SF_1449_Continuation_Sheet_A1.pdf

SF1449 – Continuation Sheet

Contents

1. Pricing Schedule (See Attachment 3 – Pricing Worksheet)

1.1. Brief Description of Supplies or Services

1.2. Contract Type: Indefinite Delivery/Indefinite Quantity (ID/IQ) Contract

1.3. Minimum and Maximum Quantities

1.4. Pricing Terms

1.5. Discounts

2. Contract Administration Details

2.1. Period of Performance

2.2. Place of Performance

2.3. Observance of Legal Holidays & Other Government Closings

2.4. Contract Management

2.5. Government Points of Contact

2.7. IDIQ Contracting Officer’s Technical Representative (COR)

2.8. Contracting Officer Representative (COR): TBD

2.9. Task Order COR

2.10. Contractor’s Contract Administration Information

2.11. Technical Direction

2.12. Notification Regarding Administrative Problems

2.13. Invoice Procedures

2.13.1. Invoice Submission Instructions

2.14. Ordering

2.15. Travel

2.16. Area of Travel

2.17. Travel Policy

2.18. Other Direct Costs (ODC)

2.19. Government Furnished Equipment/Government Furnished Information

2.20. FDA Personnel Security Clearance Requirements

2.20.1. 1. BACKGROUND

2.20.2. 2. GENERAL

2.20.3. 3. BADGING PROCESS

2.20.4. 4. BACKGROUND INVESTIGATIONS

2.20.5. 6. NON-PUBLIC DATA PROTECTION

2.20.6. CHART A

2.20.7. CHART B

2.20.8. Access to Non-Public Information

2.21. IT Security

2.22. Federal Information Security Management Act (FISMA) Compliance

3. Contract Clauses

3.1. Clauses Incorporated by Reference:

3.2. Clauses Incorporated by Full Text

3.3. Department of Health and Human Services Acquisition Regulations (HHSAR) Clauses and Provisions .. 33

4. Attachments

5. Solicitation Instructions

5.1. Questions

5.2. Instructions for Proposal Submission

5.3. Organization of Proposal

5.4. Instructions for Technical Proposal (Volume I)

5.4.1. Factor 1: Technical Understanding and Approach to Task Order

5.4.2. Factor 2: Management Approach to the IDIQ

5.4.3. Factor 3: Relevant Experience

5.5. Instructions for Business Proposal (Volume II)

5.6. Pricing Information

5.7. Pricing Instructions

5.8. Past Performance Questionnaire

5.9. Estimated Award Date

5.10. Service of Protest FAR Clause 52.233-2 Service of Protest (SEP 2006)

5.11. DUNS Numbers

5.12. System for Award Management

6. Evaluation

6.1. 52.212-2, Evaluation – Commercial Items (Jan 1999)

6.2. Evaluation of Offers (Single Award)

6.3. Evaluation Criteria and Basis for Award (Best Value)

6.4. Evaluation of Technical Proposal – Volume 1

6.4.1. Factor 1: Technical Understanding and Approach to Task Order

6.4.2. Factor 2: Management Approach to the IDIQ

6.4.3. Factor 3: Relevant Experience

6.5. Risk Assessment: Past Performance

6.6. Price

7. FAR Provisions

1. Pricing Schedule (See Attachment 3 – Pricing Worksheet)

1.1. Brief Description of Supplies or Services

The U.S. Food and Drug Administration (FDA) is establishing an Indefinite Delivery/Indefinite Quantity (IDIQ) contract to provide full software development life cycle support for the Safety Reporting Portal and related applications.

1.2. Contract Type: Indefinite Delivery/Indefinite Quantity (ID/IQ) Contract

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) contract per FAR subpart 16.5 for Commercial Items per FAR Part 12. This acquisition is in accordance with FAR Part 15.

At the discretion of the Contracting Officer, the Government may use a variety of contract types when issuing task orders under this contract, including: Firm-Fixed- Price (FFP), Time and Materials (T&M), Labor Hour (LH), or a combination thereof. Each Request for Task Order Proposal (RFTOP) issued under this contract will identify the Government’s determination of contract type.

1.3. Minimum and Maximum Quantities

The concurrent award of Task Order One fulfills the minimum order guarantee. The maximum aggregate dollar value of task orders awarded over the 5 year IDIQ ordering period cannot exceed the established contract ceiling of $20,000,000.00.

1.4. Pricing Terms

The unit prices specified in an IDIQ task order shall be derived from Attachment 3, Pricing Worksheet, for the contract period in which the services are estimated to be performed, as agreed to by the Government and the Contractor at the time the task order is issued. The IDIQ unit prices shall also be fixed for the task order period of performance and shall not be subject to adjustment; except, as a result of a direct action or inaction by the Government which delays the contractor from completing the task order within the time specified in the task order. However, in no event shall the contractor perform, or be paid for any work which exceeds the not to exceed dollar amount of a task order.

For firm fixed price (FFP) task orders issued under this contract, the applicable unit price for a task order shall be the unit price for the time period in which the services are estimated to be performed, as agreed to by the Government and the Contractor at the time the task order is issued. The price(s) specified in the FFP task orders issued under this contract is/are fixed and not subject to adjustment.

1.5. Discounts

The contractor is encouraged to offer any and all discounts for goods and services provided under future task orders. The type or amount of discount may vary based on the circumstances of each particular task order and should be proposed in accordance with the Contractor’s pricing policies.

2. Contract Administration Details

2.1. Period of Performance

The period of performance is anticipated to be 09/25/2015 – 09/24/2020

Ordering Period 1: 12 Months

Ordering Period 2: 12months

Ordering Period 3: 12 months

Ordering Period 4: 12 months

Ordering Period 5: 12 months

2.2. Place of Performance

Work will be performed at the contractor’s site or at FDA facilities throughout the DC Metropolitan area on workdays when there are face to face meetings and/or at the request of the COR. This is not expected to incur travel costs. The location and schedule of performance will be specified in each individual task order. Any travel requirements will be also be stated in each task order.

2.3. Observance of Legal Holidays & Other Government Closings

Coverage is expected during all Federal work days. Services will not be performed at the Federal site when the Federal Government is closed for reasons such as inclement weather or executive order. If Government employees are working (ie, telework), the Contractor shall work. No services or deliveries shall be performed at the Federal sites on Federal legal holidays as shown below unless specifically requested by the COR (in the best interest of industry coverage).

New Year’s Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

2.4. Contract Management

Notwithstanding the Contractor’s responsibility for total management during the performance of this contract, the administration of the contract will require maximum coordination between the Government and the Contractor.

Communications pertaining to the contract administration will be addressed to the Contracting Officer. No changes to the statement of work are authorized without a written modification to the contract executed by the Contracting Officer.

The Contractor is advised that only the Contracting Officer can change or modify the contract terms or take any other action, which obligates the Government. Then, such action must be set forth in a formal written modification to the contract.

Contractors who reply on direction from other than the Contracting Officer do so at their own risk and expense. Such actions do not bind the Government contractually. Any contractual questions shall be directed to the Contracting Officer, or Contract Specialist.

2.5. Government Points of Contact

Contract Specialist: Jacob O’Hatnick Contract Specialist – Systems Technology Acquisitions Branch Office of Acquisition and Grants Services U.S. Food & Drug Administration 5630 Fishers Lane, Room 2078A, HFA-500, Rockville MD 20857

240-402-7545

Jacob.OHatnick@fda.hhs.gov

Contracting Officer (Alternate POC):

Sherry Solodkova Chief – System Technology Acquisitions Branch Office of Acquisition and Grants Services U.S. Food & Drug Administration

5630 Fishers Lane, Room 2085, HFA-500, Rockville MD 20857 mailto:Jacob.OHatnick@fda.hhs.gov

240-402-7554 Sherry.Solodkova@fda.hhs.gov mailto:Sherry.Solodkova@fda.hhs.gov

2.7. IDIQ Contracting Officer’s Technical Representative (COR)

The Contracting Officer may designate other Government personnel (known as the Contracting Officer’s Representative) to act as her authorized representative for contract administration functions which do not involve changes to the scope, price, schedule, or terms and conditions of the contract. The designation will be in writing, signed by the Contracting Officer, and will set forth the authorities and limitations of the representative(s) under the contract. Such designation will not contain authority to sign contractual documents, order contract changes, modify contract terms, or create any commitment or liability on the part of the Government different from that set forth in the contract.

The Contractor shall immediately contact the Contracting Officer if there is any question regarding the authority of an individual to act on behalf of the Contracting Officer under this contract.

2.8. Contracting Officer Representative (COR): TBD

2.9. Task Order COR

For each Task Order, a COR will be assigned. The COR shall serve as the Contractor’s first point of contact for any technical questions and is responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; (5) assisting in the resolution of technical problems encountered during performance; and (6) providing technical direction in accordance with section 14; and, (7) reviewing of invoices/vouchers.

The Government may unilaterally change its COR designation.

Technical Leads may assist the COR. The Technical Leads will not have the authority to provide technical direction in accordance with section 14; however, they may be responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) performing technical evaluation as required; (3) performing technical inspections and acceptances as required by this performance; and (5) reviewing of invoices/vouchers.

2.10. Contractor’s Contract Administration Information

The Contractor’s contract administration functions will be performed at the following address:

Name and Title:

Responsible Office:

Address:

Telephone Number:

Fax Number:

E-mail Address:

DUNS#:

TIN:

2.11. Technical Direction

Performance of the work under task order shall be subject to the technical direction of the Task Order COR.

The term “technical direction” is defined to include, without limitation, the following:

Directions to the Contractor which redirect the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual statement of work.

Provision of information to the Contractor which assists in the interpretation of drawings, specifications, or technical portions of the work descriptions.

Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the Contractor to the Government under the contract.

Technical direction must be within the general scope of work stated in the contract. The COR does not have the authority to and may not issue any technical direction which:

Constitutes an assignment of additional work outside the general scope of work of the contract.

Constitutes a change as defined in the applicable contract clause entitled FAR 52.212-4(c) Contract

Terms and Conditions – Commercial Items.

In any manner cause an increase or decrease in the total estimated contract cost, fixed-fee, or the time required for contract performance.

Change any of the expressed terms, conditions, or specifications of the contract.

All technical direction shall be issued in writing by the IDIQ or Task Order COR or shall be confirmed by him/her in writing within 5 working days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR in the manner prescribed by this article and within his/her authority under the provisions of this article.

If, in the opinion of the Contractor, any instructions or direction issued by the COR is within one of the categories described above, the Contractor shall not proceed but shall notify the Contracting Officer in writing within 5 working days after the receipt of any such instructions or direction and shall request the Contracting Officer to modify the task order, accordingly. Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of this contract. The Contractor shall proceed immediately with the instructions or directions and shall be subject to the “Disputes” clause within FAR 52.212-4(d) “Contract Terms and Conditions – Commercial Items”.

2.12. Notification Regarding Administrative Problems

If at any time during the performance of this contract, administrative problems should arise which will have an adverse impact on the timely performance by the Contractor or affect the contract costs or funding, the Contractor is required to immediately notify the Contracting Officer identified in section II, item #5.A above.

2.13. Invoice Procedures

If applicable, invoices must include a list of tasks performed during the period of performance, broken down by labor categories, and personnel name. Total hour per labor category and rates must be broken out and clearly defined for each task and personnel per invoice.

If applicable, with each invoice the Contractor shall submit to the Contracting Officer a cumulative report, for the entire contract, demonstrating compliance with FAR Clause 52.219-14, Limitation on Subcontracting. If not in compliance, the report shall include the corrective actions taken or planned to be in compliance.

2.13.1. Invoice Submission Instructions

A. THE CONTRACTOR SHALL SUBMIT ALL INVOICES TO ALL ADDRESSEES IN THE MANNER SPECIFIED BELOW:

(I) ONE ORIGINAL AND ONE COPY TO THE APPROVING OFFICIAL:

U.S. FOOD AND DRUG ADMINISTRATION

OFFICE OF ACQUISITIONS AND GRANTS SERVICES

ATTN: [INSERT NAME], CO/CS

5630 FISHERS LANE

ROOM XXXX, HFA-500

ROCKVILLE, MARYLAND 20857

E-mail: xxxxx.xxxxx@fFDA.HHS.GOV

*** ACCEPTABLE METHODS OF DELIVERY INCLUDE: MAIL, HAND DELIVERY, AND E-MAIL

(II) ONE COPY TO THE CONTRACTING OFFICER TECHNICAL REPRESENTATIVE (COTR) OR OTHER

PROGRAM CENTER/OFFICE DESIGNEE, CLEARLY MARKED “COURTESY COPY ONLY”:

U.S. FOOD AND DRUG ADMINISTRATION

OFFICE OF PROGRAM OPERATIONS

ATTN: [INSERT NAME], COTR

WHITE OAK CAMPUS

10903 NEW HAMPSHIRE AVENUE

ROOM XXXX

SILVER SPRING, MARYLAND 20993

E-mail: xxxx.xxxx@FDA.HHS.GOV

[AMEND, AS NECESSARY]

mailto:xxxxx.xxxxx@fFDA.HHS.GOV mailto:xxxx.xxxx@FDA.HHS.GOV

*** ACCEPTABLE METHODS OF DELIVERY INCLUDE: MAIL, HAND DELIVERY, OR E-MAIL

B. INVOICES SUBMITTED UNDER THIS CONTRACT MUST COMPLY WITH THE REQUIREMENTS SET FORTH IN FAR CLAUSES 52.232-25 (PROMPT PAYMENT) AND 52.232-33 (PAYMENT BY ELECTRONIC FUNDS TRANSFER – CENTRAL CONTRACTOR REGISTRATION) AND/OR OTHER APPLICABLE FAR CLAUSES SPECIFIED HEREIN. TO CONSTITUTE A PROPER INVOICE, THE INVOICE MUST BE SUBMITTED ON COMPANY LETTERHEAD AND

INCLUDE EACH OF THE FOLLOWING:

(I) NAME AND ADDRESS OF THE CONTRACTOR;

(II) INVOICE DATE AND INVOICE NUMBER;

(III) PURCHASE ORDER/AWARD NUMBER;

(IV) DESCRIPTION, QUANTITY, UNIT OF MEASURE, UNIT PRICE, AND EXTENDED PRICE SUPPLIES DELIVERED

OR SERVICES PERFORMED, INCLUDING:

(a) PERIOD OF PERFORMANCE FOR WHICH COSTS ARE CLAIMED;

(b) ITEMIZED TRAVEL COSTS, INCLUDING ORIGIN AND DESTINATION;

(c) ANY OTHER SUPPORTING INFORMATION NECESSARY TO CLARIFY QUESTIONABLE EXPENDITURES;

(V) SHIPPING NUMBER AND DATE OF SHIPMENT, INCLUDING THE BILL OF LADING NUMBER AND WEIGHT

OF SHIPMENT IF SHIPPED ON GOVERNMENT BILL OF LADING;

(VI) TERMS OF ANY DISCOUNT FOR PROMPT PAYMENT OFFERED;

(VII) NAME AND ADDRESS OF OFFICIAL TO WHOM PAYMENT IS TO BE SENT (MUST BE THE SAME AS THAT

IN THE PURCHASE ORDER/AWARD, OR IN A PROPER NOTICE OF ASSIGNMENT);

(VIII) NAME, TITLE, AND PHONE NUMBER OF PERSON TO NOTIFY IN EVENT OF DEFECTIVE INVOICE;

(IX) TAXPAYER IDENTIFICATION NUMBER (TIN);

(X) ELECTRONIC FUNDS TRANSFER (EFT) BANKING INFORMATION, INCLUDING ROUTING TRANSIT NUMBEROF THE FINANCIAL INSTITUTIONRECEIVIN PAYMENT AND THE NUMBER OF THE ACCOUNT INTO

WHICH FUNDS ARE TO BE DEPOSITED;

(XI) NAME AND TELEPHONE NUMBER OF THE FDA CONTRACTING OFFICER TECHNICAL REPRESENTATIVE (COTR) OR OTHER PROGRAM CENTER/OFFICE POINT OF CONTACT, AS REFERENCED ON THE PURCHASE

ORDER;

(XII) ANY OTHER INFORMATION OR DOCUMENTATION REQUIRED BY THE PURCHASE ORDER/AWARD.

(XIII) CONTRACTOR IS □ IS NOT □ REQUIRED TO ATTACH AN INVOICE LOG ADDENDUM TO EACH INVOICE

WHICH SHALL INCLUDE, AT A MINIMUM, THE FOLLOWING INFORMATION FOR CONTRACT

ADMINISTRATION AND RECONCILIATION PURPOSES:

(a) LIST OF ALL INVOICES SUBMITTED TO DATE UNDER THE SUBJECT AWARD, INCLUDING THE

FOLLOWING:

(1) INVOICE NUMBER, AMOUNT, & DATE SUBMITTED

(2) CORRESONDING PAYMENT AMOUNT & DATE RECEIVED

(b) TOTAL AMOUNT OF ALL PAYMENTS RECEIVED TO DATE UNDER THE SUBJECT CONTRACT OR ORDER

(c) AND, FOR DEFINITIZED CONTRACTS OR ORDERS ONLY, TOTAL ESTIMATED AMOUNTS YET TO BE

INVOICED FOR THE CURRENT, ACTIVE PERIOD OF PERFORMANCE

C. AN ELECTRONIC INVOICE IS ACCEPTABLE IF SUBMITTED IN ADOBE ACROBAT (PDF) FORMAT. ALL ITEMS LISTED IN (I) THROUGH (XII) OF THIS CLAUSE MUST BE INCLUDED IN THE ELECTRONIC INVOICE. ELECTRONIC INVOICES MUST BE ON COMPANY LETTERHEAD AND MUST CONTAIN NO INK CHANGES AND BE LEGIBLE FOR

PRINTING. [AMEND/DELETE, AS NECESSARY]

D. QUESTIONS REGARDING INVOICE PAYMENTS SHOULD BE DIRECTED TO THE FDA PAYMENT OFFICE AT:

FDA/OC/OA/OFO/OFS

ATTN: DIVISION OF PAYMENT SERVICES

12345 PARKLAWN DRIVE, HFA-720

301.827.3742 OR 866.807.3742

fdavendorpaymentsteam@fda.gov

ROCKVILLE, MARYLAND 20857

2.14. Ordering

Task Orders – Ordering services shall be accomplished by the issuance of written task orders specifying the types of services being ordered. All task orders issued under this contract shall conform to provisions of clause FAR 52.216-18 “Ordering” in this contract. The only office authorized to process task orders through the Office of Acquisitions & Grants Services is the Food and Drug Administration (FDA) Contracting Officer

(CO).

Task Order Procedures – When a need for services within scope of this contract arises, the FDA will issue a Request for Task Order Proposal (RFTOP). The process for awarding tasks orders will be as follows:

1. FDA’s Office of Acquisitions & Grants Services Contracting Officer will issue an RFTOP via email.

The RFTOP will include at a minimum a SOW, the period of performance, the anticipated order type (LH, T&M or FFP), reporting requirements and deliverables, and any special terms and conditions applicable to the Task Order.

2. Within ten (10) business days (unless another time frame is specified in writing) the contractor will provide a proposal to the Contracting Officer. The proposal will include a brief description of the technical approach and a price build up. The price build up should include the labor categories to be utilized, the number of hours within each labor category, extended pricing for each labor category and a bottom line price/ceiling.

3. FDA will evaluate the task order proposal for technical acceptability and price reasonableness.

FDA will consider the following technical factors: technical approach, whether the labor mix is appropriate; and whether the level of effort is sufficient. If the FDA has questions or concerns the Contracting Officer will contact the contractor, and may ask for a revised proposal.

4. Once the proposal is acceptable, the Contracting Office will issue the task order.

mailto:fdavendorpaymentsteam@fda.gov

5. Orders will include the following:

a. Task Order Number

b. Date

c. Accounting Information

d. SOW

e. Price/Ceiling

f. Period of Performance

g. Any terms, conditions, or instructions unique to the order.

Any work that the Contractor undertakes prior to receiving a fully executed task order signed by the Contracting Officer is undertaken at risk.

2.15. Travel

Any required travel by the Contractor will be at the direction of the Government and will be reimbursed at cost (except Firm Fixed Price task orders) in accordance with the Federal Travel Regulations (FTR).

2.16. Area of Travel

Performance under this contract may require travel by Contractor personnel. If travel, domestic or overseas, is required, the Contractor is responsible for making all needed arrangements for Contractor’s personnel. This includes but is not limited to the following:

Medical Examinations

Immunizations

Passports

Visas, etc

Security Clearances

2.17. Travel Policy

The Government will reimburse the Contractor for allowable travel costs incurred by the Contractor in performance of the contract and determined to be in accordance with FAR subpart 31.2, subject to the following provisions: Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

Travel – Travel, subsistence, and other associated labor charges for travel time are authorized, whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience and daily travel to and from work at Contractor’s facility will not be reimbursed.

Per Diem – Per Diem for travel on work assigned under this contract will be reimbursed to employees consistent with company policy, but not exceed the amount authorized in the Federal Travel Regulations.

Air/Rail Travel – In rendering services, the Contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of tourist class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Contracting Officer. Such authorization by the Contracting Officer shall be indicated in the order or in some other suitable written form.

Note: To the maximum extent practicable without the impairment of the effectiveness of the mission, transportation shall be tourist class. In the event that only first class travel is available, it will be allowed, provided justification therefore is fully documented and warranted.

Private Automobile – The use of privately owned conveyance within the continental United States by the traveler will be reimbursed to the Contractor at the mileage rate allowed by Federal Travel Regulations.

Authorization for the use of privately owned conveyance shall be indicated on the order. Distances traveled between points shall be shown in standard highway mileage guides. Any deviations from distance shown in such standard mileage guides shall be explained by the traveler on the expense sheet.

Car Rental – The Contractor shall be entitled to reimbursement for car rental, exclusive of mileage charges, as authorized by each order, when the services are required to be performed outside the normal commuting distance from the Contractor’s facilities. Car rental for TDY teams will be limited to a rate of one car for every four (4) persons on TDY at one site.

2.18. Other Direct Costs (ODC)

Any Other Direct Costs (ODC) should be submitted through the invoice. All ODC over $3,000, other than those ODC acquired under the firm fixed price line items, must be pre-approved by the Contracting Officer, if not already approved through the issuance of a task order or modification.

To be eligible to receive reimbursement for ODC the Contractor must obtain at least three quotes for each transaction in excess of $3,000.00 to ensure that adequate price competition was sought or the Contractor must provide an acceptable justification as to why it was impracticable to do so. For purchases of ODC, the Contractor needs to provide the aforementioned documentation only when requested by the Contracting Officer.

The Contractor shall maintain documentation of all reimbursable purchases until three years after the contract is completed and shall provide access to and copies of such documentation when requested by the Contracting

The Contracting Officer may reduce the reimbursement by any amount above that which the Contracting Officer funds, in his/her sole discretion, is greater than that which is fair and reasonable for the ODC giving due consideration to the facts and circumstances prevailing at the time that the Contractor procured the ODC.

Disputes as to the amount by which any reimbursement is reduced shall be resolved in accordance with the “Disputes” clause of the contract. It shall be the Contractor’s burden to demonstrate that the price it paid for the reimbursable items was fair and reasonable.

2.19. Government Furnished Equipment/Government Furnished Information Each task order will identify Government Furnished Equipment and Government Furnished Information.

No equipment or software shall be purchased under this contract without the specific, advance, written approval and written authorization from the FDA CO. The Center business management will approve funding levels and the Government will provide funding for other direct costs, hardware, software, training, licenses (limited) and maintenance for the project and all associated applications.

The Contractor will be provided with documented standards and policies. Additionally, FDA will provide updates to artifacts (standards, document templates, and processes) as they become available.

2.20. FDA Personnel Security Clearance Requirements

2.20.1. 1. BACKGROUND

The Office of the Assistant Secretary for Management and Budget, Department of Health and Human Services (DHHS), requires that DHHS employees and contractor employees (including subcontractors) who will be working in a DHHS-owned or leased space and/or who will have access to DHHS equipment, and non-public privileged, proprietary, or trade secret information, undergo a background investigation of some type.

Contractor employees who will be in DHHS-owned or lease space for less than thirty (30) days are exempted from the background investigation requirement. These contractor employees must be escorted at all time while in DHHS-owned or leased space.

2.20.2. 2. GENERAL

The contractor shall submit the following items to the Contracting Officer, ten (10) calendar days prior to commencement of work under this contract:

Certification that all required security form packets and a list of contractor employees names for whom the requisite security information has been provided to Division of Security Operations, Policy and Planning, Personnel Security Staff.

"Contractor's Commitment to Protect Non-public Information Agreement" forms signed by each employee named in paragraph a. above.

With the exception of costs associated with fingerprinting Contractor employees outside of the FDA Personnel Security Office, the Government will conduct all required background investigations at no cost to the contractor.

The cost of fingerprinting Contractor employees at any location other than the FDA Personnel Security Office will be borne by the Contractor.

Contractor employees shall obtain security badges in order to access to DHHS-owned or leased property without an escort. (See Section 3 for details on the badging process) However, in the event that work must commence before security badges can be issued, contractor employees will be allowed onto DHHS-owned or leased property, but must be escorted at all times.

All Contractor employees who undergo a background investigation are required to log onto the Office of Personnel Management’s (OPM’s) Electronic Questionnaire for Investigation Processing (e-QIP) system to complete the forms necessary to initiate their background investigations. The forms required vary with the position risk levels for the contract.

The position risk levels for this contract Public Trust Positions (Levels 5).

There are two (2) potential position risk levels, which are:

Non-Sensitive Positions (Level 1) (SEE CHART A) - Positions which involve the lowest degree of adverse impact on the efficiency of the Agency. The forms set forth by CHART A are required for Non-Sensitive Positions (Level 1). Contractor employees assigned to Level 1 who receive a security badge will be required to provide additional security information for a background investigation as specified in Paragraph 5 below.

b. Public Trust Positions (Levels 5 or 6) (SEE CHART B) - Positions in which the incumbent's actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned Government activities, whether or not actual damage occurs. The forms set forth by CHART B are required for Public Trust Positions (Levels 5 or 6). Contractor employees assigned Levels 5 or 6 must receive security badge as well as a background investigation.

In order to access the e-QIP system, Contractor employees must provide the appropriate Personnel Security Specialist with the following information: (a) full name; (b) position title; (c) social security number; (d) date of birth; (e) place of birth; (f) email address; and (g) phone number. The Personnel Security Specialist will use this information to initiate each Contractor employee into the e-QIP system. Once this is done, each Contractor employee will receive an email that contains a web link to access the e-QIP system, as well as instructions and additional forms needed to initiate the suitability background investigation. The Project Officer for the contract will provide the name of the appropriate Personnel Security Specialist to the Contractor.

A Contractor’s failure to comply with the e-QIP processing guidelines will result in that Contractor’s employees being denied access to FDA property until all security processing has been completed.

2.20.3. 3. BADGING PROCESS

The FDA Project Officer will sponsor Contractor employees on the FDA Form 3391 for the purpose of obtaining an FDA Security Access Card. In order to obtain one, a contractor employee must receive a "favorable" fingerprint return. Fingerprints must be submitted to the Personnel Security Office at least ten (10) days prior to the commencement of work. Fingerprints will be submitted in one of two ways, depending on where the contract will be performed:

Contractor employees who will work in the Washington D.C. metro area will, at the direction of the FDA Project Officer or his/her designee, contact the Personnel Security Branch to schedule a fingerprinting appointment, or

b. Contractor employees who will work in a field office will submit fingerprints to:

Food and Drug Administration

Fingerprinting and Personnel Security Office 10903 New Hampshire Avenue, Building 1, Room 1201

Silver Spring, MD 20993 Upon the receipt of a "favorable" fingerprint return, each Contractor employee must present two forms of identification in order to receive his or her badge. One form of identification must be a government-issued photo identification document. Acceptable forms of photo identification are referenced on the FDA Form 3391.

Acceptable forms of secondary identification are listed on the back of the I-9 Form. This form can be obtained at http://uscis.gov/graphics/formsfee/forms/files/i-9.pdf

An individual who receives an unfavorable report may appeal that finding by submitting a written request to the Personnel Security Staff.,

2.20.4. 4. BACKGROUND INVESTIGATIONS

The Government shall conduct an additional background investigation for those individuals named to risk Levels 1, 5 and 6 serving under this contract.

Required background investigations may include, but not be limited to:

Review of prior Government/military personnel records;

Review of FBI records and fingerprint files;

Searches of credit bureaus;

http://uscis.gov/graphics/formsfee/forms/files/i-9.pdf

Personal interviews; and

Written inquiries covering the subject's background.

Background investigations will be conducted by the Office of Personnel Management (OPM).

The Contractor is responsible for ensuring that the integrity of contract performance is maintained pending completion of all appropriate background investigations of contractor employees.

The Contractor shall submit the information required for eQIP access and other requisite forms for the risk level(s) specified. In addition, the contractor shall provide a cover letter which includes: the Contractor's name, the contract number, the name of the Contracting Officer administering the contract, the names of all Contractor employees' for whom a background check is required and those employees’ social security numbers, dates of birth, and former names. This cover letter and all completed forms shall be transmitted, in a separate sealed envelope marked, "TO BE OPENED BY ADDRESSEE ONLY," to:

Food and Drug Administration

Badging and Credentialing Office

10903 New Hampshire Avenue, Building 1, Room 1201

The contractor shall send a separate letter to the Contracting Officer that includes the contract number and employee names.

The contractor shall advise its prospective employees that all standard forms submitted to the FDA will be forwarded to the Office of Personnel Management (OPM) for scheduling background investigations.

Personnel Security Staff will resolve with the contract employee any issues arising out of inaccurate or incomplete forms.

Employees who have been previously granted a Government security clearance shall advise Personnel Security Staff of the details of such clearances to determine if a previous clearance level is suitable for the current FDA position.

At any time, if a contractor employee for whom security forms have been submitted is terminated or otherwise ceases work under the contract, the contractor shall immediately notify Personnel Security Staff, in writing, with copies to the respective FDA Project and Contracting Officers.

The OPM background investigation will take approximately 120 days. The Contracting Officer will notify the Contractor in writing if an employee is denied a clearance. Those individuals who have been cleared by Personnel Security Staff may continue to work under the contract. Those who are not cleared must cease work on the contract immediately.

If a Contractor employee changes job responsibilities under this contract, the contractor shall notify the Contracting Officer, and the Government will make a determination whether an additional security clearance is required.

In the event that a cleared individual is replaced, the contractor shall notify the Contracting Officer and comply with all requirements of this clause, as specified herein, prior to the commencement of work by the replacement individual.

The Contractor shall be responsible for the return of any Government issued security badges to the Project

2.20.5. 6. NON-PUBLIC DATA PROTECTION

The contractor shall protect the privacy of all information reported by or about contract employees and shall protect against unauthorized disclosure.

CHARTS A & B ARE APPENDED TO THIS CLAUSE

For clarification purposes and to facilitate the flow of all required security forms, the following matrix is provided:

2.20.6. CHART A

Mandatory for all on-site contract employees

NON-SENSITIVE

POSITIONS - LEVEL 1

FORM NAME

OBTAIN

FROM

WHEN

REQUIRED

SUBMIT

TO

DATE REQUIRED

FDA Form 3391 - FDA Security Card Access Request

Project

Sponsorship must be provided by FDA Project

All positions on DHHS property or leased space

Food and Drug Administration

Attn: Badging and Credentialing Office

Form must be received prior to making fingerprint appointment.

10903 New Hampshire Avenue

Building 1, Room 1201

Silver Spring, MD 20993

**Form must be submitted by Security Rep.

Contractor’s Commitment to Protect Non- Public Information (NPI) Agreement form

Contracting Officer with access to non-public privileged, proprietary, or trade secret information

Contracting Officer for retention in contract file

Ten (10) calendar days prior to commencement of work

Listing of all contractor employee names, social security #s, gender, dates of birth, former names, and a completed Fair Credit Reporting Act Release

Contractor generated

All positions, including intermittent, per diem or temporary

*Food and Drug

(301) 796-4592 prior to

SF 85 -

Questionnaire for Non-Sensitive Positions

Online via OPM’s e- QIP system

Non- Sensitive Positions - Level 1 Clearance

*Submit to OPM online via the e-QIP system upon request of the Contracting

FD 258 -

Fingerprint Chart (2 Charts

Non- Sensitive Positions -prior to

Required)

Fingerprinting services available by appointment only.

Call (301) 827-

Level 1

Fingerprinting & Personnel Security Office

(301) 796-4607

*In addition to the submission of these forms, the contractor shall provide a cover letter that includes: contractor’s name, contract number, contractor employees’ names, and name of Contracting Officer.

*Upon favorable fingerprint return, contractor will be notified to respond to the badging office for their building pass.

2.20.7. CHART B

*Food and Drug Administration

8:00 a.m. – 11:00 a.m. and 1:00 p.m. – 3:00 p.m.

10903 New Hampshire Avenue

No appointment necessary

Public Trust Positions - Levels 5 or 6

FORM NAME

OBTAIN

FROM

WHEN

REQUIRED

SUBMIT

TO

DATE REQUIRED

SF 85P -

Questionnaire for

Positions

Online via OPM’s e- QIP system

Level 5 or 6

*Submit to OPM online via the e-QIP system

FD 258 -

Fingerprint Chart (2 Charts Required)

Fingerprinting services available by appointment only.

Call (301) 827-

Level 5 or 6

Fingerprinting & Personnel Security Office

(301) 796-4607

FDA Form 3391 - FDA Security Card Access Request

Project

Sponsorship must be provided by FDA Project on DHHS property or leased space

Food and Drug

**Form must be submitted by Security Rep.

Form must be received prior to making fingerprinting appointment.

Contractor’s Commitment to Protect Non- Public Information (NPI) Agreement form with access to non-public privileged, proprietary, or trade secret information

Contracting Officer for retention in contract file prior to

Listing of all contractor employee names, social security #s, Contractor generated

All positions, including intermittent, per diem or gender, dates of birth, former names, and a completed Fair Credit Reporting Act Release temporary

*Upon favorable fingerprint return, contractor will be notified to respond to the badging office for their building pass.

*Food and Drug Administration

8:00 a.m. – 11:00 a.m. and 1:00 p.m. – 3:00 p.m.

10903 New Hampshire Avenue

No appointment necessary

*In addition to the submission of these forms, the contractor shall provide a cover letter that includes: contractor’s name, contract number, contractor employees’ names, and name of Contracting Officer.

2.20.8. Access to Non-Public Information

All contractor and subcontractor employees are required to sign the Contractor's Commitment to Protect Non- Public Information Agreement form provided as an attachment to this contract (Attachment 6). If a person who has signed this agreement resigns, is dismissed, or is otherwise no longer working on this contract, the contractor shall notify the FDA COR and Contracting Officer. Any new contractor and subcontractor employees assigned to this contract shall sign the form, and the contractor shall hand-deliver it (ten (10) days prior to commencement of work) to the Contracting Officer.

The prime contractor, subcontractors, and consultants shall not be provided nor possess non-public information in any form unless written approval and a facility clearance have been granted.

Briefings A FDA representative (typically, the COR) will conduct an orientation briefing for the contractor/contractor employees. The briefing will stress: (1) the importance of protecting non-public information; (2) specified computer/ADP requirements as outlined in the DHHS Automated Information Systems Security Program Handbook; and (3) the consequences of unauthorized disclosure of non-public information. Briefing updates will be conducted annually.

The contractor shall brief all contractor employees, subcontractors and consultants regarding the sensitivity of the information to be handled under the contract and of the responsibility to protect it. The briefing shall stress that the information is non-public and shall not be disclosed to any unauthorized source. The contractor shall conduct an updated briefing annually and shall submit a report to the FDA COR within ten (10) days after the briefing which includes: an outline of the briefing, a copy of any briefing materials, date briefing was conducted and the names of the attendees.

If this is an automated data processing/telecommunications (ADP/TC) contract, in addition to the above briefings, the FDA COR and the FDA Center/Office Information Systems Security Officer (ISSO) will brief contractor and subcontractor personnel and consultants on security measures required pertinent to any hardware/software being utilized. Furthermore, appropriate contractor and subcontractor personnel and consultants shall attend training courses as directed by the FDA to fulfill requirements of the Computer Security Act of 1987. These courses are generally one (1) day in length; and attendance at one (1) course is sufficient. This training will be provided at no cost to the contractor.

Physical Security Requirements for Releasing Non-Public Information Under the provisions of Title 21, United States Code, Section 331(j), the contractor shall establish and maintain comprehensive security measures for controlling access to non-public information released under a contract involving the processing of such information.

The contractor shall be required to submit a physical security plan with their proposal. The plan shall provide written procedures which detail the instructions issued to contract employees on the following:

1. safeguarding material during use;

2. safeguarding material at all other times;

3. accounting for material

a. tracking procedures,

b. created in-process;

4. storage control;

5. key control;

6. area security;

7. visitor control;

8. receipt and transmittal of material;

9. reproduction of material;

10. destruction of material;

11. recording logs;

12. response to emergency situations;

13. compromise of information; and,

14. administrative controls.

This clause applies to the contractor, any subcontractors, and any consultants. Non-public information will be released to only those persons who will be using the contractor’s approved facility unless the off-site facility has been reviewed by the FDA Physical Security Staff and approved in writing by the FDA Physical Security Office.

For transmittal of documents the contractor shall adhere to the following:

1. Documents to be transmitted internally shall be transmitted on a person-to-person basis between approved employees only.

2. Documents to be transmitted outside the contractor’s facility shall be double-wrapped with the inner wrapping marked “FDA Privileged Information – Access Controlled”. The names and addresses of the sender and addressee shall be typed on both the inner and outer wrappings.

3. Documents to be transmitted back to the FDA or to another address designated by the FDA shall be transmitted by an approved employee or by U. S. Registered mail (return receipt requested). It shall be double-wrapped or wrapped by such a method as specifically approved in writing by the FDA Physical Security Office.

4. A receipt log shall be maintained for all external transmittals.

The contractor shall follow up all transmittals in order to obtain signed receipt within five (5) working days of transmittal. Failure of recipient to furnish such receipt shall be reported to the FDA Physical Security Office within ten (10) working days of transmittal.

No non-public information will be released to the contractor unless all required security precautions have been met [as demonstrated during an inspection by the Food and Drug Administration (FDA) Physical Security Staff], and written procedures for enforcing them have been provided by the contractor and approved in writing by the Physical Security Staff. The FDA Physical Security Office will notify the contractor of the approval.

When the contractor facilities have a current certification from the Defense Contract Administration Services/Defense Logistics Agency (DCAS/DLA) as a “Secret” or higher classification, such rating will satisfy the FDA security requirements for the contractor’s facility. Loss of such certification during the period of the contract will be cause for a possible issuance of a Stop Work Order pending review by the FDA’s Physical Security Staff of the contractor’s facility. The contractor shall notify the FDA Physical Security Office in the event the DCAS/DLA rating is expected to be terminated.

Pending the outcome of any subsequently required investigation, additional requirements on the contractor shall include, but not be limited to, the following: restrictions on access to data by contractor employees, subcontractor employees, and consultants; special storage requirements; restrictions on transmission and disclosure of information; changes in periods of retention and in methods of destruction of source documents or related material; and disclosure statements for all contractor employees, subcontractor employees, and consultants.

The FDA Physical Security Staff will review the contractor’s facility and assess the contractor’s compliance.

Recommendations for bringing noncompliant areas into compliance will be provided to the contractor by the FDA Physical Security Office.

The Contractor shall make any changes necessary within thirty (30) days after written notice from the FDA Physical Security Office in order to comply with FDA security requirements. When appropriate changes have been made the Contractor shall contact the FDA Physical Security Office to request further review by the FDA. The FDA Physical Security Office will notify the Contractor in writing of the outcome of the second inspection. Failure of the contractor to satisfy FDA security requirements within thirty (30) days after the first written notification from the Contracting Officer may be cause for termination of the contract.

The contractor shall designate a Security Representative to act as liaison between the contractor and the FDA on all security-related matters. This includes personnel changes, personnel terminations, disciplinary actions, etc.

The name of the Security Representative shall be provided in the offeror’s proposal.

In addition to the above, if this is an automated data processing/telecommunications (ADP/TC) contract, special requirements are necessary. Contractor and subcontractor employees and consultants participating in the design, operation, maintenance or use of FDA automated information systems or ADP/TC resources shall comply with the DHHS Automated Information Systems Security Program Handbook. Chapter VII, entitled, “Personnel Security/Suitability and Training,” which establishes criteria for assigning positions to the three (3) computer/ADP position risk levels: Level 6, high risk public trust position; Level 5, moderate risk public trust position; and Level 1, low risk position. Chapter VIII, entitled, “AIS Facilities,” requires contractors to meet or exceed the security requirements described therein.

All contractor, subcontractor and consultants assigned to this contract and working in a FDA facility will be provided with Government badges by the FDA COR at the FDA’s expense.

2.21. IT Security

Information Security Requirements This Statement of Work (SOW) requires the contractor to (1) develop, (2) have the ability to access, or (3) host and/or maintain a Federal information system(s). Pursuant to Federal and department of Human and Health Services (HHS) Information Security Program Policies, the contractor and any subcontractor performing under this task order shall comply with the following requirements:

1. Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub.

L. No. 107-347 (Dec. 17, 2002); http://csrc.nist.gov/policies/FISMA-final.pdf. FSIMA certified is required.

2. EPLC is a process-driven Information Technology (IT) life cycle management approach emphasizing enterprise integration based on the development of sound business and technical requirements. The HHS EPLC has been tailored by the FDA and will be referred to as the FDA EPLC for this document. For each project, from the FDA EPLC, the Project Process Agreement (PPA) is customized to generate the activities and deliverables required in this procurement.

3. FDA Approved Technologies List - The FDA Master Approved Technology (MAT) List contains a list of approved and not approved technologies including applications (software), infrastructure and peripherals (hardware), and scientific software and devices.

4. FDA Security Authorization Process - Security Authorization is the approach FDA follows to fulfill Federal Information Security Management Act (FISMA), Office of Management and Budget (OMB) and Department of Health and Human Services (HHS) requirements to ensure that information resources have adequate security to protect the Confidentiality, Integrity and Availability of information collected, processed, transmitted, stored, or disseminated by the agency. For further information see: FDA Security Authorization Toolkit SP 800-37 Rev. 1:

Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach.

5. National Institute of Standards and Technology (NIST) SP800-53 - This publication was developed by the…