Attachment 1 - Task Order 1 - CRRI - Amendment 1_0001.pdf

Attachment 1: Task Order 1 – CRRI Solicitation 140D0421R0007

Clinical Reporting And Research Informatics (CRRI) Support Services

SECTION 1 – TASK ORDER INTRODUCTION

1.1 GENERAL

This task order requirement is for Clinical Reporting and Research Informatics (CRRI) Support Services.

1.2 SUBMISSION OF QUESTIONS

Contractors shall submit questions in accordance with the instructions provided in the IDIQ Solicitation.

1.3 ANTICIPATED AWARD TYPE

The Government anticipates awarding a Time-and-Materials (T&M) task order. Travel and Other Direct Costs (ODCs) are anticipated in performance of this task order.

SECTION 2 – TASK ORDER STATEMENT OF WORK

2.1 INTRODUCTION

The National Cancer Institute (NCI), a major biomedical research institute within the National Institutes of Health (NIH), coordinates the nation’s research program on cancer prevention, detection, diagnosis, treatment, rehabilitation, survivorship and control. As a result of the 1971 National Cancer Act legislation, the NCI has built a research community that includes regional and community cancer centers, physicians who are cancer specialists, cooperative groups of clinical researchers, and volunteer and community outreach groups.

NCI has developed research programs supported by an infrastructure for discovery composed of support mechanisms, organizations, and networks linking scientists, facilities, and information.

This infrastructure is the underpinning for activities that encompass all aspects of cancer prevention, detection, diagnosis, treatment, rehabilitation, survivorship and control. In addition, the infrastructure supports basic, translational, and clinical cancer research, which culminates in a significant contribution of scientific advances in all areas of cancer research based on the efforts of thousands of scientists supported by NCI.

NCI invests several hundred million dollars annually to sponsor and conduct clinical trials in the areas of cancer therapy, prevention, diagnosis, and epidemiology. Studies are conducted both at the NCI and at NCI-funded organizations nationwide. These organizations include the NCI-designated Cancer Centers; the NCI Clinical Trials Cooperative Groups; the Specialized Programs for Research Excellence (SPOREs) along with several smaller trial consortia. The major NCI Centers and Divisions sponsoring clinical trials include NCI Center for Cancer Research (CCR, Division of Cancer Prevention (DCP), Division of Cancer Epidemiology and Genetics (DCEG), Division of Cancer Control and Population Sciences (DCCPS), and Division of Cancer Treatment and Diagnosis (DCTD). These research activities, the institutions where these activities are performed, and the personnel conducting these activities, are collectively referred to as the NCI Clinical Research Enterprise.

In order to facilitate the NCI Clinical Research Enterprise, The Center for Biomedical Informatics and Information Technology (NCI/CBIIT) is responsible for a range of biomedical informatics research, research support, and associated program and project management and administrative support. This support includes several general classes of program, project, resource management, biomedical informatics, and biomedical research and scientific program support including but not limited to providing subject matter expertise; application, system, and database definition, design, development, documentation, testing, implementation, update and maintenance; program and project communications support; and other biomedical informatics, biomedical research, and data science management support services.

2.2 BACKGROUND

NCI/CBIIT is seeking to provide comprehensive Clinical Reporting and Research Informatics (CRRI) support that include elements of the Cancer Moonshot and Precision Medicine Initiative (PMI). CRRI will include Precision Medicine Activities (PMACC), Correlative Study

Management (CSMS), the Clinical Trials Reporting Program (CTRP) as well as ancillary support services.

The Precision Medicine Analysis and Coordination Center (PMACC) will support current and next generation NCI precision medicine trials. This center will serve existing trials and the three new major initiatives; each of which will be composed of an umbrella/basket screening platform and linked clinical trials. Each master protocol will require both a MATCHBox precision medicine trial platform to determine patient eligibility for specific therapies and associated precision diagnostic laboratories provided by the NCI/DCTD MDNet. The PMACC will provide the treatment assignment decisions based on data obtained from MDNet, other qualified laboratories, and the trial groups. The Molecular and Immunologic Diagnostics Network of Laboratories (MDNet) will provide primary diagnostic screening for trial arms that require specialized laboratory testing for patient allocation.

The primary purpose of the PMACC will be to provide a precision medicine data center that will consume data from MDNet and other sources to allocate patients to therapeutic clinical protocols based on specific molecular targets, oncogenic pathways, and immune parameters that must be determined for precise assignment of therapy. Once performed, assay data files and results will be automatically transferred to the PMACC for further processing and generation of patient profile reports in trial-specific MATCHBoxes. The trial-specific MATCHBox will incorporate clinical data and generate treatment assignments based on the patient profile reports. Treatment assignments will then be electronically distributed by the PMACC to the enrolling sites via the trial groups. All the primary data will be stored in a permission-based, controlled access Data Warehouse provided by the Contractor for future characterization and analysis followed by subsequent data coordination and transfer to an NCI Data Commons for public distribution after primary publication.

The Correlative Study Management System (CSMS) will provide biospecimen tracking and management support for the Cancer Immune Monitoring and Analysis Centers (CIMAC) biomarker network. Samples will be tracked from either the enrolling site or study-associated biorepository to the target research or diagnostic laboratory where assays will be performed. The CSMS will integrate with data coordinating centers and biobanks while maintaining unique network-wide case identifiers. The system may also provide capabilities for other CRRI-supported initiatives, as applicable.

The Clinical Trial Reporting Program (CTRP) fulfills a recommendation made by the NCI Clinical Trials Working Group (CTWG) to the National Cancer Advisory Board. CTRP is designed to be a comprehensive database of regularly updated information, including accrual, on all NCI supported clinical trials. This comprehensive database of the entire NCI portfolio will help identify gaps in clinical research and duplicative studies, as well as facilitate effective clinical trial prioritization, trial search and trial matching.

These significant programs are described below.

NCI Clinical/Correlative Study Management System (NCI-CSMS)

The Clinical/Correlative Study Management System supports the NCI Cancer Immune Monitoring and Analysis Centers (CIMAC) Biomarker Network and will directly support oncology studies/clinical trial operations including PMACC/PMI. The system must support tracking specimen from enrolling sites (e.g. via Medidata Rave), potentially from more than 20 biorepositories and multi-laboratory networks including, but not limited to CIMAC and MDnet laboratories performing a dispersed menu of assays. The current solution should be maintained and enhanced to support study management dashboards, unique sample identifier generation, manifest and sample label generation, biospecimen tracking, document management and information management capabilities.

Precision Medicine Analysis and Coordination Center

MyeloMATCH Initiative The Division of Cancer Treatment and Diagnosis, NCI (DCTD) has embarked on a strategic initiative in its National Clinical Trials Network (NCTN) to define and discover new treatments for patients with Acute Myelogenous Leukemia/Myelodysplastic Syndrome (AML/MDS). As described in a recent report from the Institute of Medicine ‘treatment for these patients has not changed in a substantive way in the last 40 years’ demonstrating that advances in this area are critical needed.

The primary goal of this initiative is to optimize therapeutic strategies for adult, young adult, and adolescent patients with Acute Myeloid Leukemia and Myelodysplastic Syndromes

(AML/MDS).

This includes:

• A master screening protocol that evaluates patients for assignment to clinical trials.

• A data support structure that allows longitudinal analysis of sensitivity and resistance biomarkers in leukemia for discovery of new molecular targets

• Deciphering clonal selection in minimal residual disease

• Understanding mechanisms of resistance and response to therapy

The long-term goals of the study are to:

• Identify biomarkers with the potential to optimize therapy selection in AML/MDS.

• Define molecular signatures that predict different response categories in AML/MDS.

• Define phenotype/genotype characteristics of response/resistance in AML/MDS that will be valid for diverse or specific classes of drugs with different mechanisms of action.

• To identify targets in minimal residual disease (MRD), including targets in relapse and to identify new ways to eradicate MRD.

The AML/MDS initiative will initially evaluate the activity of proposed targeted agents that match specific molecular targets, including novel markers from proof-of-concept studies in tumor models. The agents will be managed in trials from the specific NCTN group portfolio developed for this next-generation MATCH-like initiative. The patients referred to these trials will be grouped by age and fitness level for enrollment by the cooperative group (e.g. Alliance, ECOG-ACRIN, SWOG, CCTG) that holds that portfolio.

The AML/MDS initiative will use an "umbrella screening protocol" whereby a single-entry point for clinical, molecular, and immunologic screening will be performed so that AML/MDS patients can be rationally allocated to multiple different protocols within the four major baskets. To conduct such a large-scale precision medicine study, a centralized diagnostic platform that facilitates matching of patient’s molecular lesion to therapy, ‘MATCHBox for AML/MDS’ will be needed. DCTD has decided to develop a contract to establish a network of designated national laboratories that will serve as centralized labs for the clinical assays for leukemias. These laboratories will be critically important in establishing new matches between abnormalities and targeted agents and will become the key diagnostic assays for assigning patients to targeted therapies during the next generation of MATCH-like initiatives.

The leukemia laboratory network will have the additional responsibility of testing AML and MDS bone marrows and bone marrow biopsies from newly diagnosed patients that will require treatment within 48-72 hours from presentation with initial standard screening tests as appropriate. These initial tests include FLT3-ITD, FLT3-TKD, NPM1 & CEPBA insertion length and CEPBA indels, IDH1/IDH2 mutations & mutation hotspots, rapid karyotype, cytogenetics and flow cytometry. Processing of specimens for molecular analysis including WBC separation, dual DNA/RNA extraction, cfDNA, buccal swabs for germline evaluation, etc. will also be required.

If a patient relapses on the initial treatment, biopsies obtained at that time will be sequenced.

For the AML/MDS Basket Trials, this will include sensitive minimal residual disease techniques such as double strand next gene sequencing (dsNGS) to identify potential residual therapeutic targets, for reassignment to specific clinical trial testing aimed at eradicating the MRD. Other specialized testing will be performed as appropriate or when requested and includes FISH, Nanostring for fusions and mRNA expression, ArcherDX for targeted RNA sequencings and an AML specific NGS panel when it is completed. Laboratory tests are summarized in the tables below.

Initially, up to 2000 patients will need to have profiling performed and be enrolled in the AML/MDS initiative during the first 36 months of the project, under this effort. In addition, for those patients that relapse on the initial treatment, MDNet shall also evaluate the samples obtained at relapse to be sequenced, characterized and analyzed. However, the accrual goal and stated assays may change as the design evolves.

DNA and other materials as required will need to be shipped to one of the MDNet labs for DNA sequencing currently leveraging an NGS panel (e.g. Genesux Platform) and leukemia-specific targeted analysis or WES. Other assays such as RNA sequencing, metabolomics, proteomics, IHC or FISH, and cytogenetic assays may also be performed, depending on the specimen quality and trial requirements. Germline testing using blood on and buccal swabs for leukemia will be needed. These results will be sent to a specialized genetics evaluation center who will evaluate the findings before making them available to patients and physicians and provide approaches to genetic counseling as needed.

ComboMATCH Initiative The ComboMATCH trial is an effort to evaluate combination therapies based on genomic lesions in a tumor-agnostic fashion or a histology-specific fashion to overcome drug resistance based on prior in vivo evidence of combination activity. Trials based solely on in vivo therapeutic data absent a molecular match will also be conducted. The ComboMATCH initiative will have a screening platform run by ECOG-ACRIN (EA) and multi-arm study cassettes run by each of the four adult cooperative groups. The screening platform will allocate patients to treatment protocols via the trial-specific MATCHBox.

It is envisioned that each NCTN study cassette would have 4-6 non-overlapping sub-study arms (total 20 trials) initially. Additionally, about half of the first group of trials will be replaced with new trials (total 10 trials) over the five-year period for a total of 30 trials anticipated. Between 40-60 patients are anticipated per trial to account for potential histologic baskets and/or randomization. Thus, we anticipate a total of 1800 patients in the trial over a 5-year period.

The study will test the overall hypothesis that in vivo combination drug testing can predict clinically beneficial drug combinations in molecularly defined patient cohorts as well as non-genetically defined patient cohorts. Therefore, ComboMATCH will focus on drug combinations

– either matched to genetically-defined cohorts or to histologically specific or non-specific cohorts that show evidence of activity in in vivo models. Drug combinations may have been tested in vivo in patient-derived models (PDMs) that have specific molecular backgrounds, and the appropriate patient population to be allocated to that combination would be expected to match the context in which the combination was tested. It is also possible that active drug combinations may have been observed in PDM’s by empiric testing, where there is no relevant genomic marker for patient selection, and therefore unmatched patients could be assigned to these combination arms. The level of evidence for each combination arm will be data that show a synergistic effect of the two agents relative to single agent activity, and robust activity of the combination in in vivo models. ComboMATCH may also include single agent arms that extend findings from the initial NCI-MATCH trial.

For ComboMATCH, NCI will not pay for biopsies for screening purposes. Therefore, it is anticipated that commercial NGS testing will be used for most of the eligibility screening for ComboMATCH. Commercial NGS providers may be restricted to those included in the MATCH Designated Laboratory Network (Ref: Tricoli et al, AACR 2019). MDNet support for ComboMATCH will include ctDNA assays for eligibility screening when ctDNA can be used for this purpose, and molecular characterization of post-enrollment pre-treatment biopsies. Since the MATCH designated lab network does not typically provide protein screening assays, if these are required for a specific protocol, the MDNet laboratories will need to provide them.

As noted above, we anticipate a total of 1800 patients over a 5-year period that may require centralized assay verification for NGS results from the Designated Labs (1800 assays), ctDNA results for screening or retrospective collection (1800 assays) and protein assays as needed for a specific study (estimated 20%=360 assays). However, the accrual goal and stated assays may change as the design evolves.

ImmunoMATCH (iMATCH) Initiative The iMATCH initiative aims to enhance the clinical investigation of immunotherapy approaches by providing prospective molecular characterizations that can be used to classify patients by tumor genomics and T-cell inflammation markers. It is envisioned that in the iMATCH trials, a central molecular screening protocol will be led by the Southwest Oncology Group (SWOG), and several therapeutic protocols will be developed by NCTN for specific clinical settings or molecular subgroups.

Specifically, through the central assay platform, patients will be divided into four strata based on Tumor Mutational Burden (TMB) and T-cell inflammation [by gene expression profiles (GEP) or CD8/PD-L1 IHC]. In addition, low-prevalence variants associated with hyper-sensitivity or resistance to checkpoint inhibitors, or oncogene mutations can be identified through the same genomic sequencing.

The prospective screening platform will allow testing of various immunotherapy strategies in pre-defined molecular cohorts (through enrichment or stratification) with pre-specified cohort sizes and statistics. Therapeutic trials, including multi-arm platform trials, may be developed for patient populations defined by either clinical or molecular features (e.g. CPI-naïve patient population with certain histology; Patients with acquired resistance to CPI; or patients with tumors carrying rare variants relevant to specific immunotherapy strategies).

It is estimated that there will be up to 5 protocols under iMATCH. These will include 3 protocols for CPI-naïve patients with select tumor histologies, one protocol for patients with acquired resistance to CPI, and one protocol for patients with tumors carrying rare variants that are actionable with combinations of targeted agents or other novel immunotherapy-specific strategies. Each protocol may contain multiple arms to collectively evaluate 20-30 immunotherapy strategies considered high priority in the field. Assuming a single arm design with 50 patients per arm for 30 arms (n=1500), iMATCH will need to screen 2000 patients with 75% treatment assignment rate. However, the accrual goal and stated assays may change as the design evolves. Initially, NCI plans to perform a smaller iMATCH Pilot with accrual of 120 patients. Informatics support for this pilot does not currently require the MATCHBox platform.

iMATCH will require the following elements in the central screening and assay platform:

• CLIA assay with Next generation sequencing (by targeted gene panel or whole exome sequencing) for Tumor Mutation Burden (TMB) and specific actionable variants (e.g.

oncogene mutations, genomic alternations associated with immune evasion or response).

Methodologies for TMB assessment are highly variable among NSG platforms, and therefore verification of assay performance and concordance with WES may be required to determine which labs and assays are appropriate for iMATCH.

• CLIA assays for T-cell inflammation – this can be done based on either IHC for CD8 or PD-L1, or RNA-based assay for T-cell inflammation or IFN-γ signatures. Selection of the assays for Inflammation markers will require assessment of available platforms and potentially additional assays or additional analysis of existing data.

• Integration of results by the PMACC trial-specific MATCHBox from the two assay platforms and classification of molecular subgroups for treatment arm or trials.

NCI-MATCH Initiative The NCI-MATCH trial is a transformational umbrella study that seeks to determine the viability of treating cancer based on a genetic analysis of a patient’s cancer cells. The study performed by sequencing cancerous tissues, identifying mutations of interest (MOIs), identifying actionable mutations of interest (aMOIs), consuming clinical data from ECOG-ACRIN (EA) and running a rules-engine to evaluate all the aforementioned information to determine appropriate treatment assignment arm(s) if possible. Since NCI no longer funds biopsies, NCI-MATCH has now transitioned from a centralized screening assay approach to designated laboratory referral as a result of commercial NGS testing (MATCH Designated Laboratory Network; Ref: Tricoli et al, AACR 2019). Following study enrollment, confirmation sequencing is performed with the

Thermo Fisher Oncomine assay. The final four new treatment arms are expected to activate this calendar year. The PMACC will provide continued operations and enhancements to the current informatics infrastructure for approximate 1-2 years.

NCI-Pediatric MATCH Initiative The NCI-Pediatric MATCH trial is a transformational umbrella study that seeks to determine the viability of treating cancer based on a genetic analysis of a patient’s cancer cells. The study performed by sequencing cancerous tissues, identifying mutations of interest (MOIs), identifying actionable mutations of interest (aMOIs), consuming clinical data from Children’s Oncology Group (COG) and running a rules-engine to evaluate all the aforementioned information to determine appropriate treatment assignment arm(s) if possible. As a basis for performing the study and as opposed to whole exome sequencing where tumor cells are compared to normal cells, NCI-Pediatric MATCH specifically targets multiple hotspots across a wide variety of genes using Thermo Fisher Oncomine assay as well as select immunohistochemistry assays.

Additional Pediatric MATCH subprotocols will be added periodically (including combination therapy) and the PMACC will provide continued operations and enhancements to the current informatics infrastructure for approximately 1-2 years.

2.3 OBJECTIVE

The objective of this SOW is to acquire contracted professional data science and informatics support and consulting services to assist CBIIT in planning, developing, implementing, and supporting informatics and IT solutions in support of the following program activities:

• Maintain, enhance, refactor NCI-MATCHBox and Pediatric MATCHBox as appropriate;

• Design, develop, document, test, operate and publish AML/MDS-MATCHBox, ComboMATCHBox, iMATCHBox (not currently required for iMATCH pilot), and

NCI-CSMS;

• Deploy, test and maintain cloud-based MATCHBox, and CSMS systems;

• Deploy or integrate and test CLIA laboratories bioinformatics assay pipelines;

• Integrate biorepository systems (i.e. Laboratory Information Management Systems);

• Integrate and test PMACC systems with trial group systems (e.g. OPEN, Medidata

Rave) including NCI developed middleware;

• Design, develop, deploy, test and provide training for Medidata Rave Case Report

Forms, Rave Custom Functions, and CDISC-Compliant Common Data Elements

• Provide operational support for bioinformatics pipelines;

• Provide operational support for cloud infrastructure;

• Provide data analytics support for primary investigators, the steering committee, and others for the purpose of publication and trial evaluation;

• Support the publication of trial findings, original research, and processes;

• Support data sharing;

• Support clinical trial evolution as the studies progress;

• Support the analysis and data loading of treatment or correlative studies into trial-specific MATCHBoxes or CSMS;

• Provide and/or facilitate high-level project plans for all effort;

• Develop and deploy finding cancer trials solutions (i.e. Trial Search, FCTC);

• Provide systems analysis to enhance data submission and curation;

• Provide analysis for integrated NCI systems and services; and

• Provide Help Desk and technical support.

2.4 SCOPE

The Scope covers a variety of work activities required to meet the stated objectives. Activities performed will include but are limited to; providing subject matter expertise, consulting, and technical services supporting program and project management of the planning, acquisition, definition, design, development, implementation, operation, and maintenance of services, applications, and software, hardware, and communications infrastructures in the areas of Clinical Reporting and Research Informatics for Precision Medicine Activities (AML/MDS PMI, ComboMATCH, iMATCH, NCI-MATCH, NCI-Pediatric MATCH), and Clinical Trial and Ancillary Correlative Studies (NCI-CSMS).

Importantly, this effort includes the support, not only of existing activities, but also of new and emerging initiatives during the feasibility, evaluation, consideration, and proposal stage of designing these trials/studies. All aspects of these related projects shall follow modern best practices in a manner consistent with the objectives of system reliability, speed, interoperability, high data quality, scalability, elasticity, and security appropriate for adhering to federal standards for PHI, PII, and emerging GDPR requirements.

Further, the Contractor shall consider costs and seek ways to optimize the dollars associated with all efforts and consider ways to continually lower the costs for all projects, including the creation of reusable modules. Work includes but is not limited to analysis, planning, cost estimation, monitoring, tracking, reporting; system and database requirements definition, design, development, documentation, implementation, update, bioinformatics support, and operations and maintenance. The expertise and support provided will assist Federal staff to plan, implement, control, and manage on-going and new work to achieve approved NCI and CBIIT plans, goals, and objectives

2.5 TASK AREAS

The Contractor shall provide the technical and functional activities necessary for the management of this SOW and all tasks provided under this SOW:

2.5.1 Task Area 1 - Task Order Management

The Contractor shall provide the technical and functional activities necessary for the management of the Task Order and tasks within the task area provided in this SOW. The Contractor shall ensure that personnel are sufficiently qualified to execute the tasks listed in this SOW. The Contractor shall assume responsibility to meet the cost, performance, and schedule requirements through the task execution.

The Contractor shall ensure that all personnel complete appropriate training. This includes, but is not limited to, the use of the programs necessary for this project and all applicable confidentiality, privacy, information security, and conflict of interest regulations and corresponding NIH, HHS and Federal policies and requirements. Contractor/subcontractor staff shall sign Non-Disclosure Agreements, as they shall have access to data that contains personally identifiable or business sensitive information.

The contractor shall support the development, maintenance, and document control/tracking, of project plans, roadmaps, protocol documents, spreadsheets, financial statements, and contract deliverable documents. The contractor shall keep all documents secured in a system that allows folder/document/workspace management allowing for access to be granted to the contractor, NCI, NIH, HHS, and any 3rd party designated by the NCI.

Additionally, the Contractor shall supply government requested metrics and data that provide insight into the efficiency of processes needed to support this SOW; and provide recommendations for changes that would improve work, management effectiveness, and end-user satisfaction.

2.5.1.1 Task Order Management Plan

The Contractor shall provide a Task Order Management Plan outlining the tasks, subtasks, processes, and approaches it will use to provide the required services including the specific deliverable documents, analyses, and reports. The Task Order Management Plan shall also provide a proposed work plan, staffing plan, and contract year spending plan specifying planned monthly costs to the Government. Additionally, the plan shall include sections detailing subcontractor management and quality assurance describing the management controls to be put in place for Sub-Contractor management if Subcontractors are a part of the proposed team and specifying the tasks, sub tasks, and approaches to be used to ensure adequate quality and integrity of data in deliverables and database.

The Contractor shall maintain a current work plan, staffing plan, and spending plan and shall submit modifications to the COR as required by changes in planned events and costs. When approved by the COR, these plans shall be used to monitor, control, and report progress, issues, and resource expenditure.

The Contractor shall implement the Task Order Management Plan and manage resulting task activities following the HHS Enterprise Performance Life Cycle (EPLC) methodology. The COR shall provide the Contractor with the HHS EPLC guidance and any CBIIT modified templates (https://collaborate.nci.nih.gov/display/CC/PM+Tools+and+Templates)

2.5.1.2 Project Plan

Within (10) business days of award the Contractor shall submit a Draft Project plan for review and feedback from the COR. The Contractor shall develop and maintain the Project Plan to include all project tasks, milestones, and dependencies. Within (5) business days of receiving feedback from the COR the Contractor will submit the Final Project Plan to be approved and baselined. The Final (baselined) Project Plan will be maintained by the Contractor and reviewed with the COR and NCI Government as needed.

2.5.1.3 Contract Start-Up Meeting

https://collaborate.nci.nih.gov/display/CC/PM+Tools+and+Templates

Within five (5) business days of award, the Contractor shall participate in a Contract Start-Up Meeting and present an Orientation Briefing for the Government. The Government does not want an elaborate orientation briefing, nor does it expect the Contractor to expend significant resources in preparation for this briefing. The intent of the briefing is to initiate the communication process between the Government and Contractor by introducing key task participants and explaining their roles, reviewing communication ground rules, and assuring a common understanding of task requirements and objectives.

The Orientation Briefing shall be held at the Government's facility, another designated location, or via teleconference and both parties shall mutually agree upon the location, date, and time.

The purpose of this briefing is to introduce Contractor and Government staff associated with tasks to be accomplished under this Contract. In addition, the Contractor shall cover the proposed Task Order management approach and demonstrate understanding of the work it must accomplish under this SOW.

2.5.1.4 Status Meetings and Reports

The Contractor shall participate in recurring management meetings and provide status updates and monthly status reports on the performance and progress toward successful completion of this SOW. The Contractor shall describe any changes or updates to the Project Management Plan as a part of monthly status reporting as needed. The Contractor shall identify and discuss known and anticipated changes to work schedules and costs in these meetings. Recurring management meetings shall include but are not limited to a bi-weekly program meeting, a weekly change control meeting, and a weekly program and COR meeting.

The Contractor shall provide monthly status performance and financial status reports including metrics and progress of ongoing projects.

The Contractor shall also implement and report on a formal change management process including periodic change control meetings.

2.5.2 Task Area 2 – Molecular and Immunologic Characterization The contractor shall provide design, development, testing, implementation, deployment, configuration, informatics and bioinformatics support necessary to successfully automate the uploading, processing, standardization, and annotation of assay data in precision medicine trials for the automatic assignment of patients to protocols and/or arms. Further, the contractor shall be responsible for supporting the data storage, data analysis, and data publication for assays and pipelines used in the clinical laboratories. Assays may include, but are not limited to, Next Generation Sequencing (NGS), Whole Exome Sequencing (WES), Tumor Sequencing, RNA Sequencing, Circulating Tumor DNA (ctDNA), Immunohistochemistry, Fluorescent in-situ hybridization (FISH), in situ hybridization (ISH), gene expression, Polymerase Chain reaction, and double-stranded DNA. Finally, the contractor shall generate/support the Investigational Device submission to the Food and Drug Administration (FDA) which may include MATCHBox by providing technical writing, slide development, administrative tasks, subject-matter expertise, and meeting attendance.

2.5.3 Task Area 3 –Informatics and Software Development Support for CRRI Activities

The contractor shall provide informatics and software development support for CRRI activities including but not limited to designing, developing, documenting, publishing, testing, and deploying software to support the following:

• Clinical trial and correlative study workflows;

• Assay data analysis;

• Quality control;

• New York state licensure, as applicable;

• Testing for assay contamination, as applicable;

• Sample and patient tracking; and

• Rules to assign patients to the appropriate treatment study;

• CLIA Report Generation as directed by NCI (e.g. Oncomine Knowledge Base Reporter)

• Medidata Rave Study Builds and NCI developed middleware

2.5.4 Task Area 4 – Informatics and Software Development Support for Validation and

Verification The contractor shall provide informatics and validation and verification support for CRRI activities including but not limited to the following:

• Design, develop, document, test, and deploy software to support validation and verification of treatment studies

• Design, develop, document, test, and deploy software to support validation and verification of clinical trial informatics.

• Design, develop, document, test, and deploy software to support validation and verification of assay findings

2.5.5 Task Area 5 – Algorithm Informatics and Software Development Support The contractor shall provide algorithm informatics, software development support including but not limited to the following:

• Patient Assignment Criteria;

• Trial Search/Matching Recommendation Criteria; and

• Leveraging Artificial Intelligence-based approaches.

2.5.6 Task Area 6 – Informatics and Software Development Support for Electronic Data

Exchange The contractor shall provide informatics and software development support for electronic data exchange activities including but not limited to the following:

• RESTful APIs to support exchange of patient workflow data;

• RESTful APIs to support exchange of patient treatment assignment data;

• RESTful APIs to support exchange of server credentials;

• RESTful APIs to support exchange of treatment workflow and data;

• RESTful APIs to support exchange of assay data; and

• RESTful APIs to support exchange of patient, biopsy/sample and aliquot/slide tracking data.

2.5.7 Task Area 7 – Engineering Support for Software-in-the-Cloud

The contractor shall provide informatics, and software system engineering and development, and support of CRRI software-in-the-cloud activities including but not limited to support of the following.

The contractor shall design, develop, maintain, secure, and operate a FISMA-Moderate cloud-based system of systems in support of this CRRI SOW. A successful system of systems shall be characterized by having the ability to successfully automate clinical trial workflows, assign patients to protocols, analyze protocols, abstract protocols, store protocol data, store/retrieve whole-slide images (e.g., DICOM) and support the querying of data in an ad-hoc yet secure manner through such techniques as data warehouse and data marts. Further, a system of systems successfully designed, developed, maintained, secured, and operated by the contractor shall be demonstrated to have 99.5% uptime and to support multi-layer security including single-sign-on and data isolation. Finally, the contractor shall produce a high-level roadmap detailing their design, development, maintenance, security, and operational timelines in accordance with this

CRRI SOW.

2.5.8 Task Area 8 –Data Science Support for Data Analysis and Reporting The contractor shall provide data science support for data analysis and reporting for all CRRI projects and initiatives.

2.5.9 Task Area 9 – High-Performance Terminology Services

The contractor shall design, develop, maintain, test, secure, operate, and/or procure cloud-based terminology services for the enhancement, annotation, analysis, and querying of protocols and patient data minimally for diseases, conditions, drugs, biomarkers, and laboratory tests. A successfully designed, developed, maintained, secured, operated, and/or procured terminology system shall be characterized by having the demonstrated ability to successfully return results in ≤ 250 ms under a load of over 1000 concurrent users. A successful terminology system shall be characterized by having multi-level security implemented and demonstrated, roll up/down capabilities, pharmacogenomic information, and ongoing curation support to facilitate capture of precise disease information and prior treatment data critical to patient assignment for PMACC/PMI or other activities as directed by NCI.

2.5.10 Task Area 10 – Provide Data Coordination Services

The contractor shall provide support services to facilitate data transfer among and between NIH Repositories (e.g. The Cancer Research Data Commons.) The contractor shall design, develop, maintain, test, secure, and operate, data-transfer application programming interfaces, workflows, and activities necessary for clinical trial data to be securely transferred to The Cancer Research Data Commons. The transfer of data will be in accordance with NCI directives on data publication. The contractor shall be fully responsible for the development of algorithms and systems that optimize, scrub, enhance, and annotate all such data as required by the data commons standards.

2.5.11 Task Area 11– Provide Help Desk Infrastructure and Support The contractor shall provide help desk and technical support services for CRRI system, application, and database users and administrators including tiers 1,2, and 3. The contractor shall design, develop, maintain, test, secure, operate, and/or procure cloud-based help desk software for traditional help desk tiers 1, 2, and 3. Further, the contractor shall provide staff for all help desk support tiers as required on a project by project basis at the sole direction of the government. Initially, help desk staff and software for all levels shall be provided for Clinical Trial Reporting Program activities and for tier 2 and 3 for all precision medicine activities. This requirement is expected to evolve as the project progresses and recommendations for changes shall be developed and documented yearly and provided to the government.

2.5.12 Task Area 12– Software Development Lifecycle Support

The contractor shall customize, document, refine, implement, and utilize an Agile software development methodology. To enable the rapid delivery of properly functioning code to production environments the contractor shall design, develop, maintain, secure, operate, and/or procure an automatable cloud-based continuous integration and deployment (CI/CD) pipeline.

The successful implementation of a CI/CD pipeline shall be characterized by a fully automatable testing pipeline that shall include unit, integration, functional, acceptance, performance, security, and smoke tests. Further, the successful implementation of a CI/CD pipeline shall be characterized by minimally including security scanning, code scoring, code scanning, check-in, automatic virtual server building (as needed), and code tier promotion. The contractor shall demonstrate to the government that these requirements have been fulfilled.

2.5.13 Task Area 13 – Compliance with Applicable Information Security Requirements The highly patient sensitive nature of CRRI project requires that the design, develop, maintain, test, secure, and operate all systems at a FISMA-Moderate level. The contractor shall provide technical support services to ensure that CRRI systems, applications, databases, and communications services are compliant with applicable security requirements and standards.

The contractor shall design, develop, and maintain all systems to be in compliance with HIPAA regulations, 21 CFR Part 11 regulations, and GDPR requirements.

The contractor shall provide the government with a compliance plan documenting how the systems the contractor has planned, designed, developed, implemented, and maintained are in compliance with the aforementioned standards. The government will approve of the compliance plan.

All application programming interfaces designed, developed, implemented, and maintained by the contractor shall adhere to mutually agreeable 3rd party standards. Examples of official API standards include, but are not limited to, https://github.com/WhiteHouse/api-standards. The contractor shall document their API standards and shall be responsible for ensuring that they do not deviate from that standard without providing clear documentation explaining the rationale for deviation.

https://github.com/WhiteHouse/api-standards

2.6 NIH FISMA and FEDRAMP INFORMATION SECURITY and/or PHYSICAL ACCESS SECURITY Compliance Requirements

Note: “Security and Privacy Language for Information and Information Technology Procurements” this document is provided for reference purposes. This has not worked its way into the NIH work-forms yet.

2.6.1 Prohibition on Contractor Involvement with Terrorist Activities The Contractor acknowledges that U.S. Executive Orders and Laws, including but not limited to E.O. 13224 and P.L. 107-56, prohibit transactions with, and the provision of resources and support to, individuals and organizations associated with terrorism. It is the legal responsibility of the Contractor to ensure compliance with these Executive Orders and Laws. This clause must be included in all subcontracts issued under this contract.

2.6.2 Information Security and/or Physical Access Security

A. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

420 RFP Handbook 01/25/19

1. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. For additional information, see HSPD-12 policy at:

https://www.dhs.gov/homeland-securitypresidential-directive-12)

Roster-

a. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen

(14) calendar days after the effective date of this contract. Any revisions to the roster as a https://www.dhs.gov/homeland-securitypresidential-directive-12 result of staffing changes shall be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10- 15-12.xlsx.

b. If the Contractor is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

c. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

d. The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

e. All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

f. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14.

Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

g. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

h. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

i. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

j. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

A. Standard for Encryption- The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative within 15 days of the validation.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

B. Applicability- The requirements herein apply whether the entire contract or order

(hereafter "contract"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to…