Page 1 of Page 1 of 2 Page 1 of THIS REQUEST FOR INFORMATION (RFI) SOURCES SOUGHT IS ISSUED SOLELY FOR MARKET RESEARCH AND PLANNING PURPOSES ONLY AND DOES NOT CONSTITUTE A SOLICITATION. 1. Responses to this Sources Sought must be in writing. The purpose of this Sources Sought Announcement is for market research only to make appropriate acquisition decisions and to gain knowledge of Small Business Capability, including Service-Disabled Veteran Owned Small Businesses and Veteran Owned Small Businesses (SDVOSB/VOSB) interested and capable of performing the work. 2. The NAICS for this requirement is 561990 All other Support Services 3. Interested and capable Contractors should respond to this notice no later than April 24th, 2020 by providing the following via email only to
[email protected] (a) Company Name (b) Address (c) Point of contact (d) Phone, fax, and email of primary point of contact (e) DUNS number (f) Type of small business, if applicable, (e.g. Services Disabled Veteran Owned small business (SDVOSB), Veteran-owned small business (VOSB), 8(a), HUB-Zone, Women Owned Small Business, Small disadvantaged business, or Small Business). (g) A capability statement that addresses the organization s qualifications and ability to perform as a contractor specifically for the work described in paragraph 5 below. Respondents are also encouraged to provide specific examples (e.g. contract number, point of contact information) of the Contractor s experience providing the same or similar supplies/services to that described in paragraph 5 below. 4. SDVOSB/VOSB respondents. (a) If respondent is VOSB or SDVOSB, respondent is encouraged to provide proof of www.vetbiz.gov certification. In addition, SDVOSB/VOSB Contractors are asked to acknowledge that they understand the limitations on sub-contracting pursuant to FAR 52.219-14, Limitations on Sub-Contracting, which will be included in the impending solicitation. Further SDVOSB/VOSB contractors are asked to respond that they are capable of providing the requested services keeping within the parameters of this clause. (b) Small businesses, including SDVOSB/VOSBS are also advised that per 13 CFR, § 125.6 the prime contractor's limitations on subcontracting are as follows: (1) General. In order to be awarded a full or partial small business set-aside contract with a value greater than $150,000, an 8(a) contract, an SDVO SBC contract, a HUBZone contract, a WOSB or EDWOSB contract pursuant to part 127 of this chapter, a small business concern must agree that: (2) In the case of a contract for services (except construction), it will not pay more than 50% of the amount paid by the government to it to firms that are not similarly situated. Any work that a similarly situated subcontractor further subcontracts will count towards the 50% subcontract amount that cannot be exceeded. 5. We are requesting the service of a contractor to provide Onsite Document Destruction for Veteran Affairs of Long Beach Healthcare System (VALBHS); Veteran Affairs of Loma Linda Healthcare System (VALLHS); Veteran Affairs of San Diego Healthcare System (VASDHS); Veteran Affairs of Greater Los Angeles Healthcare System (VAGLAHS). 6. Please note that if VA s pending market research establishes that two or more VOSB or SDVOSB, who are certified in VA s Vendor Information Pages (VIP) site https://www.vip.vetbiz.gov/, can perform the services VA will set aside the underlying solicitation per 38 U.S.C. §8127. 7. All Offerors who provide goods or services to the United States Federal Government must be registered in the System for Award Management (SAM) database found at https://www.sam.gov. Registration must include Representations and Certifications. STATEMENT OF WORK AND CRITERIA FOR B.2 Description/Specifications/Work Statement B.2.1 CONTRACT TITLE: Onsite secured sensitive document destruction services B.2.2 TYPE OF CONTRACT: The Government intends to award a Single Award, Firm-Fixed Price (FFP) contract B.2.3 PERIOD OF PERFORMANCE: The contract resulting from this solicitation will cover a base contract period of one (1) year from date of award, and up to four (4) option periods. Exercise of option(s) is the Department of Veterans Affairs discretion. B.2.4 PARTICIPATING FACILITIES All healthcare systems within Veteran Integrated Service Network (VISN) 22 are active participating facilities for this contract and are as follows: VA Long Beach Healthcare System (600) 5901 E. 7th St. Long Beach, CA 90822 VA Loma Linda Healthcare System (605) 11201 Benton St. Loma Linda, CA 92357 VA San Diego Healthcare System (664) 3350 La Jolla Village Dr. San Diego, CA 92161 VA Greater Los Angeles Healthcare System (691) Los Angeles Ambulatory Care Center 351 E. Temple St. Los Angeles, CA 91343 B.2.5 GENERAL SCOPE: The Government requires onsite secured sensitive document destruction for all healthcare systems for the Department of Veteran Affairs, VISN 22, Veteran Affairs Long Beach Healthcare System (VALBHS), 5901 E Seventh St. Long Beach, CA, 90822; Veteran Affairs Loma Linda Healthcare System, (VALLHS) 11201 Benton St. Loma Linda, CA 92357; Veteran Affairs San Diego Healthcare System (VASDHS), 3350 La Jolla Village Drive, San Diego, CA 92161; Veteran Affairs Greater Los Angeles Healthcare System (VAGLAHS), 11301 Wilshire Blvd, Los Angeles, CA 90073B.2.7 APPLICABLE DOCUMENTS, STANDARDS, LAWS AND/OR REGULATIONS: Contractor is solely responsible for meeting any current or future requirements approvals or certifications as may be levied by applicable legal, regulatory, accrediting body, governing body, and/or local/state/federal requirements as required by law. Due to continuous regulatory changes in both federal and state laws, the contractor shall be in compliance of new regulations within thirty (30) calendar days of notification. A list of applicable documents, standards, laws and/or regulations can be found in SECTION B.2.18 of this statement of work. B.2.6 SPECIFIC REQUIREMENTS: B.2.6.1 GENERAL: Contractor shall provide all labor, personnel, equipment, supplies, vehicles (shredding), materials, supervision and certifications/license to provide onsite secured sensitive document destruction. Contractor shall perform the following specific tasks: The contractor shall furnish various locked security totes and consoles as required for each facility without additional cost to the Government. The contractor will placed all contractor furnished totes or consoles at the designated areas as required by the Government. There are also Government-owned totes and consoles that will be provide during the performance of the contract. Any additional contractor totes / consoles that are provided by the contractor shall be identified with a label and serialized to distinguish Government furnish property and contractors furnish property. Contractor shall also provide an inventory list of all totes / consoles that will be provided to the Government. Each console or tote shall have a label that states SENSITIVE DOCUMENTS ONLY . At the minimum, each locked security containers shall meet the following specifications: Totes: 32, 64, 65, 95, and/or 96 gallon. Shall be easily mobile (e.g. wheels). Shall be plastic in nature. Shall have a locking mechanism (internal or external) with a key. Slot on top of unit to accept various sizes of documents. Labeled and serialized Consoles: 24 to 36 Shall have a locking mechanism (internal or external) with a key. Paper deflector. Collection bag. Labeled and serialized Each healthcare system will need the following amount of totes and/or consoles. The Government s stated quantity of totes / consoles required have been compiled based on historical data and from subject matter experts of each respective healthcare system. The numbers of contractor-owned totes / consoles maybe subject to change to meet the Government s needs. ***Gov t = Government-owned / Ctr = Contractor-owned*** Healthcare System 95 / 96 Gallon Tote 64 / 65 Gallon Tote 32 Gallon Tote 24 / 36 Console Gov t Ctr Gov t Ctr Gov t Ctr Gov t Ctr VA Greater Los Angeles 4 98 VA Long Beach 41 VA Loma Linda 4 16 237 VA San Diego 40 Contactor shall provide FULL SERVICE , CENTRALIZED SERVICE , or HYBRID shredding service for each respective healthcare system requires. This is also identified on the attached shredding schedule (see ATTACHMENT 2 SHREDDING SCHEDULE ). FULL SERVICE: Contractor shall pick up all totes / consoles and bring it to the shredding site to conduct shredding. CENTRALIZED SERVICE: Government employees shall pick up all totes / consoles and bring it to the shredding site for contractor to conduct shredding. HYBRID SERVICE: A mixture of FULL and CENTRALIZED service (e.g. VA Long Beach has CENTRALIZED SERVICE at their main facility, while the CBOC s has FULL SERVICE ). Interim destruction shall be conducted ONSITE and at the specific location designated by the Government. Each respective healthcare system will identify the site where interim destruction will occur (see ATTACHMENT 2 SHREDDING SCHEDULE ). Shred size shall not be larger than the industry standard of 5/8 . If this shredding size is not the final destruction method and is only the interim destruction, then final destruction must be conducted in accordance with VA Directive 6371 Final destruction shall be in accordance with VA Directive 6371, in which documents are pulped, macerated, shredded or otherwise to deem the documents unreadable or reconstructable to any degree. The contractor shall sign a Business Associate Agreement (BAA). If contractor has a national BAA on file with the Veterans Affairs, contractor shall provide a copy of it (see ATTACHMENT 7 BUSINESS ASSOCIATE AGREEMENT - BLANK ). Date of shredding shall conform to attached shredding schedule. Contractor may also propose a revised schedule that will be more effective and cost efficient for both parties (contractor must advise the Government of any proposed changes to the shredding schedule). The contractor shall maintain a chain of security/custody from pick up to final destruction. Contractor to provide Government a Certificate of Destruction (COD) for the number bins shredded prior to departing the facility. Contractor shall deliver industry standard COD for completed destruction according to VA Directive 6371. At the end of the month of service, contractor shall provide facility pounds and number of tips of shredded materials on a monthly basis. This report shall be provided within five (5) business days after the last day of the month. The end of service report will detail the type of materials destroyed, weights, number of containers and dates of services performed. Contractor is responsible FOR ensuring services are provided by qualified and competent personnel for all services pertinent to this contract. Contractor shall provide a contingency plan for instances where equipment malfunctions occur during the shredding process, data breach occurs, emergency plan of action, etc... Contractor shall also provide the list of facilities in which final destruction will occur. The list should include the following minimal information about the facility: Name of facility Point of Contact Address Phone Number The Government may request additional shredding services outside the scope of this contract. Additional shredding services may include onetime bulk shredding, purges, etc... These additional shredding services will not be billable to the contract, but will be paid via Government Purchase Card (GPC), which shall not exceed $2,499.00 for each additional service. To support any additional services required, contractor shall provide price per service that will be inclusive of cost to include all labor, personnel, equipment, supplies, vehicles (shredding), materials, supervision and certifications/license. B.2.7 DOCUMENTATION AND REPORTS: Certificate of Destruction The contractor shall prepare and submit to the medical facility s COR, an original signed Certificate of Destruction (COD) for each pick up for each site within five (5) calendar days of each pickup. The COD may be also sent via an electronic copy to the COR. The contractor shall maintain proper records concerning each COD issued. The COD shall as a minimum contain the following (see ATTACHMENT 9 SAMPLE CERT OF DESTRUCTION ): Pickup/Delivery Location Pickup/Delivery Date Name of Government COR at Pickup Location Amount of shredded waste (number of containers picked up and/or pounds shredded) Destruction Certification Document Number Destruction Certification Date Any other information as determined necessary by the COR. Signature of personnel viewing and confirming final destruction. End of Month Service Report At the end of each month of service, contractor shall provide a report that will provide the following information. This report is due within seven (7) calendar days after the end of the last day of the month (see ATTACHMENT 10 MONTHLY ACTIVITY LOG -SAMPLE ): Date of services Number of containers Types of material destroyed Total weight in pounds or tons B.2.8 NON-DISCLOSURE OF SENSITIVE INFORMATION: Contractor staff involved in this contract will have access to some privileged and confidential materials of the US Government. These printed and electronic documents are for internal use only and remain the sole property of the US Government. Some of the materials are protected by Privacy Act of 1974 (Amended) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials, by any contractor or subcontracted staff, is a criminal offense. The contractor is responsible for actions of contract employees. The contractor acknowledges that in the performance of this contract, the contractor will have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers, and other private or public entities. The contractor agrees to safeguard these privileges and use the information exclusively in the performance of this contract. The contractor shall comply with applicable Government regulations regarding information document security to prevent disclosure of sensitive information to unauthorized individuals or organizations. B.2.9 CONTRACTOR S QUALIFICATIONS: Contractor shall be a firm regularly engaged document destruction services. Contractor s personnel performing on this contract must be fully qualified and competent service technician. The Contractor will be required to update competency information throughout the life of the contract as changes to staff occur. Contractor must provide for Government approval credentials of each service technician. Credentials must be provided prior to the employee being assigned services responsibilities on Government equipment listed herein. Contractor must be AAA certified by the National Association for Information Destruction (NAID). The certification must be current / valid and a copy call shall be furnished to the Government. Contractors shall provide proof and adequacy of past performance history, references, and above required qualifications. When combined with Evaluation Factors, it will assist the Contracting Officer in making the best value and sound business judgment on behalf of the Government (See evaluation factors in FAR Clause 52-212-2, Section E). B.2.10 CONTRACTOR PERSONNEL, BADGES AND PARKING The contractor shall provide the COR with a list of contractor employees expected to enter Government property to pick up confidential documents. While on VA premises, all contractor personnel shall comply with the rules, regulations, and procedures governing the conduct of personnel and the operation of the facility. All Contractor personnel are required to be aware of and observe security, safety and environmental requirements of each Government facility. Including, but not limited to restricted area access, observing vehicle parking regulations and smoking restrictions. If required, a flash badge or access badge will be given to the contractor s employee upon entrance into VA buildings. The contractor employee must safeguard the access badge and immediately report any lost, stolen, or destroyed badges to the COR. All contract personnel must properly display their access badges. Access badges must be worn at or above the waist (facing forward.). The contractor s employees must return the access badge(s) to the COR or designee at the end of each pick up process. Furthermore, contractor s employee maybe required to obtain a Personal Identity Verification (PIV) ID card. If a PIV ID card is required, the contractor will be notified by the Government. The Government point of contract of each healthcare system will provide assistance in this process. Please see following link for information in regards to PIV ID cards: http://www.va.gov/PIVPROJECT/index.asp. Contractor personnel shall wear distinctive clothing bearing the name of the Contractor, closed toe footwear, wearing badges bearing the Contractor name and the employees name in English. Furthermore, contractor personnel are prohibited from wearing shorts or sandals while providing services on Government grounds. The contractor shall be required to comply with all security policies/requirements of each respective Government facility. All security policies/requirements must be met and employees cleared prior to the contractor performing work under this contract. Employees that cannot meet the security and clearance requirements shall not be allowed to perform work under this contract. It is the responsibility of the contractor s personnel to park in the appropriate designated parking areas. Parking information shall be coordinated with each facility COR. The Government does not validate or make reimbursement for parking violations of the contractor s personnel under any circumstance. B.2.12 INFORMATION SECURITY GENERAL Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. VA INFORMATION CUSTODIAL LANGAUGE Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. SECURITY INCIDENT INVESTIGATION The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. LIQUIDATED DAMAGES FOR DATA BREACH Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access); Description of the event, including: date of occurrence; data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; Number of individuals affected or potentially affected; Names of individuals or groups affected or potentially affected; Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; Amount of time the data has been out of VA control; The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); Known misuses of data containing sensitive personal information, if any; Assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: Notification; One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; Data breach analysis; Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. TRAINING All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior (see ATTACHMENT 8 CONTRACTOR RULES OF BEHAVIOR - BLANK ); Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training; Successfully complete the appropriate VA privacy training and annually complete required privacy training; and Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete. B.2.11 BACKGROUND CHECK All Contractor employees and subcontractors working with sensitive VA information are subject to the same investigative requirements as those of regular VA appointees or employees who have access to the same type of data or information. These personnel shall be the subject of a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to contract performance. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the prime Contractor will be responsible for the actions of those individuals they provide to perform work for VA. Position Sensitivity - The position sensitivity shall be as designated by the VA Sponsor or Contracting Officer Representative (COR) assigned to the contract. Most investigations required are Low Risk although some key positions may be designated at higher levels. The risk level designations for public trust positions and the corresponding background investigation levels are defined in VA Directive 0710. Performance - Contract performance shall not commence prior to confirmation from the VA Security and Investigation Center (SIC) that the investigative documents have been submitted. The SIC will notify the VA Contracting Officer, VA Sponsor (COR), and the Contractor upon receipt of the appropriate investigative documents. Public Trust Risk Level Designation Background Investigation Level Low Risk National Agency Check with Written Inquiries (NACI) - A NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions. Contractor Responsibilities - The Contractor shall complete the required documents for each individual and provide a copy to the COR and the Contracting Officer within seven (7) days of contract award. The information is necessary for the Contracting Officer or designee to initiate the investigation with the VA Security and Investigation Center (SIC) in a Contractor Request Database (CRD). Email contact information MUST be provided for the prime contractor point of contact responsible for ensuring completion of this contract requirement. Failure to provide this information to the COR could result in the forms being returned by the SIC. The Contractor shall submit or have their employees submit directly to the VA Security and Investigation Center (SIC) the necessary forms as instructed via an email from the CRD relative to the level of background investigation requested. Contractors shall be informed of due dates to complete all portions of the investigative package. Reminders notifications will be sent if the complete package is not submitted by the due date. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they are able to read, write, speak, and understand the English language. The Contractor shall inform the contract employee that when filling out Standard Form 85, that there should be no gaps in employment history. Any gaps in employment history on Standard Form 85or 85P may result in the SIC rejecting the documentation for investigation. The SIC provides a help desk and necessary forms via the VA forms web site, http://www.va.gov/vaforms/search_action.asp. Contractors who have a current favorable background investigation conducted by another Federal agency may be accepted through reciprocation. Members of the SIC staff will coordinate verification of existing favorable background investigations. The Contractor shall bear the expense of obtaining background investigations. The Contractor shall reimburse the VA within 30 calendar days when billed by the VA. Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default. Government Responsibilities: The VA facility, Fiscal Services, will coordinate the invoices from VA Security on investigations and bill the Contractor. In these instances, the Contractor will reimburse the VA facility within Thirty (30) calendar days. A bill of collection will be prepared by the VA and forwarded to the Contractor for payment. Low Risk (NACI) - $333.00 National Agency Check with Written Inquiries. The case is only open for 30 days except in rare occasions when something in the person s background requires an extension. B.2.12 APPOINTMENT OF CONTRACTING OFFICER S REPRESENTATIVE (COR): Under the authority contained in VAAR 801.603-70 -- Representatives of Contracting Officer the CO will appoint a COR to furnish technical guidance and advice or generally supervise the work under this contract. The COR(s) will be named at the time of award. B.2.13 AUTHORIZED SERVICES / CHANGES: The contractor is advised that only the CO, acting within the scope of the contract has the authority to make changes which may affect the contract terms and conditions, quality, quantity, price, and/or delivery. It is highly encouraged and advised that the contractor contact the COR for approval in the event there are changes prior to proceeding. No other individual has the authority to make this binding changes and/or commitments. In the event that the contractor commits to such changes at the direction of any other person than the CO, the changes shall be considered to have been made without proper authority and no adjustment shall be made in contract price to cover any increase in costs incurred as a result thereof. B.2.14 HOURS OF OPERATION Contractor is responsible for conducting business during normal business hours (normally between 8:00 a.m. to 4:30 p.m.) to facilitate communication between the Government and the Contractor, Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. If a holiday falls on a Sunday, the following Monday will be observed as the National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government agencies. Also included would be any day specifically declared by the President of the United States. Contractor is not required to provide any service(s) on nationally recognized U.S. Government holidays, nor shall the contractor be paid for these holidays. Any schedule services that lands on a holiday will be required to be perform the day before or after the holiday. B.2.14.1 OVERTIME AND HOLIDAYS Any overtime and/or holiday pay that may be entitled to the Contractor s employee(s) shall be the sole responsibility of the Contractor and shall not be billed to nor reimbursed by the Government. B.2.14.2 NATIONAL HOLIDAYS Listed below are the ten (10) national holidays. New Year s Day January 1st Martin Luther King s Birthday Third Monday in January President s Day Third Monday in February Memorial Day Last Monday in May Independence Day July 4th Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day November 11th Thanksgiving Day Fourth Thursday in November Christmas Day December 25th B.2.15 SERVICE CALLS Contractor shall provide information requested below as to where service calls are to be placed. Name Address City, State, Zip Code Toll Free Telephone Number Local Telephone Number Facsimile Number E-mail Address Web Site Address Primary Service Representative B.2.16 APPLICABLE DOCUMENTS, STANDARDS, LAWS AND/OR REGULATIONS The following are a list of various applicable standards, policies, regulations, and/or governing bodies. This list is not an all-inclusive list, therefore it is the responsibility of the contractor to ensure all applicable standards, policies, regulations, and/or governing bodies not listed here are adhere to. Furthermore, contractor is responsible to adhere to all current addition of applicable standards, policies, regulations, and/or governing bodies. VA Directive 6371, dated April 8, 2014 NIST Special Publication 800-88, Revision 1 Federal Information Processing Standard (FIPS 199), Standards for Security Categorization of Federal Information and Information Systems National Association for Information Destruction (NAID) Standards The Joint Commission