SOW - Canon CT Service Contract.docx

Canon CT Systems Service Contract

Statement of Work (SOW)

A. GENERAL INFORMATION

1. Purpose: Maintenance Contract for CNVAMC Canon Medical Systems USA, INC. Aquilion Computed Tomography (CT) Scanner’s.

2. Scope of Work:

This service and maintenance contract is to cover all existing Canon CT Systems owned by CNVAMC. The contract shall include Preventive Maintenance (PM) services and Corrective Repair services. The contractor shall provide all personnel, equipment, tools, materials, parts, supervision, transportation, and other items and services necessary to properly maintain all equipment identified in the Equipment List. Services to be performed include all unscheduled routine service calls, all emergency service visits, and all scheduled service visits as required for all line items. All parts provided by the contractor shall be covered by the terms and conditions of this contract. All work shall be performed in a professional manner by an authorized service representative. If any deficiencies are found due to negligence of the service representative, the contractor will be required to correct the deficiency to a fully operational status in accordance with manufacturer specifications at no additional cost to the Veteran Affairs (VA). The specific terms and CNVAMC requirements for the Preventative Maintenance (PM) and Corrective Repair services are detailed in this SOW and shall be met by the Contractor.

Equipment Listing details all equipment that shall be covered and maintained by the Contractor as part of this service and maintenance contract.

EQUIPMENT LIST:

3. Background:

The Charlie Norwood VA Medical Center is a two division multi-bed facility, encompassing acute medical, surgical, psychiatric, and long-term care. The hospital is in Augusta, Georgia and provides primary, secondary, and some tertiary care. The imaging equipment is in the Radiology Department and must be maintained by Scheduled and Unscheduled Preventive Maintenance services, using Original Equipment Manufacturer (OEM) parts to maintain the integrity of the unit. Only authorized trained technicians are eligible to perform maintenance on equipment owned by CNVAMC.

4. Performance Period:

Base year plus four (4) option years.

5. Type of Contract: Firm-Fixed-Price.

6. Place of Performance: Service will take place at Charlie Norwood VA Medical Center, Bldg 801, 950 15th St, Augusta, GA 30901. The equipment is located in the Radiology Department, rooms 2D225 and 2D222.

7. Hours of Operation:

Hospital normal hours of operation are between 8am and 4:30pm, Monday through Friday, excluding holidays. Holidays falling on a Sunday will be observed the following Monday.

Any service not covered under this contract must have prior approval of the Contracting Officer before any work is performed (otherwise the Contractor is liable for any unapproved work costs).

Juneteenth Day June 19th

B. GENERAL REQUIREMENTS

1. Preventative Maintenance:

a. Non-personal service to include, but not limited to, providing all personnel, equipment, tools, supervision, and other items necessary to maintain medical equipment as listed on the equipment list.

b. The contractor’s representative shall perform preventive maintenance inspections (PMI), calibrations and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment.

c. The contractor shall maintain the equipment listed in proper operating conditions as described in the manufacturers’ literature.

d. The contractor shall provide coordinated scheduled calibration and preventive maintenance inspection shall be performed as specified for each unit or system in the equipment list.

e. The scheduled calibration and preventive maintenance shall include written documentation of servicing, lubrication, cleaning, adjustments, operational tests, and calibration/verification in accordance with manufacturers’ specifications and all applicable VA regulations. Calibration documentation shall include a list of all tests, measurements, and diagnostic equipment. This list shall include nomenclature, model, serial number, date it was calibrated and the date its calibration is due.

f. Preventive maintenance shall include cleaning, replacement of missing or defective parts, modules, covers, lamps and keys, a complete inspection, an inspection, or repair of cables, plugs and wiring, a thorough function test of the input and safety circuits, checking the topicality of the operator manuals and information and training of new personnel. The safety inspection shall include a mechanical check (examination of the casing, the readings, user interfaces, connections, cables, labeling, soiling that would affect safety, etc.) and function test, as services include written documentation of servicing, cleaning, lubrication, adjustments, operational tests, and calibration/verification in accordance with the manufacturer’s specifications.

g. The contractor’s service representative shall be factory trained and have a minimum of 2 years’ experience working on the contracted equipment and provide COR with a copy of the certificate.

h. The contractor shall furnish all software upgrades issued by the equipment manufacturer.

i. Required forms and extracts from pertinent directives will be furnished to the contractor’s service representative by the VA.

j. All preventive maintenance inspections/verifications/calibrations shall be performed in accordance with the manufacturer’s service literature, which will be located with the equipment or provided by the contractor.

k. Upon completion of calibration, the contractor shall affix or update a VAMC AUGUSTA Preventive Maintenance sticker to the equipment in accordance with VA regulations. Required stickers and extracts from pertinent directives will be affixed by VA biomedical personnel.

l. The contractor shall only accept calls for service/repairs from the Chief, Biomedical Engineering Section, or his/her authorized designated representative.

m. Upon completion of a scheduled or unscheduled service, the contractor service representative shall report to the Chief, Biomedical Engineering Section, or his/her designated representative. In the event all necessary information is not available to the service technician at the time of completion of service, the initial service report shall include all information available (Refer to Section 4.2.8.). The contractor shall provide a legibly written or typed copy of the remainder of the required information in English within 10 days after completion of service to:

Charlie Norwood VA Medical Center Biomedical Engineering Section Building 801 Room 1B162 950 15th St Augusta, GA 30901 Tel. 706-733-0188 ext. 33342

n. On the day services (scheduled and/or unscheduled) are completed, the contractor’s service technician shall prepare and initial a legibly written or typed service report in English and present it to the Chief, Biomedical Engineering Section, or his/her designated representative via email for signature. This report shall include the following information:

(1) Services performed (i.e., preventive maintenance, repair, calibration, etc.)

(2) What systems or components failed by serial number (reason for call)

(3) Start date/time

(4) Completion date/time

(5) Name of service technician

(6) Part numbers, nomenclatures, and quantities of replaced parts

(7) Travel time

(8) Repair time

(9) Travel and repair

(10) Location of services performed

o. Completion of Unscheduled Repairs. For On Site Routine services Contractor’s technician shall be on site within two (2) working days and the repair shall be completed within four (4) working days. Emergency on site repair services are covered under 1.4.3.3.

p. Repairs that cannot be performed at the VA site may be performed at the contractor’s site provided the POC approves removal of the equipment. The contractor’s representative shall sign a receipt for the equipment. The repaired equipment shall be returned to the original premises within two (2) working days or the contractor shall provide a temporary replacement at no additional cost to the VA.

q. Preventive maintenance inspections shall be performed in accordance with the manufacturer’s standards and procedures. The preventive maintenance inspection shall include, but is not limited to safety, calibration, completed operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. It also includes installation of all parts required to ensure proper operation.

r. Preventive maintenance visit, the contractor shall perform preventive maintenance to correct any equipment malfunctions and assure that the equipment meets manufacturer’s factory specifications. Any calibration procedures or adjustments necessary to ensure accurate and reliable equipment operation shall be performed at this time.

s. Safety shall be performed in accordance with NFPA 99, Chapter 7. This regulation can be reviewed in full text at the Biomedical Engineering Section. When required, the contractor’s service representative shall comply with the Occupational Safety and Health Administration lockout/tagout standards while performing maintenance on equipment. The VA and the contractor’s service representative shall exchange hazard communication information before the commencement of any repair.

2. Corrective Maintenance and Emergency Service:

a. The contractor will provide unlimited routine/emergency service during normal workdays; Monday through Friday, between the hours of 8:00am to 5:00pm, excluding holidays. Unscheduled repair service calls shall be accepted only from the authorized biomed POCs listed in Attachment 1 of this SOW.

b. Contractor must have a minimum of two (2) factory trained representatives to provide services to contracted equipment and provide proof of factory trained certification for all the contracted equipment

c. The contractor’s qualified service technician shall be on site to provide routine services or services requiring immediate repair. Scheduled services for preventative maintenance, safety, and calibration will be performed as required by the manufacturer’s specification and this statement of work. Scheduled services shall be completed no later than the 20th day of the assigned month. Unscheduled repairs (non-emergent) will be repaired and operational within 96 hours after initial response by contractor.

d. The contractor is required to provide Biomedical Engineering Department with any service representative's name, address, and phone number so the VA Medical Center can obtain emergency maintenance service after normal VA working hours. The contractor is responsible for notifying Biomedical Engineering Department within 2 hours of the incident.

e. The contractor’s qualified service technician shall be on site to provide unlimited emergency services (services requiring immediate repair) within 8 hours. The equipment shall be repaired and operational within 48 hours after initial response by the contractor. If the equipment is out of service for longer than 48 hours (from the time of the service technician’s arrival on site), the contractor shall notify Biomedical Engineering, verbally and in writing, as to the reason(s) (i.e. parts non-availability, etc.).

f. The contractor shall complete a continuation sheet indicating manufacturer, model number, serial number, date of calibration expiration for all test, measurement, and diagnostic equipment items used to perform calibration

g. All correspondence, service reports, and invoicing shall be in English and clearly legible.

h. All contractor’s representatives will be sufficiently fluent in the English language to effectively communicate with Charlie Norwood VA Medical Center’s representatives.

i. Coverage Hours: Service coverage will be eight (8) hours a day, five (5) days a week, not including holidays. Any service not covered under this contract must have prior approval of the Contracting Officer before any work is performed (otherwise the Contractor is liable for any unapproved work costs). Two (2) hour response time by phone for a down machine and eight (8) hour onsite response time on station is required. Response time is defined as time vendor is first notified until time vendor responds.

j. Response Time: On-site response by a factory trained Field Service Engineer / Technician is required within eight (8) hours of emergency maintenance / corrective maintenance request.

k. Telephone Support: Technical Support via phone shall be available 24 hours per day, 7 days a week.

l. The U.S. government will make the equipment available to the contractor for servicing at such time and duration necessary to perform needed repairs

3. Deliverables:

a. All correspondence, service reports and invoicing shall be in English and clearly legible.

b. The contractor shall complete a continuation sheet indicating manufacturer, model number, serial number, and date of calibration expiration for all test, measurement and diagnostic equipment items used to perform calibration.

c. The contractor’s representative shall attach and complete or update a “CNVAMC Preventative Maintenance” sticker to the equipment upon completion of calibration services. This sticker will be affixed by VA biomed Personnel.

d. A continuation sheet shall be attached indicating the manufacturer, model, serial number and date of the calibration expiration of all items of test, measurement and diagnostic equipment used to perform the calibration.

e. Required forms and extracts from pertinent directives will be furnished to the contractor’s service representative by the VA.

f. If the contractor’s calibration equipment produces a printed summary of the calibration procedure used, attach the printed summary to the Preventive Maintenance worksheet.

g. Replacement Parts.

h. All replacement parts shall be certified (*) and have the same material as the original part. The original design of the equipment shall not be changed, modified or the required functional capacities altered. (*) Certified parts are parts that comply with standards set forth in 21 CFR 1020.30 (applicable to radiation producing equipment only), for installation in medical equipment. This regulation can be reviewed in full context at the Biomedical Engineering Section.

i. In place of new parts, factory refurbished exchange parts per the manufacturer’s spare parts procedures and policies may be used.

j. The contractor shall furnish a detailed listing of any replacement parts provided under the terms of this contract. This listing shall contain the part number, nomenclature, normal life expectancy and shall indicate whether the item is an exchange part.

4. Government Responsible:

a. COR shall review all completed service reports for any scheduled calibration, preventive maintenance or unscheduled routine and emergency service performed during the respective quarter. Receiving reports shall not be prepared and submitted until all such completed service reports containing all required information are in the possession of the COR.

b. COR or BIOMED designated technician shall be present while work is performed under this contract

c. (If applicable) COR or BIOMED Technician shall perform a first look prior to contacting the contractor.

d. Services to be acknowledged by service reports to be sent to and invoices to be acknowledged by:

Charlie Norwood VA Medical Center Biomedical Engineering Section Building 801 Room 1B162 950 15th St Augusta, GA 30901 Tel. 706-733-0188 ext. 33342

5. Conduct:

a. Impaired Contractor personnel: At any time during the performance of this contract, the Contracting Officer, Contracting Officer Representative (COR) or Director of the medical treatment facility may direct the contractor to immediately remove any contractor employee whose actions or impaired state raises reasonable suspicion that clear and present danger of physical harm exists to a patient, medical treatment facility personnel and equipment or to the impaired individual. This provision shall be used in emergency situations only and not for the purpose of bringing performance issues or other non-urgent concerns to the attention of the contractor.

b. Smoking is prohibited within Charlie Norwood VA Medical Center and its clinics and within 15 meters of any building.

c. The use of cellular phones and 2-way radios is expressly forbidden in certain areas of Medical Treatment Facilities and Health Clinics. The contractor shall not use cellular phones or radios in these areas. (i.e., Direct patient care areas, etc.)

6. Government-Furnished Facilities, Equipment, Material and Services:

a. GENERAL: The Government will provide, without cost to the Contractor, the facilities, equipment, materials and services listed below. The contractor will maintain government furnished supplies, equipment and work areas in a safe, orderly and clean condition.

b. FACILITIES: No facilities will be provided.

c. EQUIPMENT: No equipment will be provided

d. MATERIALS: No materials will be provided.

e. SERVICES: The VA will provide the following services at no cost to the Contractor:

f. UTILITIES: The VA will provide the normal range of utilities, electricity, water, heating, refuse collection, etc., as is provided other personnel.

7. Unauthorized Work and Scope Deviations:

a. Any work performed by the Vendor/Contractor that falls outside the explicitly defined scope of the Contract/Statement of Work (SOW) shall be considered unauthorized.

b. For any such work to proceed, the Vendor/Contractor is strictly required to obtain a formal Purchase Order (PO) from the CNVAMC prior to commencing any related tasks or incurring any associated costs.

c. Failure to secure a valid Purchase Order from the CNVAMC before executing work outside the contract's scope will result in the CNVAMC having no obligation to compensate the Contractor for said work.

d. This requirement is in place to ensure that all services rendered are properly authorized, financially tracked, and aligned with the operational needs and budgetary constraints of the CNVAMC.

e. The Vendor/Contractor acknowledges and agrees that all services must adhere to this authorization process.

C. CHANGES TO STATEMENT OF WORK

Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

D. INVOICES

1. Invoices shall be submitted electronically in arrears to the address indicated VA FSC P.O. Box 149971 Austin Texas 78714. Please reference the Purchase Order Number (i.e., 509-A0000 or 509-C75…)

2. Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer’s Representative (COR), and submitted electronically through OB-10 (https://portal.tungsten-network.com/).

3. A properly prepared invoice will contain:

a. Invoice Number and Date

b. Contractor’s Name and Address

c. Accurate Purchase Order Number

d. Supply or Service provided

e. Dates service performed

f. Location of service performed

g. Total Amount Due

E. SECURITY

PER REVIEW OF VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX A- INFORMATION SECURITY AND PRIVACY CHECKLIST:

1. “The C&A requirements do not apply and a Security Accreditation Package is not required.”

2. Acquisition of this service does not involve the storage, generating, transmitting, or exchanging of VA sensitive information to the vendor.

3. There may exist exposure to VA sensitive information, in particular to sensitive personal information (SPI) while implementing contractual services.

Minimum Statutory Requirements

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for the destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. RECORDS MANAGEMENT

a. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

b. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

c. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

d. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

e. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

f. The Government Agency owns the rights to all data/records produced as part of this contract.

g. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

h. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

i. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

j. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

4. INFORMATION SYSTEM SECURITY

a. The contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard contract language, conditions laws, and regulations. The contractor’s firewall and web server shall meet or exceed the government minimum requirements for security. All government data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA project manager and the VBA Headquarters Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification accreditation.

5. SECURITY TRAINING

a. All contractor employees and subcontractors under this contract or order are required to complete the VA's on-line Security Awareness Training Course and the Privacy Awareness Training Course annually. Contractors must provide signed certifications of completion to the CO during each year of the contract. This requirement is in addition to any other training that may be required of the contractor and subcontractor(s).

6. CONTRACTOR PERSONNEL SECURITY

a. All contractor employees who require access to the Department of Veterans Affairs' computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation will be in accordance with VA Directive 0710 dated September 10, 2004 and is available at: http://www.va.gov/pubs/asp/edsdirec.asp (VA Handbook 0710, Appendix A, Tables 1 - 3). Appropriate Background Investigation (BI) forms will be provided upon contract (or task order) award and are to be completed and returned to the VA Security and Investigations Center (07C) within 30 days for processing. Contractors will be notified by 07C when the BI has been completed and adjudicated. These requirements are applicable to all subcontractor personnel requiring the same access. If the security clearance investigation is not completed prior to the start date of the contract, the employee may work on the contract while the security clearance is being processed, but the contractor will be responsible for the actions of those individuals they provide to perform work for the VA. In the event that damage arises from work performed by contractor personnel, under the auspices of the contract, the contractor will be responsible for resources necessary to remedy the incident.

b. The investigative history for contractor personnel working under this contract must be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Industrial Security Clearance Organization (DISCO). Should the contractor use a vendor other than OPM or Defense Security Service (DSS) to conduct investigations, the investigative company must be certified by OPM/DSS to conduct contractor investigations.

1. Background Investigation

The position sensitivity impact for this effort has been designated as [LIMITED, MODERATE, SUBSTANTIAL, or MAJOR] Risk and the level of background investigation is [NACI, MBI, or BI].

2. Contractor Responsibilities

a. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM) through the VA, the contractor shall reimburse the VA within 30 days.

b. Background investigations from investigating agencies other than OPM are permitted if the agencies possess an OPM and Defense Security Service certification. The Vendor Cage Code number must be provided to the Security and Investigations Center (07C), which will verify the information and advise the contracting officer whether access to the computer systems can be authorized.

c. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

d. After contract award and prior to contract performance, the contractor shall provide the following information, using Attachment B, to the CO:

(1) List of names of contractor personnel.

(2) Social Security Number of contractor personnel.

(3) Home address of contractor personnel or the contractor's address.

e. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

f. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

g. Further, the contractor will be responsible for the actions of all individuals provided to work for the VA under this contract. In the event that damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor will be responsible for all resources necessary to remedy the incident.”

3. Government Responsibilities 1.

1. a. The VA Security and Investigations Center (07C) will provide the necessary forms to the contractor or to the contractor's employees after receiving a list of names and addresses.

b. Upon receipt, the VA Security and Investigations Center (07C) will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

c. The VA facility will pay for investigations conducted by the OPM in advance. In these instances, the contractor will reimburse the VA facility within 30 days.

d. The VA Security and Investigations Center (07C) will notify the contracting officer and contractor after adjudicating the results of the background investigations received from OPM.

e. The contracting officer will ensure that the contractor provides evidence that investigations have been completed or are in the process of being requested.

F. ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS

INTERNET/INTRANET

The contractor shall comply with the Department of Veterans Affairs (VA) Directive 6102 and VA Handbook 6102 (Internet/Intranet Services).

VA Directive 6102 sets forth policies and responsibilities for the planning, design, maintenance support, and any other functions related to the administration of a VA Internet/Intranet Service Site or related service (hereinafter referred to as Internet). This directive applies to all organizational elements in the Department. This policy applies to all individuals designing and/or maintaining VA Internet Service Sites; including but not limited to full time and part time employees, contractors, interns, and volunteers. This policy applies to all VA Internet/Intranet domains and servers that utilize VA resources. This includes but is not limited to va.gov and other extensions such as, “.com, .edu, .mil, .net, .org,” and personal Internet service pages managed from individual workstations.

VA Handbook 6102 establishes Department-wide procedures for managing, maintaining, establishing, and presenting VA Internet/Intranet Service Sites or related services (hereafter referred to as “Internet”). The handbook implements the policies contained in VA Directive 6102, Internet/Intranet Services. This includes, but is not limited to, File Transfer Protocol (FTP), Hypertext Markup Language (HTML), Simple Mail Transfer Protocol (SMTP), Web pages, Active Server Pages (ASP), e-mail forums, and list servers.

VA Directive 6102 and VA Handbook 6102 are available at:

Internet/Intranet Services Directive 6102 http://www.va.gov/pubs/directives/Information-Resources-Management-(IRM)/6102d.doc Internet/Intranet Services Handbook 6102 http://www.va.gov/pubs/handbooks/Information-Resources-Management-(IRM)/6102h.doc

Internet/Intranet Services Handbook 6102 Change 1 – updates VA's cookie use policy, Section 508 guidelines, guidance on posting of Hot Topics, approved warning notices, and minor editorial errors.

http://www.va.gov/pubs/handbooks/Information-Resources-Management-(IRM)/61021h.doc

In addition, any technologies that enable a Network Delivered Application (NDA) to access or modify resources of the local machine that are outside of the browser’s ”sand box" are strictly prohibited. Specifically, this prohibition includes signed-applets, or any ActiveX controls delivered through a browser's session. ActiveX is expressly forbidden within the VA while .NET is allowed only when granted a waiver by the VA CIO *PRIOR* to use.

JavaScript is the preferred language standard for developing relatively simple interactions (i.e., forms validation, interactive menus, etc.) and Applets (J2SE APIs and Java Language) for complex network delivered applications.

SECTION 508

The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2)(A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government. Section 508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a Federal department or agency.

Section 508 text is available at:

http://www.opm.gov/HTML/508-textOfLaw.htm http://www.section508.gov/index.cfm?FuseAction=Content&ID=14

G. CONFIDENTIALITY AND NONDISCLOSURE

It is agreed that:

1. The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order.

2. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.

3. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.