government. The Contractor agrees to furnish, without cost to the Government, replacement of all parts and material that are found to be defective during the guarantee period. Replacement of materials and parts will be furnished to the Government at the point of installation. The cost of installation of replacement material and parts shall be borne by the Contractor.

7.0 CONSTRUCTION PERIOD SUBMITTALS

7.1. The Contractor shall distribute one (1) electronic set of the submittal in pdf format attention to VA CO with copy to VA PM/COR via e-mail. All materials and equipment submittals must be submitted and approved by record A/E, VA PM/COR, and CO prior to start of construction. All submittals shall be as per the specification.

7.2. The Contractor shall be responsible of submitting to VA all equipment and materials submittals prior to any purchase or installation. The VA shall review and approve all submittals prior of the equipment purchase or material installation. The VA reserve the right to reject any material or equipment that has been installed or purchased without their respective submittal revision and approval.

7.3. The Contractor cannot start with any works without the A/E and VA revision of the concerning submittals. As deemed necessary, VA reserves the rights to request the submittal of any other item not included in the submittal list.

7.4. Other Submittals: The contractor shall submit test results, manufacturer certificates, manufacturer’s instructions, manufacturer’s field reports, etc. as required.

7.5. Project Record Drawings: The Contractor will maintain a set of construction documents (as-built drawings) to record actual construction changes during the construction process as required. The project record drawings will always be available on project site for review by the VA Project Manager.

7.6. A/E shall verify Contractor’s shop drawings, detail drawings, schedules, descriptive literature and samples, testing labor-laboratory reports, field test data and review materials for conformity with the RFP documents and specifications. The A/E shall recommend approval, disapproval, or other suitable disposition to the VA PM/COR. The VA PM/COR and CO will have final approval authority. The A/E shall evaluate the submittals with reference to any companion submittals that constitute a system. When necessary, the A/E shall request the Contractor to submit related components of a system before acting on a single component. The A/E may be required to hold joint reviews with the VA technical staff on complicated system submittals.

8.0 QUALITY ASSURANCE/QUALITY CONTROL (QA/QC)

8.1. Prior to the pre-construction meeting, the contractor shall be responsible of submit for approval a written QA/QC plan.

8.2. If the plan requires any revisions or corrections, the Contractor shall resubmit the plan within 10 days.

8.3. VA reserves the right to require changes in the plan during the contract period as necessary to obtain the quality specified.

8.4. No change in the approved plan may be made without written concurrence by the Contracting Officer.

8.5. The plan shall include but is not limited to: a list of personnel responsible for quality control and assigned duties. Include each person's qualifications, a copy of a letter of direction to the Contractor's Quality Control Supervisor outlining assigned duties, names, qualifications, and descriptions of laboratories to perform sampling and testing, and samples of proposed report forms, Methods of performing, documenting, and enforcing quality control of all work. Methods of monitoring and controlling environmental pollution and contamination as required by regulations and laws. Well defined quality control phases and procedures (as applicable).

8.6. During construction the contractor shall be responsible to submit daily test Information sheets with quality control daily reports as needed, for all on-site work. Submit two copies of complete test results not later than three calendar days after the test was performed. The failing test results shall be submitted along with proposed remedial actions within four hours of noted deficiency. The contractor shall be responsible for keeping updated logs of all tests performed on the project. The logs shall include date tested, type of test, results, and comments among others.

8.7. All items that are fabricated or assembled off-site shall be inspected for quality control at the place of fabrication. The contractor shall be responsible to submit test Information sheets with quality control reports as needed.

9.0 PROJECT CLOSE-OUT

9.1. The contractor shall comply with the requirements in the “General Requirements”, 01 00 00, for submission of final as-built drawings, shop drawings, manuals, warranties, and other documents as noted. The required as-built drawings will be submitted in the same format required for the construction documents.

10.0 CONTRACTOR RULES OF BEHAVIOR

10.1. This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

10.2. General Terms and Conditions for all Actions and Activities Under the Contract:

10.2.1. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

10.2.2. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

10.2.3. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

10.2.4. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

10.2.5. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

10.2.6. I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me.

10.2.7. I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer's Technical Representative (COTR). If the contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution.

10.2.8. I will report suspected or identified information security/privacy incidents to the COR and to the local ISO or Privacy Officer as appropriate.

10.3. General Rules of Behavior

10.3.1. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

10.3.2. The following rules apply to all VA contractors. I agree to:

10.3.2.1. Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

10.3.2.2. Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

10.3.2.3. I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

10.3.2.4. Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

10.3.2.5. Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COTR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

10.3.2.6. Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

10.3.2.7. Grant access to systems and information only to those who have an official need to know.

10.3.2.8. Protect passwords from access by other individuals.

10.3.2.9. Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

10.3.2.10. Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

10.3.2.11. Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders.

10.3.2.12. Ensure that the COR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. Do not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

10.3.2.13. Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COTR.

10.3.2.14. Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COTR.

10.3.2.15. Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COTR for policies and guidance on complying with this requirement and will follow COTR’s orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

10.3.2.16. Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COTR.

10.3.2.17. Understand that restoration of service of any VA system is a concern of all users of the system.

10.3.2.18. Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

10.4. Additional Conditions for Use of Non- VA Information Technology Resources

10.4.1. When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

10.4.2. Remote access to non-public VA information technology resources is prohibited from publicly available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

10.4.3. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COR.

10.4.4. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

10.5. Statement on Litigation

10.5.1. This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

10.6. Acknowledgement and Acceptance

I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

SOW Repair Water Tanks Deficiencies Page 17 of 21 Project 672-26-110

SOW Repair Water Tanks Deficiencies Page 2 of 2 Project 672-26-110 Print or type your full name

Last 4 digits of SSN

Office Phone

Contractor’s Company Name

Signature

Date

Position Title

Please complete and return the original signed document to the COTR within the timeframe stated in the terms of the contract

SOW Repair Water Tanks Deficiencies Page 17 of 21 Project 672-26-110

11.0 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

11.1. VA Information Custodial Language:

11.1.1. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

11.1.2. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

11.1.3. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

11.1.4. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

11.2. Security Incident Investigation:

11.2.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

11.2.2. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

11.2.3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

11.2.4. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

11.3. Liquidated Damages for Data Breach:

11.3.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

11.3.2. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

11.4. Security Controls Compliance Testing:

11.4.1. On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

11.5. Training:

11.5.1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

11.5.1.1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

11.5.2. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

11.5.3. Failure…