Combine Solicitation – R– SHREDDING SERVICE

Notice Type: Combine Solicitation

Posted Date: 29-DEC-11

Office Address: Department of Veterans Affairs;VA Sierra Pacific Network (VISN 21);VA Palo Alto Health Care System (90/NCA);3801 Miranda Ave;Palo Alto CA 94304-1207

Subject: R-- SHREDDING SERVICE

Classification Code: R - Professional, administrative, and management support services

Solicitation Number: VA26112Q0253

Contact: [email protected] mailto:[email protected] [Contract Specialist]

Description: Department of Veterans Affairs

VA Palo Alto Health Care System

Department of Veterans Affairs Palo Alto Health Care System

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice in conjunction with procedures in FAR Part 13. This announcement constitutes the only solicitation, a written solicitation will not be issued. The solicitation number, VA-261-12-Q-0253 is issued as a Request for Quotation (RFQ). This document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-54 effective November 02, 2011 and Veterans Affairs Acquisition Regulation Supplement (VAAR) current to January 7, 2010. Interested persons may identify their interest and capability to respond to the requirement or submit proposals. All proposals received prior to 01/02/12 will be considered by the Government. A determination by the Government not to compete with this proposed contract based upon responses to this notice is solely within the discretion of the Government. Information received will normally be considered solely for the purpose of determining whether to conduct a competitive procurement. NAICS code is 561990, size standard $7MIL.

Requirement Description:

ITEM DESCRIPTION OF QTY UNIT UNIT AMOUNT

NO. SUPPLIES/SVCS PRICE

1 12 MO _______________ __________________

Vendor to provide all labors and equipment to provide shredding and removal of confidential materials generated at VA Redding & Chico OPC facilities.

Statement of Work: Security Shredding will be the contractor to destroy and dispose of our confidential materials at VA Redding and VA Chico Clinics. The documents shall be destroyed/shredded using a cross cut shredder which produces particles that are 1x5 millimeters in size, or which pulverizes/disintegrates paper materials using disintegrator devices equipped with 3/32 inch security screen. The contractor shall supply as many locking security consoles/bins as necessary, at no charge to the VA. Bins will also include pad locks and inner nylon liners supplied by the contractor at no charge to the VA. The inner liners will capture confidential materials that are being disposed of by VA staff. Once every two weeks, or as deemed necessary based on the accumulation of papers, Security Shredding driver will pickup and remove the inner nylon bag from all bins located within the facility and exchange with an empty liner. The liners of confidential materials will be transported to Security Shredding mobile truck and the destruction of materials will be destroyed/shredded at their designated plant. The shredded materials will then be transported to a local recycling facility. The driver will be required to provide an inventory list of items that were shredded each console and location that was picked up and submit this report to the site Manager and/or his/her designee. At the conclusion of each service the driver will issue a legal document "Certificate of Destruction ---ensuring that all materials were destroyed beyond recognition to the Site Manager. At the end of each month the contractor will furnish to the Site Manager and the COTR a report indicating the number of pounds destroyed/shredded. At any time during this contract/agreement, the VA has the option to add or remove security consoles/bins at no charge to the VA. Security consoles should be approximately 20"W x 36"H x 19 1/2 "D or any combination that may be necessary. The consoles shall be kept locked at all times. Two sets of keys, or as many as required will be given to the Site Manager. In the event that additional pickups may be needed the contractor shall be available within 48 hours of the request of notice to respond to the unscheduled service. The destruction of confidential materials is the responsibility of the Information Security Officers. The COTR's and/or designee's will assist the ISO when possible in random inspections of the destruction of confidential materials.

Minimum Statutory Requirements

At a minimum, service contracts, in which VA sensitive information and/or systems are accessed by a VA contractor/subcontractor require the following five requirements per 38 U.S.C. '--' 5723 and 5725:

a. A prohibition on unauthorized disclosure: See VA handbook 6500.6 Appendix C, paragraph 3a. - (VA Information Custodial Language- Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).)

b. A requirement for data breach notification: See VA Handbook 6500.6, Appendix C, paragraph 6.a. --" (Security Incident Investigation- The term '-'security incident--' means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.)

c. A requirement to pay liquidated damages in the event of a data breach: See VA Handbook 6500.6, Appendix C, paragraph 7.a., 7.d.- 7a -(Liquidated Damages for Data Breach - Consistent with the requirements of 38 U.S.C. --5725, a contract may require access to sensitive personal information, If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.) 7.d -(Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $ 37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least

3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and

credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.)

d. A requirement for annual security/privacy awareness training:. See VA Handbook 6500.6, Appendix C, paragraph 9. 9" -" (Training:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document --" e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.)

e. Requirement to sign VA's Rules of Behavior: "Before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall sign on an annual basis an acknowledgment that they have read, understand, and agree to abide by VA's Contractor Rules of Behavior which is attached to this contract." See VA Handbook 6500.6, Appendix C, paragraph 9, Appendix D. Note: If a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor's designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA's information and information systems.

SOLICITATION PROVISIONS/CONTRACT CLAUSES:

FAR 52.212-1 Instructions to Offerors - Commercial Items (Jun 2008).

FAR 52.212-3 Offeror Representations and Certifications -- Commercial Items (Aug 2009): Offerors must include a completed copy of the provision with its offer. If the offeror has completed online representations and certifications at https://orca.bpn.gov/, the offeror only needs to complete paragraph (b). If the offeror has not completed online representations and certifications, the offeror must complete all relevant portions of this provision.

FAR 52.212-4 Contract Terms and Conditions -- Commercial Items (Jun 2010).

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Nov 2011) For the purposes of this clause items (b) 4, 6, 7, 11, 16, 22, 25, 26, 27, 28, 30, 31, 37, 39, 41, 44, 47 (c) 1, & 2 are considered checked and apply.

FAR 52.232-38 Submission of Electronic Funds Transfer Information with Offer (May 1999)

FAR 52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998).

For the purpose of this provision, the fill-in's are provided at:

https://www.acquisition.gov/far/index.html

http://www.va.gov/oamm/oa/ars/policyreg/vaar/

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998).

For the purpose of this clause, the fill-in's are provided at:

https://www.acquisition.gov/far/index.html

http://www.va.gov/oamm/oa/ars/policyreg/vaar/

VAAR 852.203-70 COMMERCIAL ADVERTISING (JAN 2008)

The bidder or offeror agrees that if a contract is awarded to him/her, as a result of this solicitation, he/she will not advertise the award of the contract in his/her commercial advertising in such a manner as to state or imply that the Department of Veterans Affairs endorses a product, project or commercial line of endeavor.

(End of Clause)

VAAR 852.273-75 SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES (Interim - October 2008)

(a) The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce'sNational Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST's Web site at: http://checklists.nist.gov

(b) To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in "VA Information and Information System Security/Privacy Requirements for IT Contracts" located at the following Web site:

http://www.iprm.oit.va.gov/docs/Security_and_Privacy_Requirements_for_IT_Contracts_Attachment.pdf

(End of Clause)

VAAR 852.273-76 ELECTRONIC INVOICE SUBMISSION (Interim - October 2008)

To improve the timeliness of payments and lower overall administrative costs, VA strongly encourages contractors to submit invoices using its electronic invoicing system. At present, electronic submission is voluntary and any nominal registration fees will be the responsibility of the contractor. VA intends to mandate electronic invoice submission, subject to completion of the federal rulemaking process. At present, VA is using a 3rd party agent to contact contractors regarding this service. During the voluntary period, contractors interested in registering for the electronic system should contact the VA's Financial Services Center at http://www.fsc.va.gov/einvoice.asp.

Contracting Office Address:

Department of Veterans Affairs; VISN 21

3801 Miranda Avenue, 90CCA

Palo Alto, CA 94304

Primary Point

Carol Lam

[email protected]

Phone: 650-493-5000 X65825

Fax: 650-493-2546

Link/URL: https://www.fbo.gov/spg/VA/VAPAHCS/VAPAHCS/VA26112Q0253/listing.html