TAC-PWS Gate 17 Maintenance_v1.docx

(SAP) PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Austin Information Technology Center (AITC) Gate 17 East and West Annual Maintenance Date: August 25, 2020 PWS Version Number: 1.0

Facilities Management Unit (305A) Gate 17 East and West Maintenance

Page 3 of 15 SAP PWS Template, FFSAO Version

Contents

5.1 EQUIPMENT…………………………………………………………………….……..6

DESCRIPTION OF SERVICES

· Perform complete maintenance of two (2) B&B ARMR model 450 E K12 rated slide gates. Provide emergency repair services for the automatic gates with a 12-hour response time. Spare Parts to be provided under this contract should include (relays, switches, drive gears, bearings, grease fittings, nuts, bolts, washers, mechanical connections, latch pin actuators, terminal blocks/electrical connections) any spare part deemed by Manufacture Recommendations. Provide the listed services Below per Manufacture Recommendations. Twelve annual visits will be provided in the form of twelve (12) monthly PMs and two (2) semiannual PMs. Emergency repair visits will not count as a regularly scheduled maintenance visit.

APPLICABLE DOCUMENTS

Documents referenced or germane to this Performance Work Statement (PWS) are listed below. In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March 2006

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

7. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security Program,” May 18, 2007

8. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

9. VA Directive 6500, “Information Security Program,” August 4, 2006

10. VA Handbook 6500, “Information Security Program,” September 18, 2007

11. VA Handbook 6500.2, “Management of Security and Privacy Incidents,” June 17, 2008.

12. VA Handbook 6500.3, “Certification and Accreditation of VA Information Systems,” November 24, 2008.

13. VA Handbook, 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

14. VA Handbook 6500.6, “Contract Security,” March 12, 2010

15. Project Management Accountability System (PMAS) portal (reference PWS References -Technical Library at https://www.voa.va.gov/).

16. National Institute Standards and Technology (NIST) Special Publications

17. VA Directive 6508, VA Privacy Impact Assessment, October 3, 2008

18. VA Directive 6300, Records and Information Management, February 26, 2009

19. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

PERFORMANCE DETAILS

The gates operations pose a significant part of AITC perimeter security. Because of this all maintenance activities must be closely supervised by certified experienced personnel also coordinated and accompanied by a representative from the AITC Facilities Management staff (305A). All of the maintenance activities will be performed between the hours of 4:00 PM to 4:00 AM (CST) each day consecutively until complete unless determined otherwise by the COR.

PERFORMANCE PERIOD

The period of performance shall be 1 year from date of award, with 4 option periods for 1 year.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at 1615 Woodward Street, Austin, TX 78772.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

· Emergency Repairs shall be on a 12-hour response window by the maintenance contractor.

Any repair parts needed for emergency repairs outside of the listed spare parts are the responsibility of the owner (VA). At no time should the gate needing repair be out of service more than one week (7) days.

· Due to the nature of this facility Normal Maintenance Activities shall be performed between 7 – 4.

· Spare Parts to be provided under this contract shall include ( relays, fuses, loop detectors, switches, drive gears, bearings, grease fittings, nuts, bolts, washers, mechanical connections, latch pin actuators, terminal blocks/electrical connections) any spare part deemed by Manufacture Recommendations

· Provide the listed services Below per Manufacture Recommendations. Fourteen annual visits will be provided in the form of twelve (12) monthly PMs and two (2) semiannual PMs. Emergency repair visits will not count as a regularly scheduled maintenance visit.

· The maintenance contractor shall be responsible for the removal and disposal of all defective parts, trash and debris generated as a result of maintenance activities.

· Scheduling of maintenance visits is the responsibility of the contractor visits should be scheduled at least seven (7) days in advance.

Monthly Inspections We recommend you perform the following visual inspections monthly. ** Ensure main power switch is OFF when inspecting, adjusting or replacing drive system components**

· During the opening and closing cycle, verify the gate operates smoothly and does not bind. Adjust the guide wheels as necessary to eliminate binding.

· Inspect the motor pinion gear for wear and verify that the proper spacing is present between the spur gear and gear rack. Ensure all bolts are tight.

· Verify gate limit switches and locking pin limit switches (Model 450) are in the proper position and operational. Adjust and tighten if necessary.

· Verify locking pin is aligned with beam assembly (Model 450).

· Inspect rack, pinion, and wheel areas and add grease or cosmoline as needed.

· Grease 8” drive wheels.

· Grease pillow block bearings on motor assembly.

· Inspect cradle pivot drive assembly components for wear and adjust assembly if needed. Ensure all bolts are tight.

· Verify chain tension and adjust as needed.

· Verify the safety devices are functioning correctly.

· Verify electrical connections are tight.

· Visually inspect the condition of the finish. If corrosion is present, wire brush and sand the area then repaint with primer and matching color.

Six-Month Inspections The contractor shall perform the following inspections every six months.

· Repeat the monthly inspections and adjustments.

· Verify the fluid level in the transmission by removing the oil level plug. If fluid is not present, fill with Mobil SHC 629 or equivalent.

· Inspect guide wheels. Check for proper adjustment and wear on wheels or gate. Readjust if necessary.

· Inspect roller wheels, grease fittings. Make sure oil seals (on side of wheels) are still tight and no grease is coming out the sides of them. Make sure that the wheels and nuts are still tight, and the wheels are turning freely.

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverables:

A. Monthly Progress Report A full monthly maintenance report along with any recommended service replacements, etc. shall be provided by the last day of each month.

GENERAL REQUIREMENTS

Approved vendor must have minimum of five (5) years’ immediately prior experience in automatic gate installation and maintenance.

The contractor shall be a factory (B&B ARMR) authorized maintenance provider or a direct representative of the manufacture (B&B ARMR).

All services to be directly supervised by qualified personnel who are trained and experienced in the performance of the services mentioned above. All work shall be performed by trained service technicians using equipment, materials and procedures specified above.

5.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

The following security requirement must be addressed regarding Contractor supplied equipment: Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

The Contractor shall support VA efforts in accordance with the Project Management

The position sensitivity and the level of background investigation commensurate with the required level of access is:

|X| Low/NACI

Contractor Responsibilities:

1. For a Low Risk designation, with a period of performance requirement of 180 days or less, a Special Agreement Check (SAC) is required. A Department of Veterans Affairs (DVA) Memorandum – Electronic Fingerprints form is required for fingerprinting. This should be submitted to the CO or COR after award has been made.

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. The Contractor employee may work on the contract once the SAC has been favorably adjudicated. The Contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration in working under the contract.

1. Failure to comply with the Contractor personnel investigative requirements may result in termination of the contract for default.

5.3 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2000/2003/2007, MS Excel 2000/2003/2007, MS PowerPoint 2000/2003/2007, MS Project 2000/2003/2007, MS Access 2000/2003/2007, MS Visio 2000/2002/2003/2007, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

5.4 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with this effort.

Efficient and effective in meeting requirements Meets technical needs and mission requirements Offers quality services/products Acceptable/ Unacceptable

Products completed, reviewed, delivered in timely manner Notifies customer in advance of potential problems Acceptable/ Unacceptable

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A SAP Performance Based Service Assessment Survey will be used in combination with the QASP to assist the Government in determining acceptable performance levels.

5.5 FACILITY/RESOURCE PROVISIONS

B. Staging Area

1. A small area will be made available within the building for storage of materials. Advanced coordination with the COR and the warehouse manager will be required.

6. TYPE OF CONTRACT

This is a Firm Fixed Price contract.

7. SCHEDULE FOR DELIVERABLES

Note: Days used in the table below refer to calendar days unless otherwise stated. Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government work day after the weekend or holiday.

Due each month throughout the period of performance (PoP).

Electronic submission to: COR, CO Inspection: destination Acceptance: destination

8. POINTS OF CONTACT

VA Program Manager:

Name:

Address: 1615 Woodward St. Austin. Texas 78772 Voice:

Email:

Contracting Officer’s Representative:

Name:

Address: 1615 Woodward St. Austin. Texas 78772 Voice:

Email:

Contracting Officer:

Name:

Address:

Voice:

Email:

9. ADDITIONAL ITEMS

GOVERNMENT RESPONSIBILITIES

The following needs to be provided by the VAPM/COR to the Contractor:

0. For a Low Risk position designation, the Security Investigations Center will require, the DVA Memorandum – Electronic Fingerprints. (The DVA Memorandum – Electronic Fingerprints is filled out by the VA Facility that took the electronic fingerprint.)

1. The agency performing the SAC will notify the CO and Contractor after adjudicating the results of the fingerprint check received from OMB.

SPECIAL INSTRUCTIONS/REMARKS

Equipment and/or materials required to perform the work listed in Section 4.0 above can be delivered to the VAAITC loading dock M-F from 7:00AM to 4:00 PM (CST), but must be coordinated with the COR

|X| Insert Addendum A into the Solicitation, see embedded file

|X| (Always Checked for Services- VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C.

Security Requirement guidance to CO within Section B9 Training, Para. a) Sub Para. d, Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

|X| (Always Checked for Services)

SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (Interim - OCT 2008)

(a) The Contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST’s Web site at: http://checklists.nist.gov/.

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contracts” located at the following Web site: http://www.iprm.oit.va.gov/.

(END OF CLAUSE)

SECURITY CHECKLIST REQUIREMENTS-- (If the customer answers yes to questions 4, 5, 6, and/or 7 on the Information Security Checklist, then follow the steps indicated. If the customer answers No to any of the questions, then no action is required for those questions)

|_| Yes |_| No Question 4: Contracting Officials need to work with the Program Manager or (procurement requestor), COR, PO, and ISO to:

i. Include the appropriate risk designation of the Contractors based on the PDAT determination. (Contractor Personnel Security Requirements are covered in Section 5.2 of this PWS)

ii. Incorporate the security clause (Appendix B) into the contract involved and the appropriate security/privacy language outlined in Appendix C into the solicitation. (Include Clause above and VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE VA HANDBOOK 6500.6, APPENDIX C. in PWS)

iii. Determine if protected health information is disclosed or accessed and if a BAA is required.(CO to Provide BAA Assistance (Using Nov 2008 version of BAA (approved by OGC) and coordinate with BAA Manager)

|_| Yes |_| No Question 5: Incorporate the clause from Appendix B and the appropriate security/privacy language from Appendix C respectively into the solicitation and contract and initiate planning for the certification and accreditation of the Contractor system(s). Contracting Officials need to work with the COR and ISO to:

· Determine the security impact of the IT system as High, Moderate, or Low per 6500 Handbook, Information Security Program. (Covered in Contractor Personnel Security Requirements Section 5.2)

· Ensure Contractor understanding of the IT security requirements for certification and accreditation (authorization) (C&A) of the Contractor system. See VA Handbook 6500.3, Certification and Accreditation. (CO to notify COR of this responsibility in letter to COR)

· Ensure that the proper VA Management Official is appointed by the Certification Program Office to formally authorize operation of the system in accordance with VA Handbook 6500 and 6500.3. (CO to notify COR of this responsibility in letter to COR)

· Enforce Contractor performance (timely submission of deliverables, compliance with personnel screening requirements, maintenance of secure system configurations and participation in annual IT Federal Information Security Management Act (FISMA) assessments to ensure compliance with FISMA requirements). (CO to notify COR of this responsibility in letter to COR)

· Ensure yearly FISMA assessments are completed and uploaded into SMART. (CO to notify COR of this responsibility in letter to COR)

|_| Yes |_| No Question 6: Incorporate the security clause from Appendix B and the appropriate security/privacy language from Appendix C respectively into the solicitation and contract. Contracting Officials need to work with the COR and the ISO to:

· Ensure Contractor understands and implements the IT security requirements for system interconnection documents required per the Memorandum of Understanding or Interconnection Agreement (MOU-ISA). The standard operating procedure (SOP) and a template for a MOU-ISA are located on the Information Protection Risk Management (IPRM) Portal and can be provided to the Contractor. (CO to notify COR of this responsibility in letter to COR and supply MOU-ISA template)

· Ensure Contractor understands their participation in IT security requirements for C&A of the VA system to which they connect (CO to notify COR of this responsibility in letter to COR)

· Enforce Contractor performance (timely submission of deliverables, compliance with personnel screening requirements, and appropriate termination activity as appropriate). (CO to notify COR of this responsibility in letter to COR)

|_| Yes |_| No Question 7: Incorporate the security clause and the appropriate security language from Appendices B and C into the solicitation and contract. The COR needs to:

· Ensure that a Contractor Security Control Assessment (CSCA) is completed within 30 days of contract approval and yearly on the renewal date of the contract. (CO to notify COR of this responsibility in letter to COR and to supply CSCA Document-Self Assessment Questionnaire for Contract Service Providers)

· Ensure that the CSCA is sent to the ISO and the OCS Certification Program Office for review to ensure that appropriate security controls are being implemented in service contracts. (CO to notify COR of this responsibility in letter to COR)

· Ensure a copy of the CSCA is maintained in the Security Management and Reporting Tool (SMART) database. COR will provide a copy of the completed CSCA to ISO for uploading into SMART database. (CO to notify COR of this responsibility in letter to COR)

|X| (Always Checked for Services) Contractor Rules of Behavior-Appendix D in Handbook 6500.6 – (CO to add to solicitation, CO to ensure Contractor signs document) image1.jpeg image2.emf

Addendum A

ADDENDUM A

Cyber and Information Security Requirements for VA IT Services

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations.[footnoteRef:1] The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation. [1: See VAAR 852.273-75 referenced infra. ]

Each documented initiative under this contract incorporates the security clause VAAR 852.273-75 by reference as though fully set forth therein, as well as the VA Handbook 6500.6, “Contract Security,” March 12, 2010, in its entirety. Both the security clause VAAR 852.273-75 and the VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order.

Training requirements: The Contractor shall complete all mandatory training courses identified on the current external VA training site, the Employee Education System (EES), and will be tracked therein. The EES may be accessed at https://www.ees-learning.net/librix/loginhtml.asp?v=librix. If the decision is made by the local Program Office to provide the Contractor a VA Talent Management System (TMS) account, the Contractor shall use the VA TMS to complete their mandatory training, accessed at http://www.insidetms.va.gov/

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance

The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). The VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards:

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.access-board.gov/sec508/standards.htm. A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems

_x_§ 1194.22 Web-based intranet and internet information and applications

_x_§ 1194.23 Telecommunications products

_x_§ 1194.24 Video and multimedia products

_x_§ 1194.25 Self contained, closed products

_x_§ 1194.26 Desktop and portable computers

_x_§ 1194.31 Functional Performance Criteria

_x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. The VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. The VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.