SOW-Motorola Maintenance FY2023 Privacy Review Revision.docx

James H. Quillen VA Medical Center (JHQVAMC) Motorola Police Radio Maintenance Statement of Work (SOW)

1.0 Scope of Work. This is a contract for corrective and preventative maintenance services of existing hardware and software components, and configuring hardware and software to site specific parameters for 6 USC 194 Project 25 compliant proprietary Motorola ASTRO 25 L1 Core Police Radio System components at the following facility building locations:

Maintain Motorola ASTRO 25 L1 Core Police Radio System and NICE Logging Recorder and Playback Station. Included in maintenance: GCP 8000 site controller, switch/gateway, on (1) NM Client, two (2) MCC 7500 Dispatch Consoles, one (1) 4- channel GTR 8000 repeater site, two (2) conventional GTR 8000 repeaters, four (4) APX 7500 consolettes, and MCC 7500 IP NICE Logging Recorder/Playback Station. Subcontracted service providers are accountable to the Contractor, who, in turn is responsible to the Government.

1.1 Description of Services- Introduction. The Contractor shall provide all personnel, equipment supplies, facilities, transportation, tools, materials (approved products list (APL) hardware and software), supervision and other item and non-personal services necessary to perform maintenance of the Motorola ASTRO 25 L1 Core Police Radio System and NICE Logging and Playback Station. The Contractor shall perform to the Motorola Certified Standards in this contract or above standards.

1.2 Background

1.2.1 JHQVAMC procured a Motorola ASTRO 25 L1 Core Police Radio System in 2012 to meet compliance with government-wide standards for communications for federally controlled facilities. In February 2005, Department of Commerce, National Institute of Standards and Technology (NIST) released the required standard as Federal Information Processing Standards Publication (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors. The current version is FIPS 201-2, dated August 2013. The radio system is required to be interoperable across Federal government facilities and communicate with Homeland Security.

1.2.2 To achieve compliance with Project 25, Homeland Security, and related requirements and technical standards, JHQVAMC and its affiliated facilities as listed above are working to maintain a certified Police Radio System. It requires a software connection for Police Dispatch and integration of approximately 35 APX7000, 15 APX 8000, and 50 APX Next handheld Police Radios, and 5 vehicle mounted systems. These radios are essential to communicate critical situations and life threatening or criminal conditions.

1.3 Objectives. Contractors shall perform procurement of all required hardware and software system components, licenses, system design, installation, configuration, acceptance testing, and maintenance (corrective and preventive) of credential component of the ASTRO 25 L1 Core and MCC 7500 IP NICE Logger/Playback Station to ensure conformance with all parameters in the current version of all federal communications requirements and NIST SP800-116, FICAM, FIPS 201-2 applied to radio areas.

1.4 Scope. The contractor shall provide equipment (software and hardware) and services for procurement, installation, maintenance, operator training on system for administration, registration, provisioning/de-provisioning, alarm processing and event log generation, and show that registration, provisioning, and subsequent use of a Police radio credential is completed with certificate validation. All additional equipment from what exists currently shall be new, unused, and covered under manufacturer's warranty period. Warranty period shall be no less than 12 months and warranty period shall start at the time of installation into service.

1.5 Period of Performance. Four years.

1.5.1 Contractor is required to perform all work during normal Federal business hours. Contractor shall perform services between the hours of 7:30 a.m. to 4:30 p.m., Monday through Friday, excluding Federal holidays. The recognized Federal Government holidays are as follows: New Year’s Day, Dr. Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day.

1.6 System Acceptance. The contractor shall demonstrate and show:

· The system shall pass a predefined Quality Control Test before acceptance by the Government.

· Shall meet or exceed Motorola ASTRO 25 L1 Core Police Radio System Standards.

1.6.1 Quality Control. Contractor shall demonstrate that the system runs with minimal online or offline errors, alarm errors, or software issues to best extent possible. If any equipment is made deficient through contractor negligence, the contractor shall be financially responsible and shall be responsible for replacement at no cost to the Government.

1.6.2 Special Qualifications. The contractor’s on-site staff shall include current Motorola certified System Engineers and certification as per Motorola communications requirements.

- The contractor’s on-site staff shall have valid PIV credentials always worn and visible.

- Motorola manufacturer training and certification.

- No contractor staff shall perform duties under this contract unless they receive an HSPD-12 PIV Badge with full credentials. Contractor failure to accomplish this step will eliminate that employee from working under this contract at any JHQVAMC facility site.

1.6.3 Post Award Progress Meetings.

- The contractor agrees to attend all post award meetings convened by the Contracting Officer, or Contract Administration Officer, in accordance with the FAR as appropriate to review the contractor’s performance. The contractor will apprise the Government of any problems and brief an action plan to remedy the problem.

- Appropriate actions shall be accomplished to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.7 Contracting Officer Representative (COR). The COR and Assistant COR are identified in this contract process. The COR/Assistant COR monitor all technical aspects, surveillance, and quality assurance of the contract, and assist in contract administration; maintain written and verbal communications with the contractor; issues government provided property, drawings, and site entry. The COR/Assistant COR shall not change terms and conditions of this contract. Only the Contracting Officer with concurrence from JHQVAMC can change the terms of this contract.

1.7.1. Government Key Personnel.

The following personnel are considered Key Personnel by the Government for this contract:

1.7.2 Contractor Key Personnel. The contractor shall provide a Contract Manager who shall be responsible for the performance of the work. The name of this person and an alternate who is authorized to, with full authority, act for the Contractor when the Manager is absent, shall be identified in writing to the contracting officer. The Contract Manager, and alternate, shall be available business hours during the Task Order Period of Performance.

1.8 Contractor Travel. Contractor shall travel to various locations defined in the Scope of Work above to accomplish work under this contract. Key personnel from JHQVAMC will travel as assigned to ensure performance is accurate and Motorola ASTRO 25 L1 Core Police Radio System and components are performing well. Travel for the contractor is at the contractor’s expense and at no additional charge to the Government. The contractor shall coordinate travel with JHQVAMC Key Personnel to ensure the facility staff knows the arrival time, the scope of work and the period of work performance. Failure to timely coordinate these details with JHQVAMC Key Personnel may result in no work, especially for patient care areas. Coordination with JHQVAMC Key Personnel shall occur thirty-five days in advance for access to patient care areas.

1.9 Specific Requirements.

1.9.1 Equipment. All Motorola ASTRO 25 L1 Core Police Radio System equipment parts shall be proven Motorola certified and all other requirements compliant in all aspects.

1.9.2 Contractor Staff. All contractor staff involved with System Design, Installation, Configuration, Acceptance Testing, Corrective Maintenance, Preventive Maintenance (Life Cycle Management) shall have proven competencies.

1.9.3 All on -site installation personnel and technical support personnel will be U.S.

Citizens and have a favorable fully credentialed U.S. Government National Agency Check and valid PIV Badge.

2.0 General Requirements- Government Support. Government will make available IP Address ranges and Switch ports in identified communication closets for all required peripherals and network connectivity as required to achieve compliance with GSA Evaluation Program for FIPS 201-2 compliance.

2.0.1 Programming. All programming, software load, and maintenance will be done on-site.

2.0.2 On-Site Programming Only. Contractor shall not have remote (client) access to network and access control systems to perform maintenance, trouble shoot problems, or apply software system updates or repairs. Contractor shall have on-site access to the Motorola ASTRO 25 L1 Core Police Radio System.

2.0.3 General Contractor Responsibilities. Contractor shall provide all supervision, tools, supplies, equipment, labor, non-personal services, installation, testing, and incidental training on the equipment to complete the work properly and successfully under this contract.

2.0.3.1 Connectivity. ASTRO 25 L1 Core Hardware shall be connected as per manufacturers and physical security specifications.

2.0.4 Log-on Passwords. All User and Administrator level login and passwords required for the launching; updating; and manipulation of all associated applications of the required software for operation of the ASTRO 25 L1 Core and related Logging systems will be US Government owned.

2.1 SOW Period. Contract covers a period of four years (4 years), from date of acceptance. Payments will be made within 30 days of submission of invoices into Invoicing, Receipt, Acceptance, and Property Transfers (IRAPT). Contractor shall provide detailed invoices in accordance with the FAR to ensure proper payment for services rendered for each month of service.

2.2 Maintenance. Contractor is responsible for ensuring that existing infrastructure is maintained and updated to current Motorola program levels to maintain a working ASTRO 25 L1 Core System. Contractor will be responsible for providing a detailed list (Model, Brand, Specs, Serial Number) of any equipment to be replaced during maintenance actions. This information will be provided to the COR prior to installation. The remedy of equipment failure is the repair/replacement of the failed item through Motorola Solutions Repair Depot. In addition to equipment failure, the contractor will be responsive to different aspects of service interruption or outage. These include but are not limited to the following:

2.2.1 Full Outage or system failure/non-responsive software/hardware that causes non-operation of the ASTRO 25 L1 Core System including the NICE Logging/Recorder Unit.

2.2.2 Partial Outage, where one or more JHQVAMC buildings, WCTVAOC buildings, or other components are affected with complete or partial non-operational status.

2.2.3 Equipment Specific, where singular points of failure in equipment are identified, thus rendering the node in question inoperable and in need of replacement/remediation before fully operational service can be restored.

2.3 Failure Reporting. Upon notification by COR or Assistant COR of a failure, the contractor will respond initially by phone or email within 90 minutes and no later than 48 hours in person during or after normal duty hours. The contractor will have a technical support person for consultation during normal business hours, which is reachable by telephone or email. The contractor will also provide information on how to contact technical support personnel as well as the Motorola Solutions Service Desk.

2.4 Corrective Maintenance Priority Scheduling. Downtime of the ASTRO 25 L1 Core and NICE Logging Unit component shall be kept to an absolute minimum. The contractor shall notify the Government of all projected downtime and estimated time for repair for any down time on any component at any time. All parts that store data or have any resident or residual data or partial data shall be turned over to the COR and JHQVAMC and shall not be placed in the trash or taken away from JHQVAMC.

2.5 Maintenance Activities Reporting. The contractor will provide written report of all services rendered at time of repairs. All covered equipment will be repaired within one business day. The contractor shall maintain spare parts sufficient to support one day or less repair time. If repair of equipment is expected to exceed the one-business day period, the contractor will provide written justification or action plan as to the nature of the delay in repair/replacement of identified equipment within 12 hours of system evaluation.

2.6 Maintenance Schedule Quality Assurance Plan. Contractor will propose maintenance schedule and life-cycle replacement for systems and equipment. The government will approve the plan.

2.7 Performance Evaluation. The COR or Assistant COR will periodically evaluate the contractor’s performance by appointing of a representative(s) or conducting monitoring of performance to ensure services are received. The COR or Assistant COR will evaluate the contractor’s performance through intermittent on-site inspections of the contractor's quality control program and receipt of complaints from JHQVAMC personnel. COR and Assistant COR may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections, or because of repeated JHQVAMC Staff complaints. Likewise, COR and Assistant COR may decrease the number of quality control inspections if performance dictates. COR and Assistant COR will also receive and investigate complaints from various JHQVAMC locations. The contractor shall be responsible for initially validating COR and Assistant COR complaints. However, the COR and Assistant COR are responsible to ruminate on the validity of complaint(s) in cases of disagreement with contractor’s resolution.

2.8 When all pre-final inspection discrepancies have been corrected, the COR or Assistant COR will conduct the final inspection with all or as necessary some of the following: Program Manager, Police Service representatives, the Contractor, and any subcontractors. Acceptable quality level is 100%.

2.9 Preventive maintenance and warranties included in the Contract and covered by the contractor will be performed on all systems quarterly. Acceptable quality level is 100%.

2.10 Documented processes performed, and any deficiencies found upon completion of maintenance will be submitted within five working days to COR. Acceptable quality level 100%.

2.11 Components that are found not to operate properly or exceeds the components’ lifecycle during preventive maintenance will be repaired or replaced by the contractor who will submit a written estimate to the COR. Acceptable quality level 100%.

2.12 A written request for Government funding shall be approved before contractor initiates matters beyond inclusive contracted actions, warranties, upgrades, updates, and licenses. Acceptable quality level should be 100%.

3.0. Protection, Security and Safety Policies.

3.1 Access and General Protection/Security Policy and Procedures. The contractor shall be responsible for meeting each of the access and general protection security policies and procedures for all JHQVAMC and WCTVAOC facilities and Police Service personnel will assist when requested by the Servicing Company.

3.1.1 A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

3.1.2 All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

3.1.3 The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3.2 Physical Security. The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

3.3 Sensitive Information. The contractor shall not disclose and shall safeguard procurement sensitive information, computer systems, data, keys, encryption, PII, Privacy Act data, PHI, and Government personnel work products which are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature.

3.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

3.3.2 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures follow VA directive requirements.

3.3.3 Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

3.3.4 The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

3.3.5 The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. MARCH 12, 2010, VA HANDBOOK 6500.6 APPENDIX C C-3

3.3.6 If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

3.3.7 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

3.3.8 The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

3.3.9 The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

3.3.10 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

3.3.11 Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

3.3.12 For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

3.4 Disclosure of Information. The contractor may be required to access data and information proprietary to another Government agency, another Government contractor, or of such a nature that its dissemination or use other than as specified would be averse to the Government’s interest. The contractor’s employees shall not divulge, or release data or information developed or obtained under this contract except to authorized Government personnel or upon written approval of the JHQVAMC FOIA Office. The contractor will not copy or duplicate the information contained in the Administrator’s workstation for system management IAW the Privacy Act of 1974. Information contained in the system for badge/organizational license production will not be downloaded for any purpose.

Unauthorized disclosure of information contained in the system for access to JHQVAMC & WCTVAOC facilities is prohibited and will require immediate documented reporting upon discovery by the contractor to the JHQVAMC Privacy Office, Contracting Officer, COR, and Assistant COR for processing. The contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend. The contractor shall obtain written permission from the JHQVAMC Privacy/FOIA Office prior to releasing any information. Under Title 18, Sections 793 and 798, the contractor and contractor employees are liable for any improper release of proprietary government information. The contractor shall direct to JHQVAMC Privacy/FOIA Office and copy to the COR and Assistant COR all inquiries, comments, or complaints arising from matters observed, experienced, or learned because of, or in connection with, the performance of the contract, the resolution of which may require the dissemination of official information. No information of any kind shall be disclosed unless approved by the JHQVAMC FOIA Office.

3.5 Information Assurance. The Contracting Officer will ensure that contractor personnel are appropriately certified, and training is documented. Additional training on local or system procedures may be provided by the organization receiving service.

3.5.1 The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with site requirements. The Contractor shall meet the applicable information assurance certification requirements, including‐ (1) approved information assurance workforce certifications appropriate for each category and level as listed in the current version of [Agency Policy] and (2) Appropriate operating system certification for information assurance technical positions as required.

3.5.2 Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. At the award of the contract the Contractor will provide the COR and Assistant COR documentation supporting information assurance certification and the names of contractor personnel performing information assurance functions.

3.5.3 Contractor personnel who do not have proper and current certifications shall be denied access to JHQVAMC, VA, VHA, and all Government information systems for performing information assurance functions.

3.6 Security Incident Investigation The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

3.6.1 To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

3.6.2 With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

3.6.3 In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

3.7 Liquidated Damages for Data Breach Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

3.7.1 The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

3.7.2 Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access).

(2) Description of the event, including: (a) date of occurrence; (b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and MARCH 12, 2010, VA HANDBOOK 6500.6 APPENDIX C C-11 Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

3.7.3 Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $_37.50_ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

3.8 Security Controls Compliance Testing On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

3.9 Training All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to VA information and information systems.

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training, Appendix D

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training. For this contract, the DISA Identifying, and Safeguarding Personally Identifiable Information (PII) Public Training located at https:// public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/ is acceptable.

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

3.9.1 The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

3.9.2 Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

3.10 Safety. Contractor and associated sub-contractors shall provide a safe and healthful work environment for their employees as prescribed in FAR 52.236-14, 29 CFR Part 1910, pertinent provisions of local regulations, policies, and SOPS. They shall safeguard public and Government personnel, property, equipment, and avoid interruption of Government Operations. The Contractor will report accidents or losses to the Contracting Officer, COR and Assistant COR as specified in relevant regulations and standards. Whenever the Contractor becomes aware of serious or imminent danger to Government, civilian or Contractor personnel, the Contractor shall take immediate corrective action and report all finding to the COR and Assistant COR.

3.10.1 Contractor shall maintain work areas in a neat, clean, and safe condition. The Contractor shall be responsible for providing, installing, and removal of any temporary signage, barriers, barricade tape, etc., which may be required to control pedestrian and vehicle traffic in the work area.

3.10.2 Contractor shall collect all trash, debris, refuse, garbage, etc., which is generated and place it in appropriate containers. The materials shall be removed from the site by appropriate means daily, unless otherwise approved by the COR or Assistant COR. Disposal may be outside the limits of Government property. Coordination with and approval from the COR or Assistant COR shall occur prior to any disposal of equipment and supplies by the contractor.

3.11 Applicable Documents. The Contractor shall ensure all construction for this project is completed within 29 CFR (Code of Federal Regulation) 1910, OSHA General Standards, and 29 CFR 1926, to include OSHA Construction Standards, Unified Facilities Criteria (UFC) 3-580-01 Telecommunications Building Cabling Systems Planning and Design, Unified Facilities Criteria (UFC) 3-600-01 Fire Protection Engineering for Facilities, UFC 4-010-01 Minimum Antiterrorism Standards for Buildings, International Building Code, and Uniform Mechanical Code, and VA Technical Guide for Installation Information Infrastructure Architecture. Furthermore, all electrical work shall comply with NFPA Life Safety Code 101, the latest edition of NFPA 70, (National Electric Code) and NFPA standards for communications.