0. 75ACF124R00010 THRIVE.pdf

75ACF124R00010

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

ORDER UNDER DPAS (15 CFR 700)

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP)

SEALED BID (IFB)

5. DATE ISSUED

1. THIS CONTRACT IS A RATED RATING PAGE OF PAGES

1 2

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRS., CONDS., AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECS./WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXT.NUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 253 (c) ( 10 U.S.C. 2304 (c) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

06/28/2024 X

ACF

Admin for Children and Families Administration for Children and Families

MARY E. SWITZER BUILDING

330 C ST., SW

Washington DC 20201

None 0900 ET 07/29/2024

BRUCE W JACKSON

Bruce.Jackson@acf.hhs.gov

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

CHRISTOPHER PALMER

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (Rev. 9-97)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

3-5 9-12 13-29

30-39

41-51

51-67

68-77

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____0_________ calendar days (60 calendar days unless a different period is inserted

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

75ACF124R00010

(A) (B) (C) (D) (E) (F)

CONTINUATION SHEET

BASE PERIOD: CLIN 0001

BASE PERIOD: CLIN 0002

OPTION PERIOD ONE: CLIN 1001

OPTION PERIOD ONE: CLIN 2001

OPTION PERIOD TWO: CLIN 2001

OPTION PERIOD TWO: CLIN 2002

OPTION PERIOD THREE: CLIN 3001

OPTION PERIOD THREE: CLIN 3002

OPTION PERIOD FOUR: CLIN 4001

OPTION PERIOD FOUR: CLIN 4002

OPTION PERIOD FIVE: CLIN 5001

Period of Performance: 08/15/2024 to 09/30/2029

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

Section B – Supplies or Services and Prices/Cost

B.1 Description

This acquisition is being conducted by the US Department of Health and Human Services, Government Contracting Services on behalf of the Office of Early Childhood Development (ECD) in collaboration with the Office of Planning, Research, and Evaluation (OPRE) under Federal Acquisition Regulation (FAR) 15 procedures. The acquisition is a small business set aside under NAICS 541611. The work shall be performed in accordance with all Sections of this contract.

B.2 Type of Contract

The contractor shall perform the effort required by this contract on a Cost Plus Fixed-Fee (CPFF) basis.

B.3 Services and Prices

Period CLIN Cost Fixed Fee Price Period of Performance 0001 $0 $0 $0 August 15, 2024 - March 31, 2025 0002 $0 $0 $0 August 15, 2024 - September 30, 2025 1001 $0 $0 $0 April 1, 2025 - March 31, 2026 1002 $0 $0 $0 May 15, 2025-November 14, 2026 2001 $0 $0 $0 April 1, 2026 - March 31, 2027 2002 $0 $0 $0 May 15, 2026-November 14, 2027 3001 $0 $0 $0 April 1, 2027-March 31, 2028 3002 $0 $0 $0 May 15, 2027-November 14, 2028 4001 $0 $0 $0 April 1, 2028-March 31, 2029 4002 $0 $0 $0 May 15, 2028-August 14, 2029

OPTION 5 5001 $0 $0 $0 March 15, 2029-September 30, 2029

TOTAL $0 $0 $0

OPTION 4

OPTION 3

OPTION 2

OPTION 1

BASE

Section C – Description/Specifications/Statement of Objectives

C.1 Background

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified herein), and otherwise do all the things necessary for or incidental to the performance of the non-inherently governmental function work as set forth below:

SERVICES COMPONENT (Non-Severable)

Purpose: To provide guidance, leadership, and support that promotes excellence in the implementation of tribal evidence-based home visiting programs.

End Product of Value: The end product of value is a compilation of grantee-required reports into one report that synthesizes the activities conducted by grantees, an evaluation and assessment of tools and resources developed by the Contractor, which can then be distributed to the broader field.

C.1.2 Tasks

Task 1: Project Management and Team Communication

Subtask 1.1: Kick Off Meeting Subtask 1.2: Project Management Work Plan Outline Development Subtask 1.3: Project Management Work Plan Subtask 1.4: Ongoing Project Communication & Management Subtask 1.5: Plan for Implementation of Active Engagement and Collobaration Activities Subtask 1.6: Technical Assistance Approach and Staffing Subtask 1.7: Option Period Four Draft Transition Out Plan Subtask 1.8: Transition Out Plan

Task 2: Coordination and Communication with the Federal Team

Subtask 2.1: Communication with the Federal Team Subtask 2.2: Coordination and Communication with the Tribal MIECHV Federal Project Officers Subtask 2.3: Regular Grant Recipient Calls Subtask 2.4: Plan for Feedback Loops and Continual Communication Subtask 2.5: Feedback on Universal Products and Approaches to TA Subtask 2.6: Supporting Data Driven Decision Making

Task 3; Coordination and Collaboration with Technical Assitance (TA) Provider and other Key Partners

Subtask 3.1: Coordination and Collaboration with Other TA Providers Subtask 3.2: Use of Subject Matter Experts (SME) and Key Partners Subtask 3.3: Plan for Engaging with and Coordination with Home Visiting Model Developers Subtask 3.4: Plan for Engaging with and Coordinating and Collaborating with Tribal Early Childhood Efforts

Task 4: Technical Assitance to Grant Recipients

Subtask 4.1: TA Transition Approach Subtask 4.2: Plan for Assessing Grant Recipient TA Needs Subtask 4.3: Assessing Grant Recipient TA Needs Subtask 4.4: Grant Recipient Implementation Planning Support Subtask 4.5: Home Visiting Program Implementation Support to Grant Recipients Subtask 4.6: Performance Measurement Planning and Reporting Support Subtask 4.7: Performance Data Review Subtask 4.8: Ongoing Individual Grant Recipient Data System Improvement Support Subtask 4.9: Individual Support to Utilize Peformance Data Subtask 4.10: Individual Continuos Quality Improvement Support Subtask 4.11: Continuous Quality Improvement Collaborative Efforts Subtask 4.12: Support for Tribal MIECHV Participation in MIECHV Learning Agenda

Task 5: Crosscutting Capacity Building Activities

Subtask 5.1: Communities of Learning Subtask 5.2: Tribal Home Visiting Peer Learning and Leadership Network Subtask 5.3: Site Visits

Task 6: Tribal Home Visiting Reporting System

Task 7: Privacy and Data Security Activities and Monitoring

Subtask 7.1: Authority to Operate (ATO) Support Subtask 7.2: Zero to Trust Compliance Support

Task 8: Development and Management of Grant Recipient Tools and Resources

Subtask 8.1: Environmental Scan of Tools and Resources Subtask 8.2: Development and Dissemination of Tools and Resources Subtask 8.3: Development of Tribal MIECHV Style Guide Subtaks 8.4: Training of Technical Assitance Specialist Staff on Tools and Resources

Task 9: Support for Clearance for Informative Collections

Subtask 9.1: Office of Management and Budget (OMB) Clearance for Data Collection

Task 10: Tribal MIECHV Dissemination

Subtask 10.1: Develop External Communication Plan Subtask 10.2: Cover Sheet for all Written Deliverables Subtask 10.3: Outcomes Dashboard Subtask 10.4: Report to Congress Subtask 10.5: Tribal MIECHV and ACF Office of Early Childhood Development (ECD) Website Support Subtask 10.6: Grant Recipient Profiles Subtask 10.7: ACF Office of Early Childhood Development Tribal Early Childhood Dissemination Support

Task 11: Ad Hoc Meetings Project Management and Team Communication

Subtask 11.1: Kick-off Meeting Subtask 11.2: Project Management Work Plan Outline Development Subtask 11.3: Project Management Work Plan Subtask 11.4: Ongoing Project Communication & Management Subtask 11.5: Plan for Implementation of Active Engagement and Collaboration Activities

Task 12: Ad Hoc Meeting Planning

Subtask 12.1: Annual Ad Hoc Meeting Plan Development Subtask 12.2: Meeting Registration System Subtask 12.3: Meeting Elevation(s) and Reporting Subtask 12.4: Meeting Data Request Support Subtask 12.5: Logistical Support for Tribal MIECHV Meetings Subtask 12.6: Tribal Early Childhood Listening Session and Consultation Support

Section D – Packaging and Marking

This page intentionally left blank.

Section E – Inspection and Acceptance

E.1 Place of Inspection and Acceptance

Inspection and acceptance of all work performance, reports, and other deliverables under the resulting contract will be accepted virtually.

E.2 Scope of Inspection

All deliverables will be inspected for content, completeness, accuracy, and conformance to the requirements by the COR. Inspection may include validation of information through the use of automated tools, testing, or inspections of the deliverables, as specified in the contract.

The scope and nature of this inspection will be sufficiently comprehensive to ensure the completeness, quality, and adequacy of all deliverables.

The Government requires a period NTE 15 workdays after receipt of final deliverable items for inspection and acceptance or rejection. Upon receipt of the Government comments, the contractor shall have 10 workdays to incorporate the Government’s comments and/or change requests and to resubmit the deliverable in its final form.

E.3 Basis of Acceptance

The basis for acceptance shall be in compliance with the requirements set forth in the relevant terms and conditions of this contract. Deliverable items rejected shall be corrected in accordance with the applicable clauses.

The final acceptance will occur when all discrepancies, errors, or other deficiencies identified in writing by the Government have been resolved, through documentation updates, program correction, or other mutually agreeable methods.

Reports, documents, and narrative-type deliverables will be accepted when all discrepancies, errors, or other deficiencies identified in writing by the Government have been corrected.

If the draft deliverable is adequate, the Government may accept the draft and provide comments for incorporation into the final version.

All of the Government’s comments on deliverables shall either be incorporated in the succeeding version of the deliverable, or the contractor shall explain to the Government’s satisfaction why such comments should not be incorporated.

If the Government finds that a draft or final deliverable contains spelling errors, grammatical errors, or improper format, or otherwise does not conform to the quality assurance requirements stated within this contract, the document may be rejected without further review and returned to the contractor for correction and resubmission. If the contractor requires additional Government guidance to produce an acceptable draft, the contractor shall arrange a meeting with the COR.

Section F – Deliveries or Performance

FAR Clauses Incorporated by Reference

Number Name Date

52.242-15 Stop-Work Order. AUG 1989

52.242-15 Stop-Work Order Alternate I APR 1984

52.242-17 Government Delay of Work APR 1984

F.1 Period of Performance

The anticipated period of performance is listed below:

BASE CLIN 0001 – POP 8/15/24 – 3/31/25

BASE CLIN 0002 – POP 8/15/24 – 9/30/25

OP 1 CLIN 1001 – POP 4/1/25 – 3/31/26

OP 1 CLIN 1002 – POP 5/15/25 – 11/14/26

OP 2 CLIN 2001 – POP 4/1/26 – 3/31/27

OP 2 CLIN 2002 – POP 5/15/26 – 11/14/27

OP 3 CLIN 3001 – POP 4/1/27 – 3/31/28

OP 3 CLIN 3002 – POP 5/15/27 – 11/14/28

OP 4 CLIN 4001 – POP 4/1/28 – 3/31/29

OP 4 CLIN 4002 – POP 5/15/28 – 8/14/29

OP 5 CLIN 5001- POP 3/15/2029 – 9/30/2029

F.2 Place of Performance

The work to be performed under this contract will be performed at the contractor’s facility and any subcontractor related facilities. The ACF Contracting Officer (CO) has the authority to approve and reject requests to work at alternate sites and rescind requests previously approved.

F.2.1 Place of Inspection and Acceptance

Inspection and acceptance of all work performance, reports, and deliverables under the resulting contract will be performed virtually.

Section G – Contract Administration Data

G.1 Contracting Officer (CO)

The CO is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the CO can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

The CO is the only person with the authority to act as agent of the Government under this contract. Only the CO has authority to:

1. Direct or negotiate any changes within the contract ;

2. Modify or extend the period of performance;

3. Change the delivery schedule;

4. Authorize reimburse to the Contractor of any costs incurred during the performance of this contract; and

5. Otherwise change any terms and conditions of this contract.

No information other than that which may be contained in an authorized modification to this contract, duly issued by the CO, shall be considered grounds for deviation from any stipulation of this contract.

The Government reserves the right to unilaterally change its CO designation, after which it will notify Contractor in writing of such change. The CO will appoint a COR in writing through a COR Appointment Letter that will be provided to the contractor upon award.

G.2 Contracting Officer’s Representative (COR)

The CO will appoint a COR in writing through a COR Appointment Letter that will be provided to the contractor upon award. The COR will receive, for the Government, all work called for by the resulting Task Orders and will represent the CO in the technical aspects of the contract. The COR will assist in resolving any technical issues that arise during performance.

The COR will provide no supervisory or instructional assistance to contractor personnel.

The COR is not authorized to change any of the terms and conditions, the PWS, schedule, or price of the contract. Any changes to the contract will be made only by the CO by properly executed modifications to the contract.

G.3 Contract Administration

Contracting Officer (CO) Christopher Palmer U.S. Department of Health & Human Services (HHS) Administration for Children & Families (ACF) Office of Government Contract Services (OGCS) 330 C Street S.W.

Washington, DC 20201Email: Christopher.Palmer@acf.hhs.gov

Contracting Officer’s Representative (COR)

TBD

U.S. Department of Health & Human Services (HHS) Administration for Children & Families (ACF) Office of Government Contract Services (OGCS) 330 C Street S.W.

Washington, DC 20201 Email: TBD

G.4 Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP)

All Invoice submissions for goods and or services delivered to facilitate payments must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

Invoice Submission for Payment means any request for order financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the order, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 – 5 business days of the order award for new orders or date of modification for existing orders.

Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

If your company is already registered to use IPP, you will not be required to re-register.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate mailto:Christopher.Palmer@acf.hhs.gov http://www.ipp.gov/ mailto:ipp.noreply@mail.eroc.twai.gov mailto:IPPCustomerSupport@fiscal.treasury.gov payment procedures.

G.5 Contractor Performance Evaluation(s)

Contractor performance will be evaluated on an interim and final basis pursuant to FAR Subpart

42.15. The Contractor Performance Assessment Reporting System (CPARS) will be utilized for these reviews. Information on CPARS can be located at http://www.cpars.gov.

G.5.1 CONTRACTOR PERFORMANCE EVALUATION(s)

Performance Evaluation in Contractor Performance Assessment Reporting System (CPARS):

Continual monitoring of performance is one critical element to the success of the contract.

Performance evaluation reports shall be prepared at the time of final acceptance of work, termination, annually or other times, as appropriate. Performance evaluations are initiated by the Government and then require input and acceptance of the Contractor. Performance evaluations are done in the CPARS at www.cpars.gov by focusing on elements of quality control, effectiveness of management, timely performance and compliance with safety standards.

Less Than Satisfactory Performance: If the COR concludes that a Contractor’s overall performance is less than satisfactory, the Contractor shall be advised in writing. Contractors taking exception to the evaluation ratings are encouraged to submit comments in writing within CPARS. If the Contractor submits written comments, the COR shall include them in the report, resolve any alleged factual discrepancies, and make appropriate changes to the report. If the Contractor’s performance is found to be less than satisfactory, actions may warrant the Government to make new arrangements with different suppliers and/or modify existing arrangements.

Subcontractors: The prime Contractor is responsible for the management, performance and monitoring of all subcontractors who are working on this contract. If a subcontractor’s performance is less than satisfactory, the Government expects the prime Contractor to take effective actions to correct less than satisfactory performance. Less than satisfactory performance by a subcontractor may reflect adversely on the Contractor’s performance evaluation within the CPARS system.

The applicable regulations, standards and requirements are those that are in effect at the date of proposal submission. Any subsequent major changes to said regulations, standards and requirements resulting in significant changes to contract requirements will be addressed in subsequent exchanges and possible contract modifications.

G.5.2 Quality Control and Quality Assurance (QC/QA)

The Contractor shall establish a QC/QA program to ensure that the requirements of this contract are met. The Contractor shall provide one (1) copy of the Quality Control Plan (QCP) to the CO and COR within ten (10) days of contract award, who may upon require submit http://www.cpars.gov/ questions and concerns that required Contractor review and additional edits before the QCP can marked as final. If requested edits are required, they CPM will update the QCP and submit a revised copy within five (5) business days until the deliverable is accepted by the Government. Upon Government acceptance of the QCP it becomes a living document/report, the Contractor shall monitor, control, and update continuously as needed throughout performance of this effort.

The QCP shall consist of an inspection system to cover all services requested. At a minimum, this plan shall include:

1. An inspection system covering all the services required by this contract. It must specify the areas to be inspected on either a scheduled or unscheduled basis, frequency and the designation of who will perform the inspections;

2. A defined method of identifying and reporting deficiencies to the COR in the quality of services performed before the level of performance becomes unacceptable to the

COR;

3. A method of documenting and enforcing quality control operations of services performed; and

4. An organizational structure that provides quality control personnel with direct accountability to the Contractor’s top management.

The COR and CPM shall conduct reoccurring quality assurance reviews of the Contractor’s QCP and Quality Control Records and will conduct inspections (planned and unplanned) of performance of the work. Observances of unsatisfactory performance will be documented by the COR and the CPM informed. An accumulation of three major deficiencies (3 minors are equal to 1 major) in a six-month time frame will result in a quality control review with a mandate of immediate improvement. Failure to improve quality control to the satisfaction of the Project Officer and Contracting Officer may lead to termination of the contract.

Section H – Special Contract Requirements

H.1 Government-Furnished Property (GFP)

The Contractor shall In support of the contract, when ACF determines on a case-by-case basis that Contractor staff require HHS network connectivity, then ACF will provide ITIO issued laptops as GFE to the Contractor staff. ITIO issued laptops will be at no cost to the Contractor and will be returned to the Government upon completion of the contract. If it is determined during performance that laptops need to be issued to the contractor staff, a modification will be accomplished to incorporate an appropriate GFP listing to identify the property/equipment that has been issued.

H.2 Government-Furnished Information (GFI)

The Government will provide any additional information necessary to meet all deliverables described herein. Access to Government resources such as SharePoint, Microsoft programs and anything else needed for successful performance. Materials such as reports, manuals and publications will be provided as required.

H.3 Baseline Security Requirements

Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information as required to perform their work. Access is contingent upon positive adjudication of background check.

Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the ACF mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

Protect government information and information systems to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of ACF regardless of location.

Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

Comply with the Privacy Act requirements and tailor FAR clauses as needed.

Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system. The Contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The Contractor shall ensure proper controls are implemented based on the categorization.

Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

marked appropriately.

disclosed to authorized personnel on a Need-To-Know basis.

protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and returned to ACF control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by ACF or collected by the Contractor on behalf of ACF shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any ACF records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and ACF policies. Unauthorized disclosure of information will be subject to the HHS/ACF sanction policies and/or governed by the following laws and regulations:

18 U.S.C. 641 (Criminal Code: Public Money, Property or Records).

18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Contract Documentation. The Contractor shall use provided templates, policies, forms, and other agency documents, if applicable, to comply with contract deliverables as appropriate.

Standard for Encryption. The Contractor (and/or any subcontractor) shall:

Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and ACF-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to implementation of the solution.

Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the ACF non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – When applicable, the Contractor shall assist the ACF Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor shall assist the ACF SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor shall assist the ACF SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

H.4 Training

Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/ACF Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/ACF Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies. Training is available in one of two ways:

For Contractors who will obtain an ACF PIV card, access to the training will be made available once the PIV card and laptop are obtained.

For Contractors without a PIV card, access to the training will be made available once personnel have been cleared to work for ACF.

Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Rules of Behavior. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior. The HHS ROB can be obtained on the HHS website or from the CO and/or COR. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing ACF data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract. As part of the ACF annual security requirement, assigned personnel must take the Cybersecurity Awareness and Privacy 101 training beginning the following fiscal year.

Incident Response. FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The Contractor (and/or any subcontractor) shall comply with ACF’s Incident Response Policy dated July 10, 2018, including any subsequent updates. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident.

Notify affected individuals only as instructed by the Contracting Officer or designated https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-rules-of-behavior-for-the-use-of-hhs-information-and-it-resources-policy.html representative.

Report all suspected and confirmed information security and privacy incidents and breaches to the ACF Incident Response Team (IRT), COR, CO, ACF SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic as defined in ACF’s Incident Response Policy.

Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities, if contractor is providing the hosting, during a breach/incident investigation.

Position Sensitivity Designations. All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

https://www.opm.gov/suitability/suitability-executive-agent/position-designation-tool/

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within 3 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 24 hours of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Homeland Security Presidential Directive(HSPD)-12. The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

The Contractor (and/or any subcontractor) and its employees shall comply with computing and security standards including Federal Information Security Management Act (FISMA) as part of the e-government Act of 2002 Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors. Office of Management and Budget (OMB) Memorandum(M)05-24; and Federal Information Processing Standards Publication (FIPSPUB) Number 201, FAR Subpart 4.13 (https://acquisition.gov/sites/default/files/current/far/compiled_html/subpart_4.13.html), https://www.opm.gov/suitability/suitability-executive-agent/position-designation-tool/ https://acquisition.gov/sites/default/files/current/far/compiled_html/subpart_4.13.html

FAR Subpart 52.204-9 (https://www.acquisition.gov/?q=browsefar), and HHS HSPD-12 policy. The Contractor shall refer to the HHS-OCIO Policy for Information Systems Security and Privacy, dated July 7, 2011. The Contractor shall become familiar with the HHS Departmental Information Security Policies, which may be found at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html.The HHS Cybersecurity Program develops policies, procedures, and guidance to serve as a foundation for the HHS information security program. These documents implement relevant Federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The Contractor must become familiar with HHS Cybersecurity Program guidelines as presented at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security- privacy-program/index.html.

Hosting Facilities. The contractor shall provide the hosting facility for related support services to accommodate ACF’s production, test, development, staging, training, and all other environments for the registration website. The Contractor shall ensure that the host facility and systems installed meet HHS and ACF security standards provided in the IT Security Requirements section and are able to receive and maintain an ATO. In addition, the contractor shall ensure cloud solutions are FedRAMP-approved and that the FedRAMP Customer Responsibility Matrix (CRM) identified in the FedRAMP package is identified, reviewed, implemented, and adhered to during the life of the system. Representative tasks may include, but are not limited to:

Website hosting

Infrastructure support

Communications

Network interfaces

Enhancements and other maintenance

Data backup and recovery

Hosting and Administration involves providing the information technology infrastructure (facilities and infrastructure software) that serve as the foundation for running business software applications, as well as the services to maintain that infrastructure. The contractor will provide all the necessary services to support and host the solution, consistent with the goals and objectives of the Statement of Work (SOW). These services include both infrastructure hosting and application functional and technical support.

The contractor must provide a complete hosting solution that includes all the services necessary to deliver their proposed approach from project initiation through system cut over and all post - deployment production operations.

Security Requirements for Government Owned and Contractor Operated (GOCO) and Contractor Owned and Contractor Operated (COCO) Resources.

https://www.acquisition.gov/?q=browsefar https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to: the HHS Information Security and Privacy Policy (IS2P); Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C.

101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800- 53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

Security Assessment and Authorization, and Authorization to Operate . A valid ATO certifies that the Contractor’s information system meets the contract’s requirements to protect the agency data. If the system under the contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s). The ATO timeline/schedule shall be determined within 30 days of contract award and approved by the ACF OCIO. The Contractor shall conduct the assessment and authorization requirements in accordance with HHS IS2P/, NIST SP 80037, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision). ACF’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the system security and privacy controls are implemented and operating effectively.

ATO Package Deliverables: The Contractor (and/or any subcontractor) shall provide an ATO package, within the timeframes listed below to the CO and/or COR. The following Assessment and Authorization deliverables are required to complete the ATO package:

System Security Plan (SSP) – due date to be determined and approved by the ACF OCIO after contract award and in accordance with the ATO schedule. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800- 53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and ACF policies and other guidance. The SSP shall be consistent with, and detail, the approach to IT security contained in the Contractor’s bid or proposal that resulted in contract award. The SSP shall provide an overview of the system environment and security requirements to protect the information system, as well as describe all applicable security controls in place or planned for meeting those requirements.

It should provide a structured process for planning adequate, cost - effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

Security Assessment Plan/Report (SAP/SAR) – due date to be determined and approved by the ACF OCIO after contract award and in accordance with the ATO schedule. The security assessment shall be conducted by the assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and ACF policies. The assessor will document the assessment results in the SAR.

Interconnection Security Agreement (ISA) – due date to be determined and approved by the ACF OCIO after contract award and in accordance with the ATO schedule. The contractor will submit a current agreement or complete an ISA with ACF to document interconnection arrangements and information security responsibilities for both parties, including an outline of security safeguards, and technical and operational security requirements based on the National Institute of Standards and Technology (NIST) Security Guide for Interconnecting Information Technology Systems (Special Publication (SP) 800-47 http://csrc.nist.gov/piblications/nistpubs/800-47/sp800-47.pdt) and shall comply with the security required by Federal Acquisition Regulation (FAR) clause 52.239-1, Privacy or Security Safeguards. Thereafter, the Contractor, in coordination with ACF, shall conduct and assist in the assessment of the security controls and update the SAR at least annually.

POA&M – due date to be determined and approved by the ACF OCIO after contract award and in accordance with the ATO schedule. The POA&M shall be documented consistent with the HHS Standard for POA&M and ACF policies. All high-risk weaknesses must be mitigated within 30 days and all medium weaknesses must be mitigated within 60 days from the date the weaknesses are formally identified and documented. ACF will determine the risk rating of vulnerabilities. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, shall be documented, and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, ACF may require designated POA&M weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M shall be updated on a real-time basis as vulnerabilities are discovered. The POA&M shall be reported to ACF OCIO quarterly.

Contingency Plan and Contingency Plan Test – due date to be determined and approved by ACF OCIO after contract award and in accordance with the ATO schedule. The Contingency Plan must be developed in accordance with NIST SP 800 - 34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS and ACF policies.