Inactive

DEPARTMENT OF VETERANS AFFAIRS NETWORK CONTRACTING OFFICE VISN 7 REQUEST FOR INFORMATION 36C24723Q0613 BACKGROUND: The Charlie Norwood VAMC has a requirement for the following BRAND NAME OR EQUAL supp... DEPARTMENT OF VETERANS AFFAIRS NETWORK CONTRACTING OFFICE VISN 7 REQUEST FOR INFORMATION 36C24723Q0613 BACKGROUND: The Charlie Norwood VAMC has a requirement for the following BRAND NAME OR EQUAL supplies: Manufacturer Stock # Item Description Reagents for the GeneXpert system REQUESTED RESPONSES: The intent of this Request for Information is to establish sources to define the procurement strategy (e.g., set-aside, sole source, unrestricted) for a solicitation that VA intends to post in the near future. Interested contractors are requested to respond in accordance with the following: Please respond to this RFI if you can provide the exact brand name products listed in the table in the background section above. In the response please cite your business size status. If you have an existing GSA or VA, Federal Supply Schedule contract, please include the contract details in your response. Please respond to this RFI if you can provide supplies that can be determined EQUIVALENT to the products listed in the table in the background section above. Please provide details on the proposed EQUIVALENT products such as Manufacturer Name, Part Number, and Description. If you have an existing GSA or VA, Federal Supply Schedule contract, please include the contract details in your response. Please note that VA is particularly interested in determining the availability of Small Business Manufacturers. If your company is a small business manufacturer of similar items, please respond to this RFI. CONTACT INFORMATION AND RESPONSE DUE DATE: Please email all responses to winston.graber@va.gov. Please respond to this RFI no later than April 29, 2023. DISCLAIMER: This RFI is issued solely for informational and planning purposes and does not constitute a solicitation. Responses to this notice are not offers and cannot be accepted by the Department of Veterans Affairs to form a binding contract. Respondents are solely responsible for all expenses associated with responding to this RFI. STATEMENT OF WORK A. GENERAL INFORMATION Title of Project: Fully Automated PCR Instrument 2. Purpose: It is the intent of the Department of Veteran Affairs, The Charlie Norwood VA Medical Center to establish an instrument rental and service agreement for the base period of 1 August 2023 or the date of award through 31 July 2024 plus 4 option years for an FDA approved fully-integrated and automated molecular instrument to perform definitive, rapid, real-time polymerase chain reaction (PCR) which integrates a complete on-board nucleic acid purification system with amplification and detection of select pathogens in a self-contained system in accordance with the Statement of Work. This testing is necessary to provide diagnostic and treatment information to providers and support Infection Control with disease management. 3. Background: Charlie Norwood VA Medical Center must continue to provide quick and quality real time PCR results with reduced turnaround times and provide more standardized testing with the use of automated instrumentation. Automation will provide a more efficient workflow and decrease variables for error in performing critical testing for PCR samples in the Microbiology lab. 4. Scope: The vendor shall provide leased equipment to include maintenance service, labor, parts, transportation, tools, software upgrades, repairs, and delivery of PCR test kits/products in support of Automated Real-Time PCR testing at the Charlie Norwood VA Medical Center. 5. Changes to statement of work: Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor. 6. Period of Performance: Base year with four one-year option years. Base Year 1 August 2023 31 July 2024 Option Year 1 1 August 2024 31 July 2025 Option Year 2 1 August 2025 31 July 2026 Option Year 3 1 August 2026 31 July 2027 Option Year 4 1 August 2027 31 July 2028 7. Type of Contract: Firm-Fixed-Price, for all reagents, verification kits, quality control material (excluding third party supplies), and consumables/accessories and shall be delivered upon the ordering facility. 8. Place of Performance: Charlie Norwood VA Medical Center, Pathology and Laboratory Medicine Service (Rm 2D136B), Augusta, GA. 9. Hours of Operation: Warehouse deliveries are accepted between 8am and 3:30pm, Monday through Friday, excluding holidays. Hospital normal hours of operation are between 8am and 4:30pm, Monday through Friday, excluding holidays. Federal Holidays New Year s Day January 1st Martin Luther King s Birthday 3rd Monday in January President s Day 3rd Monday in February Memorial Day Last Monday in May Juneteenth June 19th Independence Day July 4th Labor Day 1st Monday in September Columbus Day 2nd Monday in October Veteran s Day November 11th Thanksgiving Day Last Thursday in November Christmas Day December 25th NOTE: When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. 1. General Requirements: 1.1 The Contractor shall provide, transport, install, and test all listed equipment/instrumentation. All products must meet all salient characteristics defined in this statement of work. 1.2 The Contractor shall furnish all supplies, equipment, facilities, and services required for delivery and installation of the analyzer. 1.3 The Contractor shall furnish all parts, accessories and other items/peripherals required for the successful operation of the analyzers. 1.4 The Contractor shall provide shipping, transport, installation, and reagents/product necessary to test the analyzers for successful operation and function. All products must meet the salient characteristics defined in this statement of work. 1.5 The analyzer and installation must meet manufacturers and VA specifications. 1.6 All necessary reagents and related consumables, supplies, controls, and calibrators must be available for purchase and must be FDA approved. 1.7 The Contractor is responsible for any missing parts and components not included that are required for installation. 1.8 The analyzer will interface with the government s computer system to allow complete result transfer to the patient s electronic record using acceptable VA OI&T processes. 1.9 Fully automated molecular analyzer with 32 or more active modules (Includes analyzer, standard one-year warranty, power saving BACKUP-UPS, Desk top computer and DX Software.) 2. Technical Specifications: 2.1 The contractor shall provide all equipment, parts, accessories, and any other items required for the operation of the analyzer and capable of detecting, SARS-CoV-2 in both asymptomatic and symptomatic patients, Methicillin Resistant Staphylococcus aureus (MRSA), Clostridium difficile and Epidemic 027 Strain (C. difficile/Epi), Carbapenem Resistance (CRE), Influenza, RSV, Trichomonas and Bacterial Vaginosis (vaginal infection agents). 2.2 The Contractor shall provide an FDA approved, single, fully automated, continuously closed system for real time PCR testing that uses a Random-Access Platform for nucleic acid analysis for rapid analyte detection (< 75 minutes) from patient specimens. Turnaround time for C difficile test shall not exceed 50 minutes. 2.3 Contractor shall allow flexibility for future expansion of testing menu using the same instrumentation footprint and software. The Contractor shall be responsible for all costs associated with updates needed to support test menu expansion. 2.4 Sequential Testing Capability: The system shall be able to run individual samples without the need for batching. System shall have 32 or more testing modules. 2.5 The system must use unprepared samples with minimal hands-on processing time (<2 minutes). 2.6 Contractor shall provide PCR reagents that can be stored at room temperature and each individual testing reagent shall have built -in internal controls. 2.7 The molecular platform must allow rapid testing and multiple assays to run simultaneously without stopping currents runs. Instrument shall be available for testing 24/7 and shall not require any set up or start up time prior to analysis to increase productivity, reproducibility, and reduce turnaround-times. 2.8 User Friendliness: a) shall not require a molecular trained technologist to operate the analyzer or to perform the test; b) Must provide software and/or supporting instrumentation required to maintain, or improve levels of data retrieval, which can be used for epidemiology, or cost decreasing measures; c) shall have ease in handling and resolving errors; d) shall have sample barcode label reading capability. 2.9 Contractor shall provide necessary software/hardware (drivers) for bi-directional interface with Data Innovations, or other LIS vendor, LIS, where applicable. Connectivity software shall meet current VHA security requirements. The vendor should provide the necessary equipment (cable and Lantronix) to change the serial port to network communication if applicable. 2.10 The instrument must meet the performance characteristics for accuracy and precision as defined by the 1988 Clinical Laboratory Improvement Act (CLIA) and the Clinical and Laboratory Standards Institute (CLSI). 2.11 Each system s models/modules must provide accurate test assay results for sample specimens up to the manufacturer s defined maximum test per hour without excessive malfunctions, breakdowns, or service calls. 2.12 Testing equipment must be new, state-of-the-art equipment. Remanufactured and discontinued modules will not be accepted. 2.13 The Contractor shall provide all upgrades to the equipment hardware and operating system software as it is made available, at no charge to the US Government during the lifetime of the instrument. These enhancements shall be delivered and installed within 30 days of issuance to the commercial market. 2.14 The system being offered is in current production as of November 2022. For purposes of this solicitation., current production shall mean that the clinical laboratory analyzer is being manufactured as new equipment. Discontinued models/modules that are only being made available as remanufactured equipment will not be acceptable. 2.15 Analyzers must conform to the listed facility s laboratory space. The instrument should not exceed 86in L X 36in W x 79in H. 2.16 Instruments must have a 120-220-volt UPS system provided and serviced by the contractor. 2.17 The contractor shall provide all necessary startup reagents, organisms and supplies to complete a full validation and correlation study. 2.18 The Contractor shall provide all necessary software to allow complete result transfer to the patient s electronic record using acceptable VA OI&T processes. 2.19 Characterization of hazardous waste-The contractor shall provide a statement and description of the characteristics of the hazardous waste produced as a byproduct of the instrument operations that addresses the elements and criteria listed in the Code of Federal Regulations Title 40 “Protection of the Environment” Part 261 et al. The description shall address the following: x 2.19.1 Waste toxicity (Reference 40CFR261.11 and 40CFR261.24) x 2.19.2 Waste Corrosivity (Reference 40CFR261.21) x2.19.3 Waste reactivity (Reference 40CFR261.23) x.98.4Hazardous waste from non-specific sources {F-Listed} (Reference 40CFR261.31) x 2.19.5 Discarded commercial products (acutely toxic or P-Listed and toxic or (UListed) {Reference 40CFR261.33. 2.20 The contractor will supply the Starter Kit or equivalent and validation material for all PCR testing, validation, and correlation. 2.21 System must include an on-board QC program capable of printing/displaying all internal QC/calibrations (e.g., when QC is out-of-limits). 2.22 Onsite Training for VA technical staff on PCR instrument. 2.23 Operation, Technical, and Maintenance Manuals. 2.24 Shipping, delivery, installation for PCR instrument. 2.25 Printer with USB cable for the PCR instrument. 2.26 Standard service agreement for 1 year. 2.27 Power-saving Backup-UPS that has at least 24-hour backup capability. 2.28 24/7 technical support. 2.29 Delivery and installation. 3. Delivery: 3.1 The Contractor shall deliver all equipment/analyzers and accessories to the Charlie Norwood VA Medical Center, 950 15th Street, Augusta, GA 30901, Building 801 Room 2D136B. 3.2 Packaged to prevent damage or deterioration during shipment, handling, storage, and installation. Maintain protective covering in place and good repair until removal is necessary. 3.3 Deliver analyzer and specified items only when the site is ready for installation work to proceed. 3.4 Store products in dry condition inside enclosed facility. 3.5 Any Government requested delayed delivery up to 90 days after initial award delivery date, shall be at no additional cost to the US Government. 3.6 A pre-delivery meeting will be conducted 30 days prior to initial award delivery date for verification of delivery and installation dates. 3.7 Delivery and Installation will be coordinated through the Lab Manager and/or Section Supervisor/Lead, and/or COR. 3.8 The Contractor shall conduct a joint inspection with the COR upon delivery of the equipment. 3.9 Any additional costs such as Industrial Funding Fees, special shipping and handling fees, or any other usage fees must be clearly indicated in the proposal. 4. Installation, including Verification/Validation: 4.1 Install all equipment to manufacturer s specifications maintaining Federal, and Local Safety Standards. 4.2 The Contractor shall coordinate all deliveries, staging areas, installation with the Lab Manager and/or Section Supervisor/Lead, and/or COR. 4.3 The Contractor shall remove all related shipping materials, debris, and cleanup any construction associated with delivery and installation of the specified items. Contractor shall remove all packaging from the VA Lebanon Medical Center premises after instrument installation. The Contractor shall be responsible for any damage to the building that occurs due to Contractor s error or neglect. 4.4 Contractor shall provide technical support specialist to assist in equipment installation/set-up, correlation studies (evaluation/comparison data sufficient to satisfy CAP standards), staff training and methodology problems and questions. 4.5 To ensure the confidentiality of the information being disposed, or transferred, Department of Veterans Affairs (VA) requires proper sanitation of electronic data (hard disk or any storage devices) which contains stored or processed sensitive and non-sensitive VA information. 4.6 Contractor shall complete instrument installation, all validation/correlation studies 90 days after the award of the contract. Controls and all reagents needed for validation studies shall be included in proposal. 5. Deliverables: 5.1 Contractor shall provide necessary procedure manuals, troubleshooting manuals and operator manuals (also available on computer disk format). Procedures shall be in the Clinical and Laboratory Standards Institute (CLSI) format. 5.2 All reagents, controls, calibrators, and disposables required for operating the analyzer and producing quality test results shall be listed in the proposal. Note: Testing menu required by CNVAMC, but not limited to test included in table. MRSA C. Difficile Carbapenem resistance genes SARS-CoC-2 Trichomonas Bacterial Vaginosis 5.3 Contractor shall provide supplies as described and in accordance with specifications outlined within the statement of work. Supplies shall be provided as needed upon facility ordering. 5.4 FOB= Destination. Shipping cost for supplies/Reagents shall be included. 6. Repair and Maintenance: 6.1 Replacement or repair of all ancillary equipment shall be included. 6.2 Vendor shall provide technical support either by phone or on-site support during regular business hours. 6.3 Contractor/Vendor shall provide uninterrupted PCR testing during the contract period. 6.4 Contractor shall define maintenance (daily, monthly, etc.) requirements and indicate which are performed by the user, which are not. 6.5 Contractor shall perform all required periodic maintenances to keep instrument in good working condition for the life of the contract. 7. Support Services: 7.1 Contractor shall provide service sufficient not to interrupt testing needs of the CNVAMC. Technical support shall be available during regular business hours. Field engineer service support must be available within twenty-four (24) business hours of notification, Monday through Friday). All repairs on instrument must be complete within 24 hours from the time the field engineer arrives. Contractor shall provide uninterrupted PCR testing during the life of the contract. 7.2 A service hotline with technical support shall be available Monday thru Friday 5am to 6pm. All calls must be answered within one hour via telephone and any repair service shall be completed before 6pm. 7.3 Service is to include all travel, parts for repair or replacement, and labor. Contractor shall maintain the instrument in good working condition for the life of the contract. 7.4 Contractor/ shall provide alternative testing if the instrument is down (out of service) in excess of 24 hours at no additional cost to the Government. Costs to be reimbursed by vendor for those costs incurred during downtime to include but not limited to, labor, and reference laboratory charges/services. 7.5 Contractor shall provide printer support. 8. Upgrades/Test Volume Adjustment: 8.1 Vendor shall work with CNVAMC to adjust reagent supply to match workload changes. Estimated monthly testing volume may change depending on the number of Veterans CNVAMC serves during the contract period. 8.2 (Where applicable) Automatic software updates as available and within two months of release and will always maintain compatibility of systems with whatever host LIS is in place, especially when vendor software is upgraded. 8.3 Contractor shall provide necessary upgrades to equipment hardware at no additional charge to the Government. NOTE: Estimated quantities may vary based on items and the needs of the Government. 9. Operator Training: 9.1 Contractor/Vendor shall provide at a minimum (2) superuser/admin/lead operator education/training on site and maintenance training during installations or updates to the equipment. 9.2 This training shall include training of ALL technical staff on the operation of the hardware and software systems, data manipulation, basic trouble shooting and repair. 9.3 The Contractor shall coordinate training so that it is timely to the equipment installation, be consistent with the size and scope of the facility s services. 10. Service Agreement: 10.1 Standard Level Service agreement shall include: i. 24/7 Phone support ii. Onsite M-F between normal operating business hours iii. Includes parts, labor, and travel iv. Software upgrades v. 98% Uptime Guarantee B. CONTRACT PERFORMANCE MONITORING: The government reserves the right to monitor services in accordance with Performance Based Matrix. C. INVOICES: Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor, validated by the Contracting Officer s Representative (COR), and submitted electronically through OB-10. A properly prepared invoice will contain: Invoice Number and Date Contractor s Name and Address Accurate Purchase Order Number Supply or Service provided Reagents/supplies ship date Total amount due Vendor shall submit all invoices to OB-10(IPPS) within 30 days after the expiration of the contract. Government intends to close out contracts/PO within 45 days after the expiration of the contract. D. GENERAL SECURITY INFORMATION: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures comply with VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR. Security Incident Investigation: The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. Liquidated Damages for Data Breach: Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access); Description of the event, including: date of occurrence; data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; Number of individuals affected or potentially affected; Names of individuals or groups affected or potentially affected; Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; Amount of time the data has been out of VA control; The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); Known misuses of data containing sensitive personal information, if any; Assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: Notification; One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; Data breach analysis; Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. SECURITY CONTROLS COMPLIANCE TESTING On a periodic basis, VA,...