RFP_18-223-SOL-00017.pdf

Table of Contents

1. PRICING SCHEDULE

a. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

b. MINIMUM/MAXIMUM CONTRACT AMOUNT

c. CONTRACT TYPE: INDEFINITE DELIVERY / INDEFINITE QUANTITY (ID/IQ) CONTRACT

d. PRICING TERMS

e. DISCOUNTS

2. DELIVERIES OR PERFORMANCE

a. ORDERING PERIOD

b. PERIOD OF PERFORMANCE FOR TASK ORDERS

c. PLACE OF PERFORMANCE

d. PERSONNEL

e. NOTICE TO THE GOVERNMENT OF DELAYS

f. DELIVERABLES

g. CONTRACT MANAGEMENT

h. IDIQ CONTRACTING OFFICER’S REPRESENTATIVE (COR)

i. TASK ORDER AND DELIVERY ORDER COR

j. TECHNICAL DIRECTION

k. NOTIFICATION REGARDING ADMINISTRATIVE PROBLEMS

l. CONTRACTOR CLOSEOUT RESPONSIBILITIES

m. ORDERING

n. PROPOSAL PREPARATION COSTS

o. TRAVEL

p. OTHER DIRECT COSTS

q. MATERIAL HANDLING FEE

r. GOVERNMENT FURNISHED EQUIPMENT/GOVERNMENT FURNISHED INFORMATION

s. IT CONSTRAINTS

t. SECTION 508 COMPLIANCE STANDARDS

u. SECURITY AND CONFIDENTIAL TREATMENT OF SENSITIVE INFORMATION

v. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

w. ORGANIZATIONAL CONFLICT OF INTEREST

x. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

y. DO NOT COMPETE

z. NON-PERSONAL SERVICES

aa. NONCOMMERCIAL COMPUTER SOFTWARE RIGHTS DEFINITIONS

bb. SUBCONTRACTING RESPONSIBILITIES

cc. SUBCONTRACTING GOALS

3. PROVISIONS AND CLAUSES

a. CLAUSES INCORPORATED BY REFERENCE

b. CLAUSES INCORPORATED BY FULL TEXT

c. PROVISIONS INCORPORATED BY REFERENCE

d. PROVISIONS INCORPORATED IN FULL TEXT

4. SUBMISSION INSTRUCTIONS AND DEADLINES

a. GENERAL INSTRUCTIONS FOR THE PREPARATION OF THE TECHNICAL PROPOSAL AND BUSINESS

PROPOSAL

b. ORGANIZATION OF TECHNICAL VOLUME

c. INSTRUCTIONS FOR TECHNICAL PROPOSAL (VOLUME I)

d. ORGANIZATION OF THE BUSINESS VOLUME

e. INSTRUCTIONS FOR BUSINESS PROPOSAL (VOLUME II)

f. BASIS FOR AWARD

g. ATTACHMENTS

1. PRICING SCHEDULE

a. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES The objective of this contract is to continue the efforts to modernize and enhance the IT capabilities of Office of Regulatory Affairs (ORA) while maintaining a reliable, stable and secure operating environment aligned with the Department of Health and Human Services (HHS) and Food and Drug Administration (FDA) Enterprise Performance Life Cycle (EPLC) processes with the goal of driving down developmental and operating costs. The contracted effort will include both development, modernization, and enhancement (DME) and software applications operations and maintenance (O&M) for the ORA Criminal Investigations, Imports, and Systems for Inspection, Recalls Compliance, and Enforcement (SIRCE) investments. Overall objectives include:

• Achieving a high level of user satisfaction with ORA IT solutions.

• Providing reliable IT solutions that enable ORA to meet business needs.

• Deployment of high-quality code that accurately meets the requirements.

• Successful releases without introduction of unexpected problems.

• Minimal need for emergency/corrective maintenance.

• Minimal need to fix the same issue multiple times.

• Maximum value out of limited IT budget resources.

b. MINIMUM/MAXIMUM CONTRACT AMOUNT

The guaranteed minimum amount under this contract will be satisfied by either 1) the award of any singular task order contained in this solicitation or 2) the obligation of funds in the amount of $5,000. The maximum contract amount is $400,000,000.00 for the life of the contract. If the Government’s requirements for services set forth in the solicitation do not result in task orders in the amount described as the “maximum,” it shall not constitute the basis for an equitable adjustment under this contract.

c. CONTRACT TYPE: INDEFINITE DELIVERY / INDEFINITE QUANTITY

(ID/IQ) CONTRACT

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) contract per FAR subpart 16.5 for Commercial Items per FAR Part 12. This solicitation is competed under FAR Part 15.

At the discretion of the Contracting Officer, the Government may use a variety of contract types under this contract for each task order including: Firm Fixed Price (FFP), Time and Materials (T&M), Labor Hour, or a combination thereof. Incentives and disincentives may be included in individual task orders as negotiated between the Government and the Contractor.

Each Request For Task Order Proposal (RFTOP) issued under this contract will identify the Government’s determination of task order type.

Specific requirements tailored to meet a particular need will be included in each RFTOP, including specific deliverables and schedules for the deliverables. Each RFTOP shall include the specific Center requirements and performance standards and may include a quality assurance plan. The period of performance of each task order will be established upon the issuance the order. Deliverables are to be determined upon the issuance of each task order.

d. PRICING TERMS The labor rates shall be fixed for the duration of this contract and shall be derived from the IDIQ pricing schedule. The effective labor rate at the time of award of an individual task order shall be effective for the duration of the task order period of performance. If a task order’s stated period of performance must be extended as a result of a Government delay, the Contractor may request that the most current labor rates be used to price the work effort during the extended period. However, in no event shall the Contractor perform, or be paid for any work which exceeds the not-to-exceed dollar amount of a task order. The task order pricing schedule will be developed based on pricing contained in Attachment 6: Pricing Worksheet, regardless of the task order contract type. The labor rates in the IDIQ pricing schedule are fully burdened, inclusive of all direct costs, indirect costs, and profit.

Each Time and Material or Labor Hour task order shall contain a ceiling price. The Contractor shall comply with FAR 52.212-4(ALT I) in regards to the ceiling price for the individual task order(s).

e. DISCOUNTS The contractor is encouraged to offer any and all discounts for goods and services provided under future task orders. The type or amount of discount may vary based on the circumstances of each particular task order.

2. DELIVERIES OR PERFORMANCE

a. ORDERING PERIOD The ordering period is 7 (seven) years from the effective date of award.

b. PERIOD OF PERFORMANCE FOR TASK ORDERS Period of Performance for task orders will be as specified in individual task orders. Two constraints apply to the period of performance for task orders. First, individual task orders may not exceed 5 years (inclusive of option periods). Second, individual task orders may not extend greater than one year beyond the end date of the IDIQ Ordering Period.

c. PLACE OF PERFORMANCE The contractor will be required to work at the contractor’s location as required in individual task orders. Location information will be specified in each task order. In general, most FDA Centers and Offices operate predominantly in the Washington, DC Metropolitan area with concentrations in the FDA's Maryland locations of Bethesda, College Park, Laurel, Rockville, and White Oak. National Center for Toxicological Research (NCTR) operates from its headquarters in Jefferson, Arkansas. The Contractor must be available to attend in person meetings at FDA sites mainly in the Rockville, MD and White Oak area.

d. PERSONNEL

The Contractor shall ensure that all Contractor support personnel are adequately trained, possess the credentials specified in the appropriate labor categories, and are otherwise fully qualified to provide the high level of support required by this SOW prior to being assigned to task orders awarded. Additionally, the Contractor shall fulfill the requirements of HHSAR 352.237-75 Key Personnel for all Contractor support personnel positions designated as Key Personnel in individual task orders.

e. NOTICE TO THE GOVERNMENT OF DELAYS In the event the Contractor encounters difficulty in meeting performance requirements, or when the Contractor anticipates difficulty in complying with the contract delivery schedule or completion date, or whenever the Contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the Contractor shall immediately notify the Contracting Officer and COR in writing, giving pertinent details.

This data shall be informational only in character and this provision shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this contract.

f. DELIVERABLES Deliverables shall be specified in the task orders released under this contract. Deliverable products shall be validated and tested to ensure that they meet applicable/specified standards, policy, business requirements and quality measures.

g. CONTRACT MANAGEMENT Notwithstanding the Contractor’s responsibility for total management during the performance of this contract, the administration of the contract will require maximum coordination between the Government and the Contractor.

Communications pertaining to the contract administration will be addressed to the Contracting Officer. No changes to the statement of work are authorized without a written modification to the contract executed by the Contracting Officer.

The Contractor is advised that only the Contracting Officer can change or modify the contract terms or take any other action, which obligates the Government. Such action must be set forth in a formal written modification to the contract.

Contractors who rely on direction from other than the Contracting Officer do so at their own risk and expense. Such actions do not bind the Government contractually and shall be reported to the Contracting Officer immediately. Any contractual questions shall be directed to the Contracting Officer or Contract Specialist. Individual task orders may include the option to issue Technical Direction Letters from the Contracting Officer’s Representative (COR).

h. IDIQ CONTRACTING OFFICER’S REPRESENTATIVE (COR) The Contracting Officer may designate a Contracting Officer’s Representative to act as his or her authorized representative for contract administration functions which do not involve changes to the scope, price, schedule, or terms and conditions of the contract. The designation will be in writing, signed by the Contracting Officer, and will set forth the authorities and limitations of the representative(s) under the contract. Such designation will not contain authority to sign contractual documents, order contract changes, modify contract terms, or create any commitment or liability on the part of the Government different from that set forth in the contract.

The Contractor shall immediately contact the Contracting Officer if there is any question regarding the authority of an individual to act on behalf of the Contracting Officer under this contract.

i. TASK ORDER AND DELIVERY ORDER COR For each Order, a COR will be assigned. The COR shall serve as the Contractor’s first point of contact for any technical questions and is responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) interpreting the statement of work and any other technical performance requirements; (3)performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; (5) assisting in the resolution of technical problems encountered during performance; and (6) providing technical direction in accordance with section 2.J; and, (7) reviewing of invoices/vouchers.

The Government may unilaterally change its COR designation.

Technical Leads may assist the COR. The Technical Leads will not have the authority to provide technical direction; however, they may be responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) performing technical evaluation as required; (3) performing technical inspections and acceptances as required by this performance;

and (5) reviewing of invoices/vouchers.

j. TECHNICAL DIRECTION Performance of the work under task order shall be subject to the technical direction of the Task Order COR. The term “technical direction” is defined to include, without limitation, the following:

Directions to the Contractor which redirect the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual statement of work.

Provision of information to the Contractor which assists in the interpretation of drawings, specifications, or technical portions of the work descriptions.

Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the Contractor to the Government under the contract.

Technical direction must be within the general scope of work stated in the contract. The COR does not have the authority to and may not issue any technical direction which:

Constitutes an assignment of additional work outside the general scope of work of the contract.

Constitutes a change as defined in the applicable contract clause entitled FAR

52.212-4(c) Contract Terms and Conditions – Commercial Items.

In any manner cause an increase or decrease in the total estimated contract cost, fixed-fee, or the time required for contract performance.

Change any of the expressed terms, conditions, or specifications of the contract.

All technical direction shall be issued in writing by the IDIQ or Task Order COR or shall be confirmed by him/her in writing within 5 working days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR in the manner prescribed by this article and within his/her authority under the provisions of this article.

If, in the opinion of the Contractor, any instructions or direction issued by the COR is within one of the categories described above, the Contractor shall not proceed but shall notify the Contracting Officer in writing within 5 working days after the receipt of any such instructions or direction and shall request the Contracting Officer to modify the task order, accordingly.

Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of this contract. The Contractor shall proceed immediately with the instructions or directions and shall be subject to the “Disputes” clause within FAR 52.212-4(d) “Contract Terms and Conditions – Commercial Items”.

k. NOTIFICATION REGARDING ADMINISTRATIVE PROBLEMS

If at any time during the performance of this contract, administrative problems should arise which will have an adverse impact on the timely performance by the Contractor or affect the contract costs or funding, the Contractor is required to immediately notify the Contracting Officer.

l. CONTRACTOR CLOSEOUT RESPONSIBILITIES

The Contractor shall provide all management, administrative, clerical, and supervisory functions required for the effective and efficient performance of this contract. A smooth and orderly transition between the Contractor and a predecessor or successor Contractor is necessary to ensure minimum disruption to vital Government business. The Contractor shall cooperate fully in the transition.

The Contractor shall adhere to the same professional and ethical standards of conduct required of Government personnel. The Contractor shall NOT:

• Discuss with unauthorized persons any information obtained in the performance of work under this contract;

• Conduct business not directly related to this contract on Government premises;

• Use computer systems and/or other Government facilities for company or personal business other than the performance of work authorized under an active task order;

or

• Recruit on Government premises or otherwise act to disrupt official Government business.

It is the Government’s intention to perform closeout procedures on an individual task order basis as well as for the SIRCE and Imports IDIQ Contract. The Contractor agrees to perform those internal functions necessary to support this process in a timely manner. The task order closeout will occur as soon as possible after the payment of the final invoice.

m. ORDERING

The government intends to issue task/delivery orders for one or more projects during the period of performance. When a need for services/goods within scope of this contract arises, a FDA Contracting Officer will issue a Request for Task Order Proposal (RFTOP). The process for awarding orders will be as follows

1. FDA’s Office of Acquisitions & Grants Services Contracting Officer will issue an RFTOP via email. The RFTOP will include, at a minimum, a SOW/PWS/SOO, the period of performance, the anticipated order type (LH, T&M or FFP), reporting requirements and deliverables, and any special terms and conditions applicable to the Task Order.

2. Within ten (10) business days (unless another time frame is specified in writing) the contractor will provide a proposal to the Contracting Officer. The requested information for each RFTOP will vary depending on the nature of the requirement and the timeline for award.

3. Generally, FDA will evaluate the task order proposal for technical acceptability and price reasonableness. If the FDA has questions or concerns, the Contracting Officer will contact the offeror and may ask for a revised proposal.

4. Once FDA has reached an award determination, the Contracting Office will issue the task order.

5. Orders will be issued using an OF347 or a SF1449 and will include the following:

• Task Order Number

• Date

• Accounting Information

• SOW

• Price/Ceiling

• Period of Performance

• Any terms, conditions, or instructions unique to the order.

Any work that the Contractor undertakes prior to receiving a fully executed order signed by the Contracting Officer is undertaken at the contractor’s own risk.

n. PROPOSAL PREPARATION COSTS

The costs for preparation of task order proposals shall be the responsibility of the Contractor and not reimbursable.

o. TRAVEL Any required travel by the Contractor will be at the direction of the Government and will be reimbursed at cost (except Firm Fixed Price task orders) in accordance with the Federal Travel Regulations (FTR). Please note local travel will not be reimbursed.

p. OTHER DIRECT COSTS Other Direct Costs (ODC) may be authorized by the applicable COR if 1) the ODC is valued in an amount less than the micropurchase threshold, 2) funds are available for this purpose under the task order, and 3) the items are within the scope of the task order. All ODCs valued in an amount equal to or greater than the micropurchase threshold must be pre-approved by the Contracting Officer. Direct costs that have been specifically approved and funded as part of an awarded task order are not subject to these approval procedures.

To be eligible to receive reimbursement for ODC, the Contractor must obtain at least three quotes for each transaction equal to or greater than the micropurchase threshold to ensure that adequate price competition was sought. Alternatively, the Contractor must provide an acceptable justification as to why it was impracticable or impossible to seek price competition. For purchases of ODC, the Contractor shall provide the aforementioned documentation with every ODC purchase request to the Contracting Officer.

The Contracting Officer will approve the purchase of ODCs via the issuance of an authorization letter. The approval letter shall be submitted with the invoice as supporting documentation. Likewise, for ODC purchases under the micropurchase threshold, the COR will provide authorization to purchase via email, and the Contractor shall include a copy of the email with the invoice as supporting documentation.

The Contractor shall maintain documentation of all reimbursable purchase until three years after the contract is completed and shall provide access to and copies of such documentation when requested by the Contracting Officer.

The Contracting Officer may reduce the reimbursement by any amount above that which the Contracting Officer funds, in his / her sole discretion, is greater than that which is fair and reasonable for the ODC giving due consideration to the facts and circumstances prevailing at the time that the Contractor procured the ODC. Disputes as to the amount by which any reimbursement is reduced shall be resolved in accordance with the “Disputes” clause of the contract. It shall be the Contractor’s burden to demonstrate that the price it paid for the reimbursable items was fair and reasonable.

q. MATERIAL HANDLING FEE Reimbursement for material handling fee shall be allowed on material expenses (excludes travel expenses) on task orders issued under this contract at a fixed rate of _TBD. The fixed rate for material handling is fixed at the time of award and is not subject to adjustment based on actual final indirect rates as determined by a contractor’s cognizant audit agency. The establishment of a fixed material handling fee will facilitate the more-timely closeout of task orders, which will not be dependent upon receipt of final audited indirect rates or the additional documentation requirements of quick close-out procedures. Contractors cannot include profit in their Material Handling Fee.

r. GOVERNMENT FURNISHED EQUIPMENT/GOVERNMENT FURNISHED

INFORMATION

Each task order will identify Government Furnished Equipment and Government Furnished Information.

The Contractor will be provided with documented standards, policies, and FDA EPLC templates. Additionally, FDA will provide updates to artifacts (standards, document templates, and processes) as they become available. As the FDA EPLC artifacts are modified, the contractor shall use the most current artifacts in all subsequent development activities.

s. IT CONSTRAINTS General IT Life Cycle Support All software O&M and DME activities will be, at a minimum, in accordance with FDA’s EPLC policies, processes, and templates found in IDIQ SOW Appendix H - EPLC Artifacts. The activities will follow either Waterfall or Agile or a hybrid of both methodologies based on the scope of work identified in individual task orders. The Government will provide updates to artifacts (standards, document templates, and processes) as they become available. As the EPLC artifacts are modified, the Contractor shall use the modified artifacts in all subsequent development activities. All software shall be developed in accordance with software engineering industry best practices, including the use of waterfall and agile methodologies. All software developed shall maintain existing database integrity, error handling, and graceful termination of execution for unexpected problems and not adversely impact other applications running in the production environment.

Stage Gate Review (SGR) Support SGRs are FDA’s release review and approval process, which focuses on the review and approval of the EPLC documents created or modified per the Project Process Agreement (PPA) for the release. The Contractor shall provide the Government with the technical support to create or modify documents per the PPA. The Contractor shall be available to attend the SGR upon notification of the COR.

Puppet Auto-Deployment The Contractor shall use Puppet auto-deployment process (a software upgrade release system already in production at FDA) to deploy all releases, after the first initial implementation, including: maintenance, enhancement and emergency releases, for Pre-Production and Production environments, where available. The Contractor shall provide Self Service Automated Application Deployments in Test environment. The Application Deployment Artifacts shall be tested in the Test environment and then provided to FDA IT Server administrators for both WODC & ADC that will auto install these upgrades/releases in (Pre- Prod/Prod).

Security Requirements The Contractor shall:

a. Comply with the Federal Information Security Management Act (FISMA) 2002.

Information technology systems that will be used to process, store, or transmit federal information in support of this contract shall be segmented from Contractor’s Corporate Network and adhere to the National Institute of Standards and Technology (NIST) Special Publication (SP) 800 Series and associated Federal Information Processing Standard Publications (FIPSPUB) standards that meet security control baselines supporting data in accordance with FIPS 199. All systems that are operated in support of this contract shall undergo a security assessment and achieve a security authorization to operate by the FDA’s Authorizing Official (AO) prior to processing, storing, or transmitting federal information. The Contractor shall cooperate and provide FDA access to, and information, regarding the Contractor’s systems in conjunction with FDA’s efforts to ensure compliance with all federal and departmental security requirements.

b. Establish a continuous monitoring capability in accordance with NIST SP 800-137.

c. Maintain an accurate inventory of all devices used in the performance of the contract.

d. Use the FDA recommended templates of security artifacts that shall be used with the development or maintenance of any IT system. The following deliverables shall be submitted at least annually or upon significant change to the system and the details contained in the documents must be of the actual environment as built:

i. Security Categorization Form (SCF) to be completed with support from the Business Owner/ISSO

ii. Privacy Impact Assessment (PIA) Form, which is signed off by the FDA Director of Privacy

iii. E-Authentication Form

iv. System Security Plan (SSP)

v. Information System Contingency Plan (ISCP), to include the relevant parts specific to the system being developed/maintained.

vi. ISCP Annual Exercise/Test

vii. Plan of Action and Milestones

e. Review all identified and applicable weaknesses within the Plan of Action and Milestones and provide a resolution within the required timeline. The weakness resolution will include the proposed solution, a project schedule to include the resources required, and the submittal of an artifact to validate the weakness has been remediated.

f. Employees with access to data will be required to undergo a Level 5 Public Trust security clearance, including finger printing, performed under the auspices of the FDA Security Office.

g. Due to the sensitive nature of the information involved, all contractor personnel shall be required to sign a non-disclosure agreement before data and information otherwise exempt from public disclosure (e.g. Privacy Act or Data Collected Under an assurance of Confidentiality) that may be disclosed to them. Each contractor/sub-contractor employee who may have access to non-public Department information under this task order shall complete and submit the FDA Form 3398 (RFP Attachment No. 7): Contractor’s Commitment to Protect Non-Public Information (NPI) Agreement available upon request from the FDA Intranet site. A copy of each signed and witnessed Non- Disclosure agreement shall be submitted to the COR or designee prior to performing any work under the contract. The COR or designee will inform the contractor of any additional forms and training that are required (if any).

h. Contractor-owned laptops or other media storage devices to process or store data in the performance of this contract are prohibited, unless authorized by the Contracting Officer (CO). Contractors must use FDA issued laptops and workstations to perform any FDA related activities.

HHS OCIO Standard 2009-0001.001S The Contractor shall be responsible for the following security requirements that are in accordance with HHS OCIO Standard 2009-0001.001S:

1. Contractor computers containing FDA data shall be configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/index.cfm),

(iii) and shall have and maintain the latest operating system patch level and anti-virus software level;

2. The Contractor shall apply “approved security configurations” to information technology that is used to process information on behalf of the FDA. Such “approved security configurations” shall be identified jointly by the FDA Contracting Officer’s Representative (COR) and Chief Information Security Officer (CISO). Approved security configurations by the National Institute of Standards and Technology (NIST) at http://checklist.nist.gov/;

3. The Contractor shall ensure applications operated on behalf of the FDA are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

(i) The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings. (ii) The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology (IT) products meet the latest FDCC major version and subsequent major versions.

4. The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges;

5. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above;

6. The Contractor shall ensure all its subcontractors which perform work under this contract (at all tiers) comply with the above requirements.

7. This meets the self-assertion requirement under OMB M-08-22. Future FDCC changes having minimal security impact may be released as minor versions to FDCC.

Self-assertion is not required for minor releases.

8. See http://web.nvd.nist.gov/view/ncp/repository, as required by the Office of http://nvd.nist.gov/fdcc/index.cfm) http://checklist.nist.gov/%3B http://web.nvd.nist.gov/view/ncp/repository

Management and Budget (OMB) Memorandum (M) 08-22, Guidance on the Federal Desktop Core Configuration (FDCC), released August 11, 2008.

9. FDCC is applicable to all computing systems using Windows XP™, Windows7, Windows Vista™ and Windows 10, including desktops and laptops—regardless of function—but not including servers. The Department of Health and Human Services (HHS) has developed an HHS version of FDCC (henceforth HHS FDCC) for Windows XP™, Windows7, Vista™, and Windows 10 to accommodate business and operational needs in the HHS environment. These settings are available at http://www.hhs.gov/ocio/securityprivacy/.

10. When there is a compelling business or operational need to deviate from the FDCC, FDA may use the HHS FDCC settings instead of the government-wide FDCC settings.

t. SECTION 508 COMPLIANCE STANDARDS

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards.

This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA http://www.hhs.gov/ocio/securityprivacy/ http://www.hhs.gov/ocio/securityprivacy/ approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Section 508 Standards apply to this acquisition:

• E101.2 Equivalent Facilitation

• E203 Access to Functionality

• E204 Functional Performance Criteria

• E205 Electronic Content

• E207 Software

• E302 Functional Performance Criteria

All electronic and information technology (EIT) must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at:

http://www.section508.gov/summary-section508-standards.

All deliverables must meet HHS 508 compliance formatting based on the criteria available on HHS’s Making Files Accessible web page:

http://www.hhs.gov/web/508/accessiblefiles/index.html.

u. SECURITY AND CONFIDENTIAL TREATMENT OF SENSITIVE

INFORMATION

x.1 SECURITY REQUIREMENTS

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

http://www.section508.gov/summary-section508-standards http://www.hhs.gov/web/508/accessiblefiles/index.html

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ ] Moderate [X] High Integrity: [ ] Low [ ] Moderate [X] High Availability: [ ] Low [ ] Moderate [X] High Overall Risk Level: [ ] Low [ ] Moderate [X] High

Note that the ORA systems are managed within several security “boundaries”, and thus different Risk Levels may be assigned to different systems. The assessment above is for the highest risk systems.

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

Note that some, but not all, ORA systems contain PII.

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [X] High Note that the PII Confidentiality Impact level may vary between ORA systems.

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

• marked appropriately;

• disclosed to authorized personnel on a Need-To-Know basis;

• protected in accordance with NIST SP 800-53, Security and Privacy

Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

• returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer- Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06- 16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b.18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate. See Table 1 – Security/Privacy Deliverables.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b.Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d.Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA). The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b.The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The…