17-233-SOL-00536_000001.pdf

(x)

17-233-SOL-00536

x x

0 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

06/13/2017000001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

06/13/2017

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to (1) revise language in section A.1, I.2, J, and L.9;and

(2) provide submitted questions and corresponding responses.

Attachments:

Amended Solicitation with track changes

Offerors Questions and Answers

All other terms and conditions remain unchanged

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

Solicitation 17-233-SOL-00536_000001_National Data on Child Abuse and Neglect

SECTION A - Solicitation/Contract Form

A.1 COMBINED SYNOPSIS/SOLICITATION

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. This solicitation is being issued in conjunction with FAR Part 15 Contracting by Negotiation as applicable. The solicitation number is 15-233-SOL-00250 17-233-SOL-00536. This announcement is issued as a Request for Proposal.

The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-82, 05/17/2015.

This solicitation is issued as unrestricted. The associated North American Industry Classification System (NAICS) Code is 541690. The small business size standard is $15 million.

This announcement serves to notify offerors that the government contemplates awarding a time-and-material Firm Fixed Price contract resulting from this solicitation for the services defined herein. Prospective offerors are responsible for downloading the solicitation and any amendments. It is offerors’ responsibility to monitor the FedBizOpps website for the release of any amendments to this solicitation

SECTION I - Contract Clauses

FEDERAL ACQUISITION REGULATION (FAR) (48 CFR CHAPTER 1) AND HEALTH AND

HUMAN SERVICES ACQUISITION REGULATION CONTRACT CLAUSES

I.2. FAR 52.212-5 - Contract Terms and Conditions Required to Implement Statutes or

Executive Orders -- Commercial Items (May 2015)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Dec 2014)

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (41 U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

___ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Jul 2013) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

___ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Aug 2013) (31 U.S.C. 6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (May 2012) (section 738 of Division C of Public Law 112-74, section 740 of Division C of Pub. L. 111-117, section 743 of Division D of Pub. L. 111-8, and section 745 of Division D of Pub. L. 110-161).

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C.

657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2011) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved]

X (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

X (ii) Alternate I (Nov 2011).

X (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Oct 2014) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Oct 2001) of 52.219-9.

___ (iii) Alternate II (Oct 2001) of 52.219-9.

___ (iv) Alternate III (Oct 2014) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Nov 2011) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

___ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for Economically Disadvantaged Women-Owned Small Business (EDWOSB) Concerns (Jul 2013) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for Women-Owned Small Business (WOSB) Concerns Eligible Under the WOSB Program (Jul 2013) (15 U.S.C. 637(m)).

___ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

___ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2014) (E.O.

13126).

X (27) 52.222-21, Prohibition of Segregated Facilities (Feb 1999).

___ (28) 52.222-26, Equal Opportunity (Mar 2007) (E.O. 11246).

___ (29) 52.222-35, Equal Opportunity for Veterans (Jul 2014) (38 U.S.C. 4212).

___ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

___ (31) 52.222-37, Employment Reports on Veterans (Jul 2014) (38 U.S.C. 4212).

___ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

X (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Aug 2013). (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514

___ (ii) Alternate I (Jun 2014) of 52.223-13.

___ (37) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

X (38) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C.

8259b).

___ (39) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

___ (40) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

___ (41) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

X (42) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

___ (43) 52.225-5, Trade Agreements (Nov 2013) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

___ (44) 52.225-13, Restrictions on Certain Foreign Purchases (Jun 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (45) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (46) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

___ (47) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (48) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C.

4505), 10 U.S.C. 2307(f)).

___ (49) 52.232-30, Installment Payments for Commercial Items (Oct 1995) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

___ (50) 52.232-33, Payment by Electronic Funds Transfer— System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (51) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (52) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

___ (53) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

___ (54) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67.).

___ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (May 2014) (29 U.S.C.206 and 41 U.S.C.

chapter 67).

___ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495).

___ (8) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792).

___ (9) 52.237-11, Accepting and Dispensing of $1 Coin (Sep 2008) (31 U.S.C. 5112(p)(1)).

___ (10) 52.222-55, Minimum Wages Under Executive Order 13658 Dec 2014)(Executive Order 13658).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c) and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (41 U.S.C.

3509).

(ii) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $650,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(iii) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(iv) 52.222-26, Equal Opportunity (Mar 2007) (E.O. 11246).

(v) 52.222-35, Equal Opportunity for Veterans (Jul 2014) (38 U.S.C. 4212).

(vi) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.

793).

(vii) 52.222-37, Employment Reports on Veterans (Jul 2014) (38 U.S.C. 4212).

(viii) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(ix) 52.222-41, Service Contract Labor Standards (May 2014), (41 U.S.C. chapter 67).

(x) ____ (A) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(xi) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67.)

(xii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67)

(xiii) 52.222-54, Employment Eligibility Verification (Aug 2013).

(xiv) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xvi) 52.247-64, Preference for Privately-Owned U.S. Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2014)(Executive Order 13658).

(2) While not required, the contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of Clause)

SECTION J - List of Attachments

Reference Number

Title

J.1 Wage Determination J.2 508 Assessment Template J.3 Past Performance Questionaire J.4 HHS-OCIO-2008-0001.003 Policy for responding to breaches of PII J.5 Non-Disclosure Agreement (to be provided by successful Offeror) J.6 NDACAN Breach Response Procedure 2016-05-31 J.7 NDACAN Software 6.29.17 J.8 Responses to submitted questions

SECTION L - Instructions, Conditions, and Notices to Offerors or Respondents

L.9 TECHNICAL PROPOSAL INSTRUCTIONS

Technical proposals shall be limited to 35 double-spaced pages, with 1-inch margins, and using not less than 12 point font. Offerors are encouraged to be succinct and economical in their presentation. Excessive volume and elaborate presentation are unnecessary. Tables of contents, and works cited and the Technical Appendices are not included in the page count.

The technical proposal must not contain references to cost; however, resource information, such as data concerning labor hours and categories, materials, subcontracts, etc., must be contained in the technical proposal so that your understanding of the scope of work may be evaluated. It must disclose your technical approach in sufficient detail to provide a clear and concise presentation that includes, but is not limited to, the requirements of the technical proposal instructions. The proposal shall contain a response to each of the factors and subfactors identified in Section M.

The Offeror must provide clear responses, including objectives and outcomes, to each Task addressing the work to be performed in Section C. Proposals which merely offer to conduct a project in accordance with the requirements of the Government's scope of work will not be eligible for award. The technical proposal should reflect a clear understanding of the nature of the work being undertaken.

Technical Appendices:

The technical appendices shall only include transcripts, resumes, and letters of commitment, .

HHS-OCIO-2008-0001.003 Policy for responding to breaches of PII, Non-Disclosure Agreement (to be provided by successful Offeror), and any additional appendices that the offeror deems as necessary for their proposal.

The technical proposal shall address the following factors:

FACTOR 1 – Technical Capabilities

FACTOR 2 –Project Management Plan

FACTOR 3 – Organizational Capacity

FACTOR 4 – Personnel Qualifications and Experience

FACTOR 5 – Understanding of the Issues and Scope of Work

FACTOR 6 - Section 508 Compliance

The offeror must demonstrate their compliance with the applicable Section 508 standards. This includes submitting the completed HHS Section 508 Evaluation Template (Attachment J.2), Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

Attachment J.6

1 ver. 2016-05-31

Breaches of PII: Safeguards and Responses Terminology

Personally identifiable information (PII): Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. (OMB M-07-16, p. 1).

Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic (OMB M-07-16, p. 1).

Sources of PII at NDACAN

Using the NIST 800-122 definitions, we classify the PII confidentiality level of our datasets at the moderate impact level. Moderate impact means "the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals." For example, a breach of data at the moderate level might involve "financial loss due to identity theft or denial of benefits, public humiliation, discrimination, and the potential for blackmail" (NIST 800-122, p. 3-2). The other sources of PII include data related to licensed users and others who submit inquiries to NDACAN or who have asked to be added to our mailing list and we classify these sources as having a low impact level. Low impact means "the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals." Harm resulting from low impact breaches might involve inconveniences, such as changing a telephone number (NIST 800-122, p. 3-2).

Data Source Confidentiality Impact Level

NDACAN Dataset Holdings (AFCARS, NCANDS, NYTD, NSCAW, LONGSCAN, NIS, etc.)

Moderate

NDACAN Business Management Information System (FileMaker, Human Ecology Web Hosting Server)

Low

NDACAN User Support Ticketing System (FreshDesk.com) Low

NDACAN User Feedback Survey (cornell.qualtrics.com) Low

2 ver. 2016-05-31

Safeguards in Place at Cornell University

According to Cornell University Policy 5.10, Information Security, all university information, whether digital or paper, is assigned one of three classifications: Confidential (Level 1), Restricted (Level 2), or Public (Level 3), and rules regarding the treatment of information at each level is specified in policy. In addition, baseline IT security requirements for paper documents, desktop computers, laptops, handheld devices, and file servers are specified.

The Cornell IT Security Office (ITSO) determines the technical procedures that pertain to information security policy and protects the University’s networks from intrusion attempts or other forms of network hacking. The ITSO maintains a number of university-wide vulnerability management solutions including Nessus and AppSpider. They are also available to run additional scans upon request from Human Ecology IT staff.

Within the College of Human Ecology, the Assistant Director for Information Technology, Mary

Miller, serves as the data steward for College resources and is charged with implementing the University’s policies regarding information security.

All members of the NDACAN contract are considered custodians of institutional information and must comply with the rules of Policy 5.10, the baseline standards for information security, and the technical requirements for protecting confidential and restricted information. All NDACAN staff have completed the CITI (Collaborative Institutional Training Initiative) courses related to research ethics and responsible conduct of research and are required to renew their training certification every five years.

NDACAN stores its datasets on servers in the Cornell Central IT NetApp Storage Farm managed by the Cornell University Systems Administration team. The servers are located in two raised-floor machine rooms in Rhodes Hall with redundancy in the Computing and Communications Center. The servers supply networked storage that NDACAN accesses through its office workstations. NDACAN office workstations require a netID for access and run enterprise-level software for the Windows OS and the Symantec security suite. NDACAN stores NSCAW Restricted Data on a dedicated server storage instance to which only select staff have access. All NDACAN data on servers and workstations are backed up nightly with Cornell’s enterprise-level subscription to IBM Tivoli Storage Manager.

NDACAN maintains a 2TB external hard drive with a copy of its holdings inside of a 660lb fireproof file cabinet safe which sits in the NDACAN Associate Director’s office in Beebe Hall. Only select NDACAN staff know the combination to the safe. The NDACAN office building has electronic locks on its two main entrance doors which unlock at 8AM and lock at 4:30PM. All NDACAN staff have keycard access to the building with access monitored by College of Human Ecology facilities services.

Safeguards Related to PII at NDACAN

In addition to the operational safeguards that are enforced across Cornell University, NDACAN staff follow additional procedures to protect the confidentiality of individuals within the NDACAN datasets. In an effort to preserve the research utility of the datasets while ensuring that individuals cannot be identified and that information about them cannot be disclosed, NDACAN has adopted the following layered approach.

NDACAN datasets may never contain high risk primary identifiers, such as names, Social Security

Numbers, email addresses, physical addresses, phone numbers, or biometric identifiers. When contributors submit data to NDACAN, they certify that these kinds of identifiers have been removed.

During processing, NDACAN analysts complete an additional review for primary identifiers as part of

3 ver. 2016-05-31 their disclosure risk assessment, and if any are present, the data are deleted from all copies of the contributed files.

Other variables in datasets may be quasi-identifiers, which are variables that may be used to deduce a person’s identity by linking a data record to other external information. Common quasi-identifiers include dates of birth and geographic detail below the state level. As a result of the disclosure risk assessment, NDACAN may elect to coarsen quasi-identifiers to make deductive disclosure more difficult. Common methods include combining categories within a variable, top-coding outlying values, or constructing summary variables. In some cases, coarsening may not be sufficient and the quasi-identifier will be removed from the distributable dataset entirely.

Overly aggressive coarsening can reduce the research utility of a dataset, so NDACAN provides an additional layer of protection by restricting data access to individuals who have demonstrated their trustworthiness by meeting eligibility requirements and by signing legally-binding licensing agreements.

NDACAN dataset users are academic professionals and are subject to institutional oversight through the IRB at their home institutions. All users of NDACAN data are required to sign either a Terms of Use Agreement or a three-year Restricted Data License. In these agreements, researchers promise to maintain the confidentiality of the data, use the data for legitimate research purposes, refrain from attempting to identify individuals in the data set, restrict access to the data to authorized users, keep the data secure, and follow their institution’s policies and procedures for conducting research.

Restricted Data Licenses, which are used for the NCANDS Child File and NSCAW Restricted

Release datasets, have additional requirements that are subject to NDACAN approval. These include an application describing the intended research purpose, a detailed data protection plan, signed use agreements from all members of the research team who will have access to the data, institutional concurrence by an authorized representative of the researcher’s institution, documentation that the IRB has either approved the project or found it exempt from review, and certification that the data have been destroyed or returned to NDACAN upon completion of the project.

Once the required documents have been submitted and approved, NDACAN transmits its datasets directly to researchers over secure network connections using the cloud-based service Cornell.Box.com.

Box provides multi-layered 256-bit AES encryption for data on its servers and secure high-grade TLS encryption while data are in transit to licensed users. For NSCAW Restricted users, NDACAN uses Cornell’s proprietary secure file transfer portal known as Dropbox.Cornell.edu (not to be confused with Dropbox.com). Cornell’s Dropbox system has additional requirements including an additional password that is not communicated through email and a time-limited window for downloading the data.

Procedures in Response to Intrusion Attempts

The following procedure is in place for reporting security incidents to Cornell IT. These steps are to be followed in case of unauthorized access to restricted or confidential data that are under the care of NDACAN staff. Unauthorized access might come from a successful hack of a Cornell or affiliated network, or from loss of a staff workstation or other device that contains restricted or confidential data.

The full description is available at http://www.it.cornell.edu/cms/security/how.cfm?cat=1&tip=54.

1. Report incidents immediately.

Email security@cornell.edu.

Contact the IT Service Desk.

Contact the NDACAN COR, Valeria Fajardo at valeria.fajardo@acf.hhs.gov.

2. Take steps to protect evidence. See http://www.it.cornell.edu/cms/security/how.cfm?cat=1&tip=53.

4 ver. 2016-05-31

3. Contact the Data Steward. See http://www.it.cornell.edu/cms/security/how.cfm?cat=6&tip=38.

4. Provide incident details to the ITSO.

The nature of the incident. Was a system or application compromised? If so, how?

When did the incident occur, and when was it discovered?

How was the incident discovered?

What is the scope of the incident? How many systems are affected? How many users have been affected?

Was there any sensitive data (confidential, regulated, etc.) on the affected systems or was any accessed during the time of compromise? See http://www.it.cornell.edu/security/how.cfm?cat=1&tip=44.

All available, relevant logs (include logs on the affected system, as well as firewall, domain, and IDS logs).

All applications that reside on this system (include databases, servers, and user applications).

Where the most recent backup resides, how often the system was backed up, and when it was last backed up.

Who should have access to the system, when they should be accessing it, how they should be accessing it (console, VPN, etc.), and what data they should be accessing.

5. Coordinate additional response with the Cornell IT Security Office.

Depending on the nature of the incident, it may be necessary for the IT Security Office to perform analysis on the affected systems. Local support providers may be asked to participate in this analysis. This could include assistance with the creation of disk images of the affected resources, confirmation of system configuration and activity, and validation of any remediation tasks.

6. Follow guidelines to recover from the system compromise. See http://www.it.cornell.edu/security/how.cfm?cat=6&tip=55.

Response to Data Licensing Violations

When researchers sign the licensing agreements to obtain NDACAN datasets, they are made aware of the possible consequences if they violate the terms of the agreement. If NDACAN believes that a researcher has violated the license, NDACAN will submit its allegations in writing to the researcher and give the researcher 10 days to prepare a written response. If NDACAN does not accept the explanation, the following sanctions are outlined in the licensing agreement:

Revoke the license, demand return of the data, and deny all future access to NDACAN data.

Report the violation to the researcher’s institution with a request for an investigation.

Report the violation to the researcher’s funding agencies, if any, with a request for an investigation.

Report the case to the Federal Office for Human Research Protections, which may result in an investigation of the researcher’s institution.

Pursue other remedies available under applicable state and federal law.

Related Resources

Cornell University Policy 5.10, Information Security NIST Special Publication 800-122, Guide to Protecting the Confidentiality of Personally

Identifiable Information (PII) OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally

Identifiable Information OMB Memorandum M-14-06, Guidance for Providing and Using Administrative Data for

Statistical Purposes

Attachment J.7

Software Usage Renewal Type

SPSS

process datasets; format distributable files

Annual Subscription

SAS

process datasets; format distributable files

Annual Subscription

STATA/SE 15

Serial # process datasets; format distributable files

None

STAT/TRANSFER

13 process datasets; create various output formats

None

CommonLook Office GlobalAccess create 508 compliant accessible Word and PDF documents

Maintenance

CommonLook

PDF

GlobalAccess remediate PDF documents for 508 compliance

Maintenance

FileMaker Pro 12 (8 licenses total) database for client mailing list, data orders, and licenses

None

WinZip 14.5 compress datasets for distribution None

TextPad edit HTML None

WinZip Self‐ Extractor 4.0 compress datasets for distribution

None

UltraEdit‐32 edit HTML and other text files None

EditPad Pro clean data files and edit HTML None

RegexBuddy process data files None

Camtasia 9 record and edit videos None

SnagIt v. 13 capture screen shots and record videos None

ArcGIS Advanced Desktop GIS mapping

Annual Subscription

Freshdesk client support portal to track and fill external requests sent to NDACAN@CORNELL.EDU and

NDACANSUPPORT@CORNELL.EDU

Monthly Subscription

Adobe Dreamweaver

Website administration, HTML editing

Cornell Institutional Subscription

MS Outlook, Word, Access, Excel, Powerpoint email, word processing, database front‐end for SQL Server, spreadsheets, slide presentations

Cornell Institutional Subscription

MS SQL Server 2012 contains databases of datasets like NCANDS Child File; also dynamically serves metadata to the website

Cornell Institutional Subscription

Coldfusion Web application server which queries the MS SQL server tables and serves content to the Web site; runs other applications like web forms

Cornell Institutional Subscription

RFP Section RFP Page Number

Question Answers

L10.2 77 Can you clarify the time period, or other assumptions, upon which these labor hours were determined. If it covers the base year and 4 option years, none of the positions listed would be full-time for the entire contract period.

The determination of labor hours in the Independent Government Cost Estimate (IGCE) was based upon the current contract. The labor hours provided within the soliciatation covers a time period of one fiscal year.

L10.2 77

The bidding assumptions include a line for SRI participant costs. Also, the description under Subtask 3.1. does not specify whether this institute is required to be delivered as an online event, as it was in the 2015 contract language. Participant costs would only be included if the SRI was run as an in- person event. Is the intent that the SRI can be run as either an in-person or as an online event, at the discretion of the contractor? Or is one method of delivery being required?

The SRI will be required to be delivered as an online event.

L.9 76 The statement on page 76 “The technical appendices should only include transcripts, resumes, and letters of commitment” omits the list of attachments on page 52. Please clarify what appendices should be included in Volumes I, 2, and 3 (e.g. the 508 template). Can additional appendices be included that are not explicitly referenced in the solicitation?

The attachements in section J are appropriate appendices to be included in Volume I Technical Proposals, and any additional appendices that may enhance the offerors proposal is acceptable. Please reference amendment 000001 solicitation.

B.5 (1 - 2)

1. On page 1, the RFP states “the government contemplates awarding a time-and-material contract”. Page 2, section B.5 indicates a fixed price type contract. Can you please clarify if the government intends to issue a Fixed Price or Time & Material contract?

The government comtemplates awarding a firm fixed price contract the reference to a Time and Material was done so in error. Please reference amendment 000001 solcitiation for corrections

A.1 1

Page 1 of the RFP indicates, “This solicitation is issued as unrestricted” but also makes reference to the “small business size standard.” Can you please clarify whether this is an open solicitation to PSC members, or whether it is restricted to small businesses?

The mention of the NAICS code is for refernce only this requirement is fully unrestricted and is not a Small Business Set aside.

M.5 84

The RFP states that, “Respondent must demonstrate that it has adequate facilities to carry out all objectives in the

SOW.” Given this requirement, is it allowable for the contractor to purchase and utilize services for the Data Archive under this contract from a FedRAMP Compliant Cloud Service Provider (CSP)?

The Contractor is responsible for protecting the integrity, confidentiality and availability of federal information and information systems as listed clauses within the solicitation. Respondents may propose alternative approaches in addition to addressing the tasks as proposed by the government; justification for alternatives (e.g., cost efficiency, etc.) must be provided with any alternatives proposed.

Respondents are expected to draw on their own expertise to propose the most effective approach to addressing the tasks.

M.5 82 – 84 Are all factors equally weighted in the evaluation of the technical proposal? If not, how will they be weighted?

The Government will evaluate the Technical Proposal using the color coded ratings defined within the solicitation (page 84). Each factor will receive one of the color coded ratings, and then there will be an overall color coded rating for the proposal.

The factors are rated in ascending order:

a. Technical Approach

b. Understanding the Issues and Scope of Work

c. Project Management Plan

d. Organizational Capacity

e. Personnel Qualifications and Experience

C.2.1: Subtask 3.5 14 Who is on the current advisory board? When do current members’ terms expire?

Desmond Runyan (Colorado) Emily Putnam-Hornstein (USC) Bill Block (Cornell) Christopher Wildeman (Cornell) John Eckenrode (Cornell) The board was formed in February of 2016. Members serve three-year terms. Terms will expire February of 2019.

C.2.1: Subtask 1.3 7

What software does the existing Data Archive use? This question is in relation to the requirement in the task stating:

“Per the Rights in Data Clause (FAR Clause 52.227 ‐ 17), the Contractor shall provide all software, databases, interfaces, and data under a no ‐cost, no strings license to another party, in the case this contract is terminated.”

Please see attachment J.7 in amendment 000001 solicitation

C.2.1: Task 2.3 11 May we see a copy of the current data security plan for The National Data Archive on Child Abuse and Neglect

(NDACAN) ?

Please see attachment J.6 in amendment 000001 solcitation

Solicitation No. 17-233-SOL-00536

SUBMITTED QUESTIONS AND HHS RESPONSES

June 30th, 2017

Attachment J.8

C.2.1.: Subtask 3.1 12

Is the Summer Research Institute (SRI) expected to be held in‐person rather than via distance learning? How many participants should the contractor plan for? Can the government provide details about expected costs associated with the summer research institute participants (e.g., should the contractor budget for participants’ travel and per diem expenses to attend the SRI? How many days is the SRI expected to last?)

The SRI will be required to be delivered as an online event. Respondents may propose alternative approaches in addition to addressing the tasks as proposed by the government; justification for alternatives (e.g., cost efficiency, etc.) must be provided with any alternatives proposed. Respondents are expected to draw on their own expertise to propose the most effective approach to addressing the tasks.

C.2.1: Subtask 3.2 13 Should we budget for exactly 12 presentations/workshops annually at professional conferences?

Respondents may propose alternative approaches in addition to addressing the tasks as proposed by the government; justification for alternatives (e.g., cost efficiency, etc.) must be provided with any alternatives proposed. Respondents are expected to draw on their own expertise to propose the most effective approach to addressing the tasks.

I.2 43 The Notice of Total Small Business [Set‐]Aside clauses are selected. Should those be removed The Notice of Total Small Business set-aside clause was seected in error please see section I.2 in amendment 000001 solicitation.

C.2.1.: Subtask 3.3 13 Can the government provide an expected level of annual effort, given historical experience, regarding the, “free, ongoing technical assistance to NDACAN data users” (Subtask 3.3, service component 1)?

Based upon historical experience the National Data Archive on Child Abuse and Neglect provides free, ongoing techinal assitance to an estimate of 100 requests per fiscal year. An expected level of annual effort cannot be provided. Respondents may propose alternative approaches in addition to addressing the tasks as proposed by the government; justification for alternatives (e.g., cost efficiency, etc.) must be provided with any alternatives proposed. Respondents are expected to draw on their own expertise to propose the most effective approach to addressing the tasks.