SAM #36C10D26Q0115

Confidential On-Site Document Destruction Services for Providence VBA Regional Office

The Department of Veterans Affairs, Veterans Benefits Administration (VBA), is seeking confidential on-site document destruction services for its Providence Regional Office. - Scope of Work: - Secure, biweekly shredding of up to two 95-gallon locking bins of paper documents - Up to three unscheduled shredding services per year - Contractor must provide bins, labor, equipment, supplies, supervision, and secure vehicles - Services must comply with VA Directive 6371 and include interim and final destruction certifications - Contractor personnel must undergo background investigations and adhere to strict security, confidentiality, and records management standards - Performance Standards: - All shredding must be performed on-site at the Providence Regional Office - VA personnel will escort contractor staff during service - Compliance with federal privacy and security regulations is mandatory - Contract Structure: - Base period of 12 months with four one-year option periods - Locations: - Place of performance: Providence Regional Office, 380 Westminster Street, Providence, RI 02903 - Contracting office: 1800 G Street NW, Washington, DC 20006 - Commercial Opportunity: - No specific OEMs or vendors named; open to qualified document destruction service providers - Requirements focus on secure, compliant, and reliable on-site shredding - Regulatory Compliance: - Adherence to VA Directive 6371 and federal privacy/security standards required

Description

DRAFT STATEMENT OF WORK Page 2 of 2 ?.## STATEMENT OF WORK Confidential On-Site Shredding Services Providence VBA Regional Office (304) BACKGROUND The Department of Veterans Affairs, (Veterans Benefits Administration) Providence Regional Office, 380 Westminster Street, Providence, RI 02903, has a requirement for onsite confidential shredding services of paper documents in accordance with VA Directive 6371 including all appendices. The contractor shall provide scheduled service every two (2) weeks, and unscheduled services that may arise from overflow or record purging. Contractor shall perform all on-site shredding services for offices located exclusively at 380 Westminster Street, Providence, RI 02903. SCOPE The contractor shall provide all labor, personnel, equipment, supplies, secured vehicles, materials, supervision, and other related services necessary to provide commercial document destruction services for the Department of Veterans Affairs, Veterans Benefits Administration, Providence Regional Office, 380 Westminster Street, Providence, RI 02903. The Contractor shall be responsible for conducting orientations to new contractor employees. This will not relieve the contractor's obligation to provide documentation of trustworthiness of new employees. The contractor and employees will be accompanied by a VA employee while inside the Federal Building located at 380 Westminster Street, Providence, RI 02903. The contractor shall be responsible for final disposition of all shredded materials in the Providence Regional Office, approximate volume of up to two (2) 95-gallon bins per month. All shredding shall take place at the Providence Regional Office loading dock located at 380 Westminster Street, Providence, RI 02903, and shall be witnessed by a VA employee authorized to witness destruction of sensitive VA Material. The Contractor shall shred materials in accordance with this Statement of Work and all applicable regulations and directives. The Contractor is responsible for safeguarding material until final destruction. When material is burned, residue must be reduced to white ash. The contractor shall provide the Providence Regional Office with two (2) 95-gallon bins, secure containers (bins) to collect and store materials to be shredded until such time that shredding of the materials occurs. Bin quantities will be stated on each task order. The contractor shall provide bins that have wheels, can hold an average of 300 lbs. (95-gallons), possess locking mechanisms, and utilize a keyed lock. All like size containers will use the same key lock and key code, sets of keys and/or combination for the bin locking mechanisms shall be issued to the VA Providence Regional Office Records Management Officer (RMO). The bins shall have a slot for inserting material into the bin while minimizing unauthorized access to the bin and materials. The Contractor shall provide for Monthly On-Site Shredding Service: up to (2) 95-gallon bins containers per service, services every two (2) weeks (between 1 to 2 containers per service). Unscheduled Services: The vendor shall provide up to three (3) unscheduled services per contract year, during normal facility business hours and within five (5) business days of notification at a predetermined cost to the Government. (between 1 to 2 containers per service) The VA Providence Regional Office shall designate the secure office workspace where the bins will be stored. The contractor will be paid only for those bins the Providence Regional Office presents for document destruction. The contractor will allow cancellation of any pickup, with no charge to the Government, if 48 hours or more notice is provided by the Government to the contractor. Notice will be in the form of an email to the contractor's point of contact. PLACE OF PERFORMANCE / HOURS OF OPERATION The Department of Veterans Affairs, (Veterans Benefits Administration) Providence Regional Office, 380 Westminster Street Providence, RI 02903 Questions regarding the location and access: What floor are the Bins located? Is there a loading dock the vendor can use? Describe the loading dock to include whether there is a raised portion (including height) and how the vendor would get to the raised portion, such as a ramp or stairs. Describe where the vendor will park and the distance from there to the place the bins will be located for them to pick up. Is there an elevator the vendor can use? Will the facility bring the Bins to the vendor or is the vendor expected to get them? Normal Business Hours are 8:00 AM EST to 4:00 PM EST. Unless directed by the RMO, or Regional Office, work at the site will not take place on Federal Holidays or weekends. If a Federal Holiday falls on a day scheduled for shredding, the shredding will resume the next official workday between the scheduled hours. Vendor shall contact the RMO or designated representative at least one hour prior to arrival at the shred material pick-up location by calling the RMO's direct extension. A mutually agreed date and time shall be established for the document destruction visits and may be changed via mutual agreement between the government and the contractor. PERIOD OF PERFORMANCE The base year period of performance will be 12 months, with four (4) one-year pre-priced option periods exercised at the discretion of the Contracting Officer. DESTRUCTION OF TEMPORARY PAPER RECORDS Not all VA data contained in temporary paper records is sensitive, however, sensitive data that is contained in temporary paper records often are Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive information. Regardless of whether the temporary paper records contain PII, PHI, or VA sensitive information, they must be handled and disposed of properly. Temporary paper records will be disposed of securely, economically, and effectively in accordance with applicable disposition instructions. Sensitive information that is not disposed of properly could result in harm to the Department and/or to subject individuals. Wherever feasible, temporary records should be recycled, while still meeting the requirements for final destruction. Procedures for the destruction of temporary paper records including those temporary records that contain sensitive information, and the minimum set of standards that information destruction contractors (and their subcontractors or third parties) must meet are contained in Appendix A of VA Directive 6371. CERTIFICATE OF DESTRUCTION: At a minimum, the contractor will conduct on-site interim destruction of the VA shred material and will present the RMO with a written Acknowledgement of Interim Certificate of Destruction prior to departing the Regional Office. The contractor must also provide the RMO written documentation that attests to the completion of the destruction process of VA temporary paper records after the final destruction, as defined by policy. Certification documentation can be in the form of a letter, memo, or any format attesting to complete destruction. This certification is not considered a valid certification of destruction if completed and submitted prior to the final destruction of the records. The certification should contain sufficient information to attest to the final destruction of the temporary paper records — what temporary records were destroyed, the date and amount destroyed, what destruction method was used, where they were destroyed, and who was responsible for their final destruction. The Certificate of Destruction must also read "Final Destruction". If the final destruction is completed by an information destruction contractor, then the written Certification of Destruction is completed by the information destruction contractor. If the final destruction is completed by a subcontractor to the information destruction contractor, then the written Certification of Destruction is completed by this third party or by the information destruction contractor with assurance from the third party that final destruction was completed. The assurance can be in general terms describing the destruction method, date of destruction, and amount destroyed, e.g., 75 bales of shredded material. Certificates of destruction from information destruction contractors must be maintained in accordance with applicable VA Records Control Schedules and should be completed and provided to the VA organization that created the temporary paper records only after final destruction has taken place. A Certificate of Destruction must be submitted for every shipment of temporary paper records released to an information destruction contractor. Final Destruction: Final destruction is the process through which temporary paper records are pulped, macerated, shredded, or otherwise destroyed to a degree that definitively ensures they are not readable or reconstructable to any degree. If this final destruction is performed away from a VA facility, it must be performed by an information destruction contractor (or its subcontractor of a third party) who has demonstrated that: Its destruction process constitutes final destruction as defined in VA Directive 6371; and It has implemented reasonable physical safeguards to protect VA temporary paper records during their transportation, transfer, or short-term storage prior to the completion of their final destruction. Long-term storage (e.g., more than 30 days) must be approved in advance and in writing by the VA organization that generated the temporary paper records. Interim Destruction: The contractor will, at a minimum, perform on-site interim destruction of the VA shred material it picks up at the Regional Office. Interim destruction is any physical destruction process that substantially reduces the risk that PII, PHI, or other VA sensitive information will be disclosed during transport and short-term storage (i.e., less than 30 days) of temporary paper records but does not meet the requirement of final destruction as defined in VA Directive 6371. Interim destruction is a reasonable physical safeguard that affords an additional layer of security for temporary paper records once they are identified for destruction. It is generally accomplished through maceration, chopping, pulverization, or shredding where these processes do not render the material unreadable or where the material could be reconstructed. Interim destruction must be completed prior to the contractor departing the Regional Office and carried out by either: A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records until final destruction has been completed; or A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371, Appendix A. Methods of interim destruction carried out by an information destruction contractor must be witnessed by a VA employee or, if authorized by the VA organization that created the temporary paper records, a contractor (or subcontractor or third party) employee may act as witness. If a contractor (or subcontractor or third party) employee is the witness, then that individual must, prior to departing the VA location, provide the designated VA representative with documentation that acknowledges receipt of the temporary paper records and a certificate of completion of interim destruction. Although lesser destruction measures (e.g., interim destruction) may be taken prior to the secure transport of temporary paper records, final destruction of the records must ensure the information on the temporary paper record is not readable or reconstructable to any degree. If final destruction is not carried out by VA employees, then the final destruction must be witnessed by a VA employee or, if authorized by the VA organization that created the temporary paper records, a contractor (or subcontractor or third party) employee may serve as witness. If final destruction is not carried out by VA employees, it must be carried out by either: A NAID certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction; or A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371, Appendix A. If the final destruction is witnessed by a contractor (or subcontractor or third party), then the contractor must submit a valid Certificate of Final Destruction to the VA organization that created the temporary paper records. If one or more subcontractors (or third parties) handle VA temporary paper records before final destruction, then the contractor will require documentation in any and all subsequent contracts or agreements between the primary information destruction contractor and their subcontractors or third parties that the subcontractors or third parties will provide sufficient reasonable safeguards for the temporary paper records, to the same standards required of the primary contractor, throughout the destruction process. The assigned Records Manager for the VA organization that created the temporary paper records must review all contracts related to the destruction of temporary paper records to ensure the requirements of VA Directive 6371 are satisfied. Readable: Printed data is readable when strategies can be used to assist with decoding (the translation of letters into sounds and/or visual representations of speech) data and arriving at comprehension using morpheme, semantics, syntax, and contextual clues to integrate the information they have read into their existing framework of knowledge in order to arrive at a meaning. Reconstructable: Printed data is reconstructable when methods can be employed to reassemble the various portions of material in such a fashion that data can be decoded as to make it readable so that meaning can be derived from the data found on the media. PERFORMANCE OUTCOMES OBJECTIVES The contractor will arrive with equipment capable of picking up, loading, and completing onsite destruction of the material contained within the contractor provided shredding bins at the Providence Regional Office. The contractor will shred paper documents in accordance with VA Directive 6371, Destruction of Temporary Records. The contractor's owned and operated equipment will comply with industry standards for cross-cut or double-cut shredding. The final product, if not recycled, will be disposed of by pulping, macerating, shredding, burning, or otherwise definitively destroying the information contained in the material. Interim shred will be of such size as to not be easily reconstructable or readable prior to leaving the Providence Regional Office. The contractor will provide the RMO/Alternate RMO/RMT on the same day that shredding service is provided, and prior to leaving VA premises, a written Certificate of Destruction in accordance with VA Directive 6371, Destruction of Temporary Records. If Final Destruction is not completed on VA grounds at the time of shredding service, the contractor will provide the RMO/Alternate RMO, within 30 days of Final Destruction, a written Certificate of Final Destruction. At the end of each calendar month, the contractor will provide the RMO with a report detailing the number of bins that were collected, weight, date(s) the shredding services were performed, and total cost/value of the provided services. The RMO/Alternate RMO/RMT will always escort the contractor throughout the building. At no point will the contractor be by his or herself. CONTRACTOR QUALITY CONTROL The contractor shall develop and maintain quality control programs to ensure destruction services are performed in accordance with mandated specifications, regulations, and laws. The contractor shall develop and implement procedures to identify and prevent the occurrence of defective services. Contractor shall execute the terms of this contract in a manner that will safeguard the confidentiality of all documents and information. The contractor shall not resell, in any form, any documents that have been destroyed. CONSTRAINTS Contractor owned and operated equipment will be capable of cross cutting or double-cut shredding using disintegrator devices equipped with 3/32-inch security screen. The final product, if not recycled, will be disposed of by pulping, macerating, shredding, burning, or otherwise definitively destroying the information contained in the material. Interim shred will be of such size as to not be easily reconstructable or readable prior to leaving the VBA facility. Contractor will allow for on site vehicle inspection of shredded items for compliance of VA Policy. The RMO/Alternate RMO/RMT must witness the destruction of documents and media. Contractor will allow for unannounced inspection, by a VA representative, of the contractor facilities or other locations that are used by the contractor and/or subcontractor(s)/third party(ies) for completing the services requested at least annually if requested. Contractor is responsible for safeguarding documents until final destruction and will provide safeguard addendums to the service contract as required by Directive 6371. Contractor must maintain a physical chain of custody that will never be broken while conducting shredding/destruction services, while transporting material, and while storing material. Subject to criminal prosecution, contractor personnel will comply with all manner of confidentiality when engaging in the destruction of all VBA temporary records, as per VA Directive 6371, Destruction of Temporary Paper Records. Any contractor personnel found to be reading any VBA material will be promptly removed from the premises where the job is being performed, and the person(s) involved will not be allowed to have access to any future service requests at VBA locations. All contractor employees that will handle VA Sensitive Information will be required to complete and adhere to the terms of TMS course 10176, VA Privacy and Information Security Awareness and Rules of Behavior, for safeguarding of VA Sensitive Information. Prior to the start of work, the contractor will submit to the CO a signed copy of the Rules of Behavior for each employee who will handle VA Sensitive Information in the performance of the contract. The contractor will also provide the CO a list of those employees that have reviewed the Rules of Behavior at the beginning of the contract, whenever there is a change to the employee list, or at least annually. The Department of Veterans Affairs online Information Security Rules of Behavior training TMS course 10176 at https://www.tms.va.gov will be completed by all contractor/subcontractor personnel handling shred material before services can begin. The training certificates will be provided to the Contracting Officer's Representative for the applicable task order. All contractor vehicles utilized in the performance of this contract will maintain insurance (Mandatory minimum coverage required by the respective state) and will maintain current state inspection and vehicle registration. The contractor, or contractor employees, while performing under this contract, will not use personal vehicles to transport containers to and from the Government and contractor's site. The contractor will ensure all contractor vehicles utilized for the performance of this contract are kept in proper working condition. The contractor will keep vehicles locked and properly secured at all times while at the Government site or in route to and from the contractor's site. The contractor will adhere to the VBA policies applicable to all record destruction as outlined in VA Handbook 6300, Records and Information Management, VA Directive 6371, Destruction of Temporary Paper Records, and VBA Letter 20-21-04, Records, and Information Management. These guidelines are designed to protect sensitive and private information from being disclosed to unauthorized parties and adhere to the Privacy Act and the Health Insurance Portability and Accountability Act (HIPAA), Privacy rules and regulations. Examples of sensitive information include but are not limited to personally identifiable information (PII), protected health information (PHI), benefits, VBA sensitive information, personnel and or personal information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information. For instances where equipment malfunction occurs during the shredding process, the contractor will immediately provide to the RMO a contingency plan to ensure completion of the shredding within twenty-four work hours. The contractor will maintain a current listing of employees/subcontractor employees handling shred material. The list will include the employee's name, address, phone number, level of security, and position held. The list will be validated and signed by the company Facility Security Officer and provided to the RMO. An updated listing will be provided when an employee's status or information changes. The contractor has twenty-four hours to inform the RMO, in writing, that the employee does not work for them due to termination, transfer, suspension, or extended absence from the employer's duty position. If the employee is reinstated, a written notification must be provided to the RMO. Contractor/subcontractor staff will comply with Homeland Security Presidential Directive-12 (HSPD-12), NIST 800-53, Office of Management and Budget (OMB) guidance M-05-24, as amended, and Federal Information Processing standards Publication (FIPS PUB) Number 201, as amended. Contractor personnel will immediately report to the RMO and provide any information or circumstances of which they are aware may pose a threat to the security of Department of Veterans Affairs personnel, contractor personnel, resources, classified, and unclassified information. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or their contractor-owned or privately-owned vehicle while on VBA premises and locations. If the RMO finds it in the best interest of the Government he/she may at any time during the performance of this contract order the contractor to remove any of his/her personnel from further performance under this contract for reasons of their moral character, unethical conduct, security reasons and violation of on-site building rules. In the event it becomes necessary to replace any contractor personnel for any of the above reasons, the contractor will bear all costs associated with such removal, including the costs for the replacement of any personnel so removed. These charges will not be chargeable to the Government. In the event of an accident on the Department of Veterans Affairs premises or locations involving Government personnel or property, the contractor will submit a report immediately to the RMO on company letterhead that will include the following: the time and date of occurrence. the place of occurrence. a list of personnel directly involved; and a narrative or description of the accident to include chronological order of the accident and circumstances. The contractor will not hold any discussions or release any information related to the contract to anyone not having a direct interest in performance of this contract, without written consent of the RMO. This restriction applies to all news releases of information to the public, industry, or Government agencies. The contractor will not advertise information about projects performed for this contract without Government review and approval. Advertisement is considered but not limited to promotional brochures, posters, tradeshow handouts, web pages, magazines, newspapers, and similar promotions. All work is to be performed by competent personnel, experienced and qualified to provide services. Contractors will keep all VA records and related information strictly confidential. Contractor/subcontractor personnel will wear identifying clothing and name badges while performing any tasks at VBA Regional Offices.

View original listing