R614--Document Destruction Services Request for Information

DRAFT STATEMENT OF WORK Page 2 of 2 ?.## STATEMENT OF WORK Confidential On-Site Shredding Services Providence VBA Regional Office (304) BACKGROUND The Department of Veterans Affairs, (Veterans Benefits Administration Providence Regional Office, 380 Westminster Street, Providence, RI 02903, has a requirement for onsite confidential shredding services of paper documents in accordance with VA Directive 6371 including all appendices. The contractor shall provide scheduled service every two (2) weeks, and unscheduled services that may arise from overflow or record purging. Contractor shall perform all on-site shredding services for offices located exclusively at 380 Westminster Street, Providence, RI 02903 SCOPE The contractor shall provide all labor, personnel, equipment, supplies, secured vehicles, materials, supervision, and other related services necessary to provide commercial document destruction services for the Department of Veterans Affairs, Veterans Benefits Administration Providence Regional Office, 380 Westminster Street, Providence, RI 02903. The Contractor shall be responsible for conducting orientations to new contractor employees. This will not relieve the contractor s obligation to provide documentation of trustworthiness of new employees. The contractor and employees will be accompanied by a VA employee while inside the Federal Building located at 380 Westminster Street, Providence, RI 02903. The contractor shall be responsible for final disposition of all shredded materials in the Providence Regional Office, approximate volume of up to two (2) 95-gallon bins per month. All shredding shall take place at the Providence Regional Office loading dock located at 380 Westminster Street, Providence, RI 02903, and shall be witnessed by a VA employee authorized to witness destruction of sensitive VA Material. The Contractor shall shred materials in accordance with this Statement of Work and all applicable regulations and directives. The Contractor is responsible for safeguarding material until final destruction. When material is burned residue must be reduced to white ash. The contractor shall provide the Providence Regional Office with two (2) 95-gallon bins, secure containers (bins) to collect and store materials to be shredded until such time that shredding of the materials occurs. Bin quantities will be stated on each task order. The contractor shall provide bins that have wheels, can hold an average of 300 lbs. (95-gallons), possess locking mechanisms, and utilize a keyed lock. All like size containers will use the same key lock and key code, sets of keys and/or combination for the bin locking mechanisms shall be issued to the VA Providence Regional Office Records Management Officer (RMO). The bins shall have a slot for inserting material into the bin while minimizing unauthorized access to the bin and materials. The Contractor shall provide for Monthly On-Site Shredding Service: up to (2) 95-gallon bins containers per service Services every two (2) weeks (between 1 to 2 containers per service). Unscheduled Services: The vendor shall provide up to three (3) unscheduled services per contract year, during normal facility business hours and within five (5) business days of notification at a predetermined cost to the Government. (between 1 to 2 containers per service) The VA Providence Regional Office shall designate the secure office workspace where the bins will be stored. The contractor will be paid only for those bins the Providence Regional Office presents for document destruction. The contractor will allow cancellation of any pickup, with no charge to the Government, if 48 hours notice or more is provided by the Government to the contractor. Notice will be in the form of an email to the contractor s point of contact. PLACE OF PERFORMANCE / HOURS OF OPERATION The Department of Veterans Affairs, (Veterans Benefits Administration) Providence Regional Office, 380 Westminster Street Providence, RI 02903 What floor are the Bins located? Is there a loading dock the vendor can use? Describe the loading dock to include whether there is a raised portion (including height) and how the vendor would get to the raised portion, such as a ramp or stairs. Describe where the vendor will park and the distance from there to the place the bins will be located for them to pick up. Is there an elevator the vendor can use? Will the facility bring the Bins to the vendor or is the vendor expected to get them? Normal Business Hours are 8:00 AM EST to 4:00 PM EST. Unless directed by the RMO, or Regional Office, work at the site will not take place on Federal Holidays or weekends. If a Federal Holiday falls on a day scheduled for shredding, the shredding will resume the next official workday between the scheduled hours. Vendor shall contact the RMO or designated representative at least one hour prior to arrival at the shred material pick up location by calling the RMO s direct extension. A mutually agreed date and time shall be established for the document destruction visits and may be changed via mutual agreement between the government and the contractor. PERIOD OF PERFORMANCE: The base year period of performance will be 12 months, with four (4) one-year pre-priced option periods exercised at the discretion of the Contracting Officer. DESTRUCTION OF TEMPORARY PAPER RECORDS Not all VA data contained in temporary paper records is sensitive, however, sensitive data that is contained in temporary paper records often are Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive information. Regardless of whether the temporary paper records contain PII, PHI, or VA sensitive information, they must be handled and disposed of properly. Temporary paper records will be disposed of securely, economically, and effectively in accordance with applicable disposition instructions. Sensitive information that is not disposed of properly could result in harm to the Department and/or to subject individuals. Wherever feasible, temporary records should be recycled, while still meeting the requirements for final destruction. Procedures for the destruction of temporary paper records including those temporary records that contain sensitive information, and the minimum set of standards that information destruction contractors (and their subcontractors or third parties) must meet are contained in Appendix A of VA Directive 6371. CERTIFICATE OF DESTRUCTION: At a minimum, the contractor will conduct on-site interim destruction of the VA shred material and will present the RMO with a written Acknowledgement of Interim Certificate of Destruction prior to departing the Regional Office. The contractor must also provide the RMO written documentation that attests to the completion of the destruction process of VA temporary paper records after the final destruction, as defined by policy. Certification documentation can be in the form of a letter, memo, or any format attesting to complete destruction. This certification is not considered a valid certification of destruction if completed and submitted prior to the final destruction of the records. The certification should contain sufficient information to attest to the final destruction of the temporary paper records what temporary records were destroyed, the date and amount destroyed, what destruction method was used, where they were destroyed, and who was responsible for their final destruction. The Certificate of Destruction must also read Final Destruction . If the final destruction is completed by an information destruction contractor, then the written Certification of Destruction is completed by the information destruction contractor. If the final destruction is completed by a subcontractor to the information destruction contractor, then the written Certification of Destruction is completed by this third party or by the information destruction contractor with assurance from the third party that final destruction was completed. The assurance can be in general terms describing the destruction method, date of destruction and amount destroyed, i.e., 75 bales of shredded material. Certificates of destruction from information destruction contractors must be maintained in accordance with applicable VA Records Control Schedules and should be completed and provided to the VA organization that created the temporary paper records only after final destruction has taken place. A Certificate of Destruction must be submitted for every shipment of temporary paper records released to an information destruction contractor. Final Destruction: Final destruction is the process through which temporary paper records are pulped, macerated, shredded, or otherwise destroyed to a degree that definitively ensures they are not readable or reconstructable to any degree. If this final destruction is performed away from a VA facility it must be performed by an information destruction contractor (or its subcontractor of a third party) who has demonstrated that: Its destruction process constitutes final destruction as defined in VA Directive 6371; and It has implemented reasonable physical safeguards to protect VA temporary paper records during their transportation, transfer, or short-term storage prior to the completion of their final destruction. Long-term storage (e.g., more than 30 days) must be approved in advance and in writing by the VA organization that generated the temporary paper records. Interim Destruction: The contractor will, at a minimum, perform on-site interim destruction of the VA shred material it picks up at the Regional Office. Interim destruction is any physical destruction process that substantially reduces the risk that PII, PHI, or other VA sensitive information will be disclosed during transport and short-term storage (i.e., less than 30 days) of temporary paper records but does not meet the requirement of final destruction as defined in VA Directive 6371. Interim destruction is a reasonable physical safeguard that affords an additional layer of security for temporary paper records once they are identified for destruction. It is generally accomplished through maceration, chopping, pulverization, or shredding where these processes do not render the material unreadable or where the material could be reconstructed. Interim destruction must be completed prior to the contractor departing the Regional Office and carried out by either: a. A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records until final destruction has been completed; or b. A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371, Appendix A. Methods of interim destruction carried out by an information destruction contractor must be witnessed by a VA employee or, if authorized by the VA organization that created the temporary paper records, a contractor (or subcontractor or third party) employee may act as witness. If a contractor (or subcontractor or third party) employee is the witness, then that individual must, prior to departing the VA location, provide the designated VA representative with documentation that acknowledges receipt of the temporary paper records and a certificate of completion of interim destruction. Although lesser destruction measures (e.g., interim destruction) may be taken prior to the secure transport of temporary paper records, final destruction of the records must ensure the information on the temporary paper record is not readable or reconstructable to any degree. If final destruction is not carried out by VA employees, then the final destruction must be witnessed by a VA employee or, if authorized by the VA organization that created the temporary paper records, a contractor (or subcontractor or third party) employee may serve as witness. If final destruction is not carried out by VA employees, it must be carried out by either: a. A NAID certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction; or b. A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371, Appendix A. If the final destruction is witnessed by a contractor (or subcontractor or third party), then the contractor must submit a valid Certificate of Final Destruction to the VA organization that created the temporary paper records. If one or more subcontractors (or third parties) handle VA temporary paper records before final destruction, then the contractor will require documentation in any and all subsequent contracts or agreements between the primary information destruction contractor and their subcontractors or third parties that the subcontractors or third parties will provide sufficient reasonable safeguards for the temporary paper records, to the same standards required of the primary contractor, throughout the destruction process. The assigned Records Manager for the VA organization that created the temporary paper records must review all contracts related to the destruction of temporary paper records to ensure the requirements of VA Directive 6371 are satisfied. Readable: Printed data is readable when strategies can be used to assist with decoding (the translation of letters into sounds and/or visual representations of speech) data and arriving at comprehension using morpheme, semantics, syntax, and contextual clues to integrate the information they have read into their existing framework of knowledge in order to arrive at a meaning. Reconstructable: Printed data is reconstructable when methods can be employed to reassemble the various portions of material in such a fashion that data can be decoded as to make it readable so that meaning can be derived from the data found on the media. PERFORMANCE OUTCOMES OBJECTIVES The contractor will arrive with equipment capable of picking up, loading, and completing onsite destruction of the material contained within the contractor provided shredding bins at the Providence Regional Office. The contractor will shred paper documents in accordance with VA Directive 6371, Destruction of Temporary Records. The contractor s owned and operated equipment will comply with industry standards for cross-cut or double-cut shredding. The final product, if not recycled, will be disposed of by pulping, macerating, shredding, burning, or otherwise definitively destroying the information contained in the material. Interim shred will be of such size as to not be easily reconstructable or readable prior to leaving the Providence Regional Office. The contractor will provide the RMO/Alternate RMO/RMT on the same day that shredding service is provided, and prior to leaving VA premises, a written Certificate of Destruction in accordance with VA Directive 6371, Destruction of Temporary Records. If Final Destruction is not completed on VA grounds at the time of shredding service, the contractor will provide the RMO/Alternate RMO, within 30 days of Final Destruction, a written Certificate of Final Destruction. At the end of each calendar month, the contractor will provide the RMO with a report detailing the number of bins that were collected, weight, date(s) the shredding services were performed, and total cost/value of the provided services. The RMO/Alternate RMO/RMT will always escort the contractor throughout the building. At no point will the contractor be by his or herself. CONTRACTOR QUALITY CONTROL The contractor shall develop and maintain quality control programs to ensure destruction services are performed in accordance with mandated specifications, regulations, and laws. The contractor shall develop and implement procedures to identify and prevent the occurrence of defective services. Contractor shall execute the terms of this contract in a manner that will safeguard the confidentiality of all documents and information. The contractor shall not resell, in any form, any documents that have been destroyed. CONSTRAINTS Contractor owned and operated equipment will be capable of cross cutting or double-cut shredding using disintegrator devices equipped with 3/32-inch security screen. The final product, if not recycled, will be disposed of by pulping, macerating, shredding, burning, or otherwise definitively destroying the information contained in the material. Interim shred will be of such size as to not be easily reconstructable or readable prior to leaving the VBA facility. Contractor will allow for on site vehicle inspection of shredded items for compliance of VA Policy. The RMO/Alternate RMO/RMT must witness the destruction of documents and media. Contractor will allow for unannounced inspection, by a VA representative, of the contractor facilities or other locations that are used by the contractor and/or subcontractor(s)/third party(ies) for completing the services requested at least annually if requested. Contractor is responsible for safeguarding documents until final destruction and will provide safeguard addendums to the service contract as required by Directive 6371. Contractor must maintain a physical chain of custody that will never be broken while conducting shredding/destruction services, while transporting material, and while storing material. Subject to criminal prosecution, contractor personnel will comply with all manner of confidentiality when engaging in the destruction of all VBA temporary records, as per VA Directive 6371, Destruction of Temporary Paper Records. Any contractor personnel found to be reading any VBA material will be promptly removed from the premises where the job is being performed, and the person(s) involved will not be allowed to have access to any future service requests at VBA locations. All contractor employees that will handle VA Sensitive Information will be required to complete and adhere to the terms of TMS course 10176, VA Privacy and Information Security Awareness and Rules of Behavior, for safeguarding of VA Sensitive Information. Prior to the start of work, the contractor will submit to the CO a signed copy of the Rules of Behavior for each employee who will handle VA Sensitive Information in the performance of the contract. The contractor will also provide the CO a list of those employees that have reviewed the Rules of Behavior at the beginning of the contract, whenever there is a change to the employee list, or at least annually. The Department of Veterans Affairs online Information Security Rules of Behavior training TMS course 10176 at https://www.tms.va.gov will be completed by all contractor/subcontractor personnel handling shred material before services can begin. The training certificates will be provided to the Contracting Officer s Representative for the applicable task order. All contractor vehicles utilized in the performance of this contract will maintain insurance (Mandatory minimum coverage required by the respective state) and will maintain current state inspection and vehicle registration. The contractor, or contractor employees, while performing under this contract, will not use personal vehicles to transport containers to and from the Government and contractor s site. The contractor will ensure all contractor vehicles utilized for the performance of this contract are kept in proper working condition. The contractor will keep vehicles locked and properly secured at all times while at the Government site or in route to and from the contractor s site. The contractor will adhere to the VBA policies applicable to all record destruction as outlined in VA Handbook 6300, Records and Information Management, VA Directive 6371, Destruction of Temporary Paper Records, and VBA Letter 20-21-04, Records, and Information Management. These guidelines are designed to protect sensitive and private information from being disclosed to unauthorized parties and adhere to the Privacy Act and the Health Insurance Portability and Accountability Act (HIPAA), Privacy rules and regulations. Examples of sensitive information include but are not limited to personally identifiable information (PII), protected health information (PHI), benefits, VBA sensitive information, personnel and or personal information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information. For instances where equipment malfunction occurs during the shredding process, the contractor will immediately provide to the RMO a contingency plan to ensure completion of the shredding within twenty-four work hours. The contractor will maintain a current listing of employees/subcontractor employees handling shred material. The list will include the employee s name, address, phone number, level of security, and position held. The list will be validated and signed by the company Facility Security Officer and provided to the RMO. An updated listing will be provided when an employee s status or information changes. The contractor has twenty-four hours to inform the RMO, in writing that the employee does not work for them due to termination, transfer, suspension, or extended absence from the employer s duty position. If the employee is reinstated a written notification must be provided to the RMO. Contractor/subcontractor staff will comply with Homeland Security Presidential Directive-12 (HSPD-12), NIST 800-53, Office of Management and Budget (OMB) guidance M-05-24, as amended, and Federal Information Processing standards Publication (FIPS PUB) Number 201, as amended. Contractor personnel will immediately report to the RMO and provide any information or circumstances of which they are aware may pose a threat to the security of Department of Veterans Affairs personnel, contractor personnel, resources, classified, and unclassified information. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or their contractor-owned or privately-owned vehicle while on VBA premises and locations. If the RMO finds it in the best interest of the Government he/she may at any time during the performance of this contract order the contractor to remove any of his/her personnel from further performance under this contract for reasons of their moral character, unethical conduct, security reasons and violation of on-site building rules. In the event it becomes necessary to replace any contractor personnel for any of the above reasons, the contractor will bear all costs associated with such removal, including the costs for the replacement of any personnel so removed. These charges will not be chargeable to the Government. In the event of an accident on the Department of Veterans Affairs premises or locations involving Government personnel or property, the contractor will submit a report immediately to the RMO on company letterhead that will include the following: the time and date of occurrence. the place of occurrence. a list of personnel directly involved; and a narrative or description of the accident to include chronological order of the accident and circumstances. The contractor will not hold any discussions or release any information related to the contract to anyone not having a direct interest in performance of this contract, without written consent of the RMO. This restriction applies to all news releases of information to the public, industry, or Government agencies. The contractor will not advertise information about projects performed for this contract without Government review and approval. Advertisement is considered but not limited to promotional brochures, posters, tradeshow handouts, world-wide-webpages, magazines, newspapers, and similar promotions. All work is to be performed by competent personnel, experienced and qualified to provide services. Contractors will keep all VA records and related information strictly confidential. Contractor/subcontractor personnel will wear identifying clothing and name badges while performing any tasks at VBA Regional Offices. Changes to the Statement of Work (SOW) Any changes to this SOW will be authorized and approved only through written correspondence from the Contracting Officer (CO). Costs incurred by the contractor through the actions of parties other than the Contracting Officer will be borne by the contractor. RECORDS MANAGEMENT OBLIGATIONS Applicability This clause applies to all contractors whose employees create, work with, or otherwise handle Federal records regardless of the medium in which the record exists. Definitions Federal record as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. The term Federal record: includes [Agency] records. does not include personal materials. applies to records created, received, or maintained by Contractors pursuant to their [Agency] contract. may include deliverables and documentation associated with deliverables. Requirements Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation. In accordance with 36 CFR 1222.32, contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data. Department of Veterans Affairs and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Department of Veterans Affairs or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, contractor must report to [Agency]. The agency must report promptly to NARA in accordance with 36 CFR 1230. The contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to Department of Veterans Affairs control, or the contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4). The contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The contractor (and any sub-contractor) is required to abide by Government and [Agency] guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information. The contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with [Agency] policy. The contractor shall not create or maintain any records containing any non-public [Agency] information that are not specifically tied to or authorized by the contract. The contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act. The Department of Veterans Affairs owns the right to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which Department of Veterans Affairs shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20. Training. All contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take Department of Veterans Affairs provided records management training. The contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training. [Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.] Requirements to subcontractors The contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract, and require written subcontractor acknowledgment of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor. Certificate of Destruction  The contractor will provide the RMO/Alternate RMO/RMT on the same day that shredding service is provided, and prior to leaving VA premises, a written Certificate of Destruction indicating either interim or final destruction has been completed.  The Certificate of Destruction will, at a minimum, contain the following: 1.            Pickup/delivery location 2.            Pickup/delivery dates 3.            Name of the RMO or designated representative at pickup location 4.            Name of contractor employee who destroyed the material 5.            Destruction Certificate Document number 6.            Date of Destruction 7.            Amount of shredded material (number of containers picked up and/or pounds shredded) 8.            Degree of destruction, interim or final, as defined by VA Directive 6371, Destruction of Temporary Paper Records 9.            Any other information as determined necessary by the CO or RMO/Alternate RMO. If the above certification documents Interim Destruction, the Certificate of Destruction must clearly state the provided shredding service constitutes Interim Destruction.   If Final Destruction is not completed on VA grounds at the time of shredding service, the contractor will provide the RMO/Alternate RMO, within 30 days of Final Destruction, a written Certificate of Final Destruction. The Certificate of Final Destruction will, at a minimum, contain the following: 1.            Pickup/delivery location 2.            Pickup/delivery dates 3.            Method of transportation 4.            Site of final destruction, i.e., name of subcontractor/third-party 5.            Date of final destruction 6.            Amount destroyed, i.e., 15 bales of shredded material 7.            Name of contractor or subcontractor employee who witnessed and/or can attest to final destruction 8.            Method of final destruction (bleached, pulped, macerated, shredded, burned, etc.)  9.            Certification by the contractor and/or subcontractor/third-party that the material has been destroyed to a degree that definitively ensures the material in its final state is not readable or reconstructable to any degree {VA Directive 6371} 10.         Any other information as determined necessary by the CO or RMO/Alternate RMO. TECHNICAL REFERENCES VA Directive 0710, Personnel Suitability, and Security Program VA Handbook 0710, Personal Security and Suitability Program VA Directive 6500, Information Security Program VA Handbook 6500.6, Contract Security VA Handbook 6500.6, Appendix A, Checklist VA Directive 6371, Destruction of Temporary Paper Records VA Directive 6371, Appendix A, VA Handbook 6300.1, Records Management Procedures VBA Letter 20-21-04, Records, and Information Management 5 U.S.C. §552a, Privacy Act 44 U.S.C. 3301, Definition of Records VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE GENERAL SECURITY All Contractors and Contractor personnel shall be subject to the same Federal security and privacy laws, regulations, standards and VA policies as VA, including the Privacy Act, 5 U.S.C.§552a, and VA personnel, regarding information and information system security. Contractors must follow policies and procedures outlined in VA Directive 6500, Information Security Program; and VA Handbook 6500.6. See attached VA 6500.6 Appendix C, which is incorporated in the resulting purchase order to ensure appropriate security controls are in place. Contractor Personnel Security a. Any individual who requires access to the VA site(s), personally identifiable information (PII) and/or access to VA local area network (LAN) systems shall be the subject of a favorable fingerprint check (SAC) adjudicated by VBA Personnel Security Office (PERSEC). Individuals are required a background investigation and must receive a favorable adjudication from the VA Personnel Security and Adjudication Center (PSAC). These requirements are applicable to all sub-contractor personnel requiring any Background Investigation (BI) conducted by Defense Counterintelligence Security Agency (DCSA). b. The level of BI will be in accordance with VA Directive 0710 dated June 4, 2010 and is available at http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=487&FTyp. Background Investigation: The Contractor employee level of BI required for this effort is: Low Risk (T1) Security Employees Moderate Risk (T2) Managers and Directors Note: The position sensitivity should reflect the results from the completion of the PDAT versus the title of the individual. Investigation Documents: Immediately after contract award, the COR will provide the Contractor with the following background investigation documents to be completed by the Contractor and returned thru the COR to VBA PERSEC to begin the background investigations process for all contract employees working on the contract who will have access to VA/VBA facilities, VA systems, or privacy data: 1. Background Investigation Request Worksheet 2. Optional Form 306 Declaration of Federal Employment 3. VBA Contractor Fingerprint Request Form 4. VA Form 0710 Authorization for Release of Information Fair Credit Report (if T2 or higher) 5. (SC) Self-Certification Form (if applicable) 6. VA Form 0711 Request for Personal Identity Verification Card 7. SIC Contractor Background Request Form (unsigned) Submitting Completed Package: Upon receipt of documents listed above from the COR, the COR will submit the background investigation package to VBA s Personnel Security Specialist. Upon notification of favorable fingerprint results, the COR should request the official VA email account and will be notified of all background investigation requirements preventing the Contractor from an immediate onboard. Thereafter, the Contractor shall receive an email notification from DCSA including detailed instructions regarding completion of the background clearance application process in the Electronic Questionnaires for Investigations Processing (e-QIP) system. e-QIP is an online, internet accessible system, where the Contractor employee shall complete the security questionnaire required for OPM to process background investigation. Once the e-QIP is released by VBA PERSEC, scheduled by OPM, the Contractor may begin work while the background investigation is ongoing. Reciprocation: Contractors who have current favorable background investigation previously conducted by OPM or DCSA may be accepted through reciprocation. When a previous personnel security clearance is currently held, it does not preclude the Contractor form submitting a complete Background Investigation Package as stated above to the COR immediately after contract award for all Contractor employees who will be working on the contract. Pre-Screen: The Contractor shall prescreen all personnel who require access to VA site(s) and/or access to VA LAN systems to ensure they maintain a U.S. citizenship or Alien Registration that authorizes them to work in the U.S., and are able to read, write, speak, and understand the English language. Contractor Performance: Contract performance shall not commence before A. The VBA has confirmed favorable fingerprint results, or B. PSAC confirms that it has received the Contractor s investigative documents, The documents are complete, and that the background investigation information has been released to OPM for scheduling of the background investigation, or C. VBA or the PSAC has confirmed that the verified investigation will be reciprocated. Copy of Certificate of Investigation (COI): The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably completed or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The Contractor, if notified, of an unfavorable adjudication by the Government, shall withdraw the employee from consideration from working under the contract. Failure to comply, the Contractor personnel security requirements may result in termination of the contract for default. Responsibility: The Contractor shall be responsible for the actions of those contract and subcontract employees it provides to perform work for the VBA. In the event damage arises from work performed by Contractor employees the Contractor will be responsible for resources necessary to remedy the incident. Vendor Selection: Should the Contractor use a vendor other than OPM or DCSA to conduct background investigations, the investigative company must be certified by OPM/DCSA to conduct Contractor background investigations. The Vendor Cage Code number must be provided to the VA PSAC, which will verify the information and conclude whether access to the Government s site(s) and/or VA LAN systems can be granted. Investigative History: The investigative history for Contractor personnel working under this contract must be maintained in the databases of either OPM or DCSA. Government Responsibilities: After the VBA PERSEC has quality controlled the BI package from the Contractor, the VBA PERSEC will send a courtesy e-mail notification to the Contractor and the COR identifying the e-QIP email from DCSA including detailed instructions regarding completion of the BI application process and the level of background that was requested. Upon receipt of required background investigative documents, VBA PERSEC will review the background investigative documents for completion and initiate the background investigation by forwarding the background investigative documents to OPM to conduct the BI. If the background documents are not complete, VBA PERSEC will notify the Contractor and COR of deficiencies and include corrective instructions. VBA PERSEC will pay for background investigations and reciprocals processed through the VA PSAC and conducted by OPM in advance. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the BI has been favorably adjudicated or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The COR will also notify the Contractor of an unfavorable adjudication by the Government. Training a. All Contractor and sub-contractor personnel requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and networks: 1) Sign and acknowledge understanding of and responsibilities for compliance with the National Rules of Behavior related to access to VA information and information systems. 2) Successfully complete any cyber security or privacy training as required for VA personnel with equivalent information and/or system access. b. The Contractor shall provide to the Contracting Officer a copy of the training certificates and signed Rules of Behavior for each applicable employee within 30 days from the date TMS access is granted and annually thereafter, as required. These online courses are located at https://www.tms.va.gov/learning/user/login.jsp