FBO_Combined_synopsis-solicitation.doc

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR 12.6 as supplemented with FAR 13 and additional information included in this notice. The incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2005-101.

THIS ANNOUNCEMENT CONSTITUTES THE ONLY SOLICITATION AND A SEPARATE SOLICITATION SHALL NOT BE ISSUED. The solicitation number for this acquisition is 18-223-SOL-00062 and is being issued as a Request for Quote (RFQ). The NAICS Code for this solicitation is 541519 and the Small Business Size Standard is $27.5 million. This shall be awarded as Fixed Price and 100% Total Small Business Set-Aside. Prospective Offerors are responsible for downloading the solicitation and any amendments from FedBizOpps (FBO). The Government reserves the right to award an order without discussions if the Contracting Officer determines that the initial offer is providing best value and discussions are not necessary.

The U. S. Food and Drug Administration (FDA) has a need for the procurement of internet monitoring services of FDA regulated products.

The FDA anticipates awarding a fixed price award for this effort.

A. BACKGROUND AND OVERVIEW:

FDA is responsible for regulating products to ensure the safety of foods, prescription and over-the-counter drugs, biological products such as vaccines and blood, medical devices, cosmetics, radiation-emitting products, and more. Since 1993, Office of Criminal Investigation (OCI) has investigated thousands of criminal schemes involving the distribution of potentially dangerous FDA-regulated products. These investigations have involved a wide variety of criminal conduct, including street level distribution of counterfeit, unapproved, and designer drugs, major organized illicit diversion of prescription drugs, fraudulent schemes involving ineffective AIDS, cancer, and Alzheimer cures, large scale product substitution conspiracies, application and clinical investigator fraud, and health frauds involving harmful FDA-regulated drugs and medical devices. As FDA’s criminal law enforcement arm, OCI protects the American public by conducting criminal investigations of illegal activities involving FDA-regulated products, arresting those responsible, and bringing them before the Department of Justice for prosecution.

The FDA requires Contractor support services to further its on-going efforts to counter the widespread illicit trafficking and/or marketing of FDA-regulated products over the Internet. These products include: prescription drugs; dietary supplements; tobacco; medical devices; blood and biologics; vaccines; cosmetics; radiation-emitting products; animal and veterinary medicines; and foods.

B. OBJECTIVES/PURPOSE

The objective of the Internet Monitoring Program is to support protecting the public health by obtaining Internet Monitoring support services to assist FDA in identifying illegal marketing and/or sale of FDA-regulated products via the Internet.

The Contractor shall provide monitoring of the Internet to capture relevant data, as well as the targeting of:

1. Illicit pharmaceutical and active pharmaceutical ingredient (API) websites, operators, and facilitators. This includes instances where prescription drugs and/or API are being offered for sale in any manner which would violate Federal law.

2. Illegal / unapproved medical device websites, operators, and facilitators. This includes medical devices that are not approved for use in the United States by the FDA, are stolen, or expired.

3. Illicit tobacco product websites, operators, and facilitators. This includes the sale of flavored cigarettes to US-based consumers, as well as the sale of tobacco products by entities not licensed to sell such products (located both domestically and/or internationally), or any other activities which would violate Federal law.

4. Illicit food and / or dietary supplement websites, operators, and facilitators. This includes the sale of dietary supplements which contain undeclared ingredients, or are not approved for use/sale in the United States by the FDA. This also includes the sale of food products which may be potentially harmful to consumers (i.e., counterfeit, stolen, adulterated, etc.).

5. Illicit cosmetics websites, operators, and facilitators. This includes the sale of counterfeit, unapproved, misbranded or adulterated cosmetic products intended for sale to individuals in the United States.

6. Illicit animal and veterinary product websites, operators, and facilitators. This includes the sale of counterfeit, unapproved, misbranded or adulterated veterinary products intended for sale to consumers in the United States.

7. Illicit vaccine, blood and / or biologics websites, operators, and facilitators. This includes the sale of stolen, counterfeit, unapproved, adulterated and/or misbranded vaccines, blood and/or biologic products regulated by the FDA.

8. Illegal / unapproved medical device and radiation-emitting product websites, operators, and facilitators. This includes medical devices and/or radiation-emitting products that are not approved for use in the United States by the FDA, are stolen, or expired.

9. Other Internet entities not detailed above, such as Registrars and Web host providers, actively involved in or facilitating illicit activities associated with the manufacturing, sale, marketing and/or distribution of FDA-regulated products.

10. This includes the collection and analysis of data associated with the above-mentioned entities which may result in the identification of specific trends / patterns of the activities of the individuals engaging in illegal activities. These patterns may include usage of specific domain name registrars and web hosting services (either domestically or abroad).

Definitions: See Attachment 3

C. STATEMENT OF WORK (SOW) -- SCOPE OF WORK

The Contractor shall provide the following:

1. Program Management Plan:

a. The Program Management Plan is an evolutionary document that describes the proposed management approach and includes the following:

i. A baseline for this award after the FDA has had an opportunity to comment.

ii. Detailed Standard Operating Procedures (SOPs) for all tasks.

iii. Milestones, tasks, and subtasks required in this award.

iv. An overall Work Breakdown Structure (WBS, completed in Microsoft Project) and associated responsibilities and partnerships between Government organizations.

b. During completion of the PMP, the Contractor shall consult with and advise the Contracting Officer Representative (COR) in tailoring and mapping various project management artifacts/documents to ensure adequate visibility, accountability and compliance.

c. Contractor shall provide the Government with an updated PMP within one week after the Kick-Off meeting. The FDA shall have an opportunity to comment and provide necessary changes, if necessary.

d. Contractor shall update and present the PMP monthly at the first meeting of each month for FDA approval.

2. Status Meetings: The Contractor shall interact with the COR telephonically or via Webex on an ongoing basis to discuss Data Form Reports or other issues within this Scope of Work.

3. Monthly Status Reports (MSR). The Contractor shall provide a MSR using MS Office Suite applications, by the 10th of each month via electronic mail to the FDA COR. The report shall include the following:

a. Activities during reporting period, by task (Include: On-going activities, new activities, activities completed; progress to date on all above mentioned activities). Start each section with a brief description of the task;

b. Monthly result of deconfliction efforts;

c. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them;

d. Personnel gains, losses and status;

e. Government actions required;

f. Schedule (Shows major tasks, milestones, and deliverables; planned and actual start and completion dates for each);

g. Any change request and level of efforts;

h. Accumulated invoiced cost for the previous month;

4. Initial Information Request

a. Upon an Initial Information Request from FDA-OCI, the Contractor shall attempt to determine if an affiliate network exists. If so, the Contractor shall document the size and scope of the operation, including any affiliate network. An initial report regarding the affiliate network and relevant data and statistical information shall be provided to FDA-OCI within ten (10) business days of request, and shall indicate if the identification process has been completed, or shall require additional time to be completed. If additional time is required, the Contractor shall submit the final report within fourteen (14) days from the submission of the initial report.

b. Upon an Initial Information Request of FDA-OCI, the Contractor shall provide to FDA-OCI relevant data and statistical information on any website, affiliate network, email address, IP address of any other cyber-related request for information.

c. The following relevant and statistical data shall be submitted in a format subject to FDA-OCI approval (primarily PDF and Database Reports) for inspection:

i. Website domain names

ii. IP address for each identified URL

iii. Name server utilized for each URL

iv. Mail exchange server utilized for each URL

v. Who is information to include IP address, Registrar, Registrant and Web host

vi. Geographical identification of website

vii. Associated affiliate network

viii. Anchor site for each identified network

ix. Sub-networks identified

x. FDA-regulated product(s) offered for sale

xi. Source of supply, when identified

xii. Methods of payment accepted

xiii. Point-of-contact information identified on website; i.e., email addresses, telephone numbers; fax numbers

xiv. Merchant processor and merchant acquirer information, when identified

xv. Results of deconfliction efforts

d. The Contractor shall provide a maximum of 500 Initial Informational Requests (which may include other associated attachments [i.e., spreadsheets, etc.]) under the scope of this award.

5. Secondary Informational Requests

a. After review of the Initial Informational Request, OCI shall determine if it is necessary for the Contractor to provide a further analysis of their findings via a Secondary Informational Request.

b. The Secondary Informational Requests shall provide a strategic overview of the individual project request and shall highlight significant findings and matters of concern related to the illegal marketing, trafficking, and/or sale of FDA-regulated products. The specific information requested shall be defined by the COR.

c. The report shall be prepared through detailed analysis of the information obtained by the Contractor in the Initial Information Request in conjunction with any information which may be supplied by FDA-OCI in support of the request.

d. The request shall be designed to provide FDA-OCI with a focused discussion of key issues and developments associated with the request as defined by the COR.

e. OCI does not anticipate more than 200 Secondary Informational Requests shall be needed annually.

f. The Secondary Informational Request is “not” considered to be included in the 500 Initial Informational Request report maximum limit and is considered supplemental information to the data form report.

6. Deconfliction Services

a. The Contractor shall establish a system to notify the COR of any instances where an Initial Information Request involves or is related to a previous Initial or Secondary Information Request.

b. All Initial and Secondary Data Form requests shall undergo internal deconfliction.

c. Upon written or verbal authorization from the COR, the Contractor shall securely deconflict information contained in Initial and Secondary Data Form Requests with other Federal law enforcement agencies or relevant private-sector stakeholders as directed by the COR.

7. Special Projects as requested by COR.

a. Occasionally, the COR shall request research be conducted pursuant to a special project or operation. This may include requests related to incidents of national security.

b. OCI anticipates that the number of these special requests shall not exceed 10 per calendar.

8. 12-Week Transition Plan

a. The Contractor shall create transition plan providing a description of transition activities to be carried out and a timeline for the implementation and completion of all final transition activities.

b. The successor Contractor and out-going Contractor shall work together to implement an orderly, secure, and efficient transition of the contracts.

c. This includes transitioning operations, equipment and any data relative to this award.

d. The Contractor shall also conduct a close out meeting to ensure that all necessary transition activities have occurred and to obtain a signoff from the COR.

e. The Contractor shall provide a transition plan including close out lesson learned document.

9. Section 508 Requirements

a. Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase information and communication technologies (ICT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

b. There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of information and communication technology (ICT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

c. Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

d. Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

e. The following Section 508 standards apply to the content identified in this SOW:

a. E101.2-Equivalent Facilitation (Appendix A, Application and Scoping Requirements).

b. E203-Access to Functionality (Appendix A, Application and Scoping Requirements).

c. E204-Functional Performance Criteria (Appendix A, Application and Scoping Requirements).

d. E205-Electronic Content (Appendix A, Application and Scoping Requirements).

e. 302-Functional Performance Criteria (Appendix C, Functional Performance Criteria and Technical Requirements).

f. E208-Support Documentation and Services (Appendix A, Application and Scoping Requirements).

g. Chapter 6-Support Documentation (Appendix C, Functional Performance Criteria and Technical Requirements).

D. PLACE OF PERFORMANCE :

1. Work is to be performed at the Contractor's Site.

2. The Contractor’s site shall be a facility with physical and data security standards acceptable to FDA-OCI, which generally includes modem access controls, data encryption, alarm and signal systems to ensure data security and integrity of personally identifiable information. Pursuant to HHS policy guidance* the COR shall obtain verification that the Contractor’s facility is in possession of a valid facility security clearance equal to or higher than the level of Law Enforcement Sensitive / Official Use Only [LES/OUO]. FDA-OCI shall provide facility security verification as well as personal security clearance verification for all Contractors, experts, and consultants.

3. Requests which result in the collection of large amounts of data may require the Contractor to present the findings to FDA-OCI in-person at a Government site within the United States.

4. The Contractor may also be required to testify in court.

FOB Inspection and acceptance: Destination

E. PERIOD OF PERFORMANCE: The Period of Performance for this effort shall be one (1) year from the date of award, with four (4) one year option periods.

F. Deliverable Schedule:

Updates to Project Management Plan

Monthly Status Reports

Initial Informational Request:

Each

Special Projects as requested by COR

As requested by COR and as needed - Priority Requests require immediate work and delivery

Provide a fixed price quote in accordance with the Statement of Work identified on the pricing schedule in Attachment 1.

Labor Categories

Manages other team members

Analyzes new and complex project related problems and creates innovative solutions involving finance, scheduling, technology, methodology, tools, and solution components.

Serves as the main point of contact for the COR.

Manages work of analysts and developers to ensure complete and timely fulfillment of deliverables

Prepares all reports and deliverables

352.237-75 Key Personnel. (December 2015) The key personnel specified in this award are considered to be essential to work performance. At least 30 days prior to the Contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request shall identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the Contractor is terminated for cause or separates from the Contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract shall be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

Project Manager

G. PRICING SCHEDULE

For pricing schedule to be completed by the vendor, see attachment 1.

H. GENERAL INFORMATION

Hours of operation shall be normal business hours (9am-5pm) Eastern Time. However, in matters dealing with National Security and/or significant public health and safety issues, the Contractor shall provide services outside of normal business hours to meet the timely reporting requirements specified above.

I. GOVERNMENT HOLIDAYS

a. The Government hereby provides notification that Government personnel observe the listed days as holidays:

b. In addition to the days designated as holidays, the Government observes the following days:

(1) Any other day designated by Federal Statute

(2) Any other day designated by Executive Order

(3) Any other day designated by the President’s Proclamation

c. When any such day falls on a Saturday, the following Monday is observed. Except for designated around-the-clock or emergency operations, Contractor personnel shall not be able to perform on-site under this contract with FDA on holidays set forth above. The Contractor shall not charge any holiday as direct charge to the award.

d. It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the award.

e. Nothing in this clause abrogates the rights and responsibilities of the parties relating to stop work provisions as cited in other sections of this contract.

I. CONTRACT ADMINISTRATION DATA

Contracting Officer’s Authority The Contracting Officer (CO) has responsibility for ensuring the performance of all necessary actions for effective contracting; ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this contract and is the only person authorized to approve changes to any of the requirements under this contract, and notwithstanding any provision contained elsewhere in this contract, this authority remains solely with the CO.

No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this Task Order. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the contract. The Government shall not reimburse the Contractor for any work not authorized by the CO, including work outside the scope of the contract.

CONTRACTING OFFICER'S REPRESENTATIVES (CORs):

A Government Contracting Officer Representative (COR) shall be responsible for the overall success of the project, ensuring adequate coordination among the various management components. The COR is designated to monitor the performance of this contract on behalf of the Government. He/She shall provide no supervisory or instructional assistance to Contractor personnel regarding the application software. The COR’s function is primarily to provide the Contractor with working data. He/She is not empowered to make any commitments or authorized to make any changes that affect process, terms or delivery as specified in this order. Any such proposed changes shall be brought to the immediate attention of the CO for action. The acceptance of any changes by the Contractor without specific approval and written consent of the CO shall be at the Contractor’s own risk. The following persons have been appointed as the COR:

NOTIFICATION REGARDING ADMINISTRATIVE PROBLEMS

If at any time during the performance of this contract, administrative problems should arise which shall have an adverse impact on timely performance by the Contractor or affect the contract costs or funding, the Contractor is required to immediately notify the Contracting Officer (CO) and the Contract Specialist.

FDA THREE-WAY-MATCHING INVOICE CLAUSE

A.

The Contractor shall submit all invoices to:

U.S. FOOD AND DRUG ADMINISTRATION

Attn: Vendor Payments

Division of Payment Services

10903 New Hampshire Ave

WO32 - Second Floor

MAIL HUB 2145

Silver Spring, MD 20993-0002

301-827-3742

FDAVendorPaymentsTeam@fda.hhs.gov

*** Acceptable methods of delivery include: E-mail (preferred) and Standard Mail. Provide a copy marked courtesy to the COR. The COR is TBD.

B.

Invoices submitted under this contract shall comply with the requirements set forth in FAR Clauses 52.232-25 (Prompt Payment) and 52.232-33 (Payment by Electronic Funds Transfer - System for Award Management) and/or other applicable FAR clauses specified herein. To constitute a proper invoice, the invoice shall be submitted on company letterhead and include each of the following:

(i) Name and address of the Contractor;

(ii) Invoice date and invoice number;

(iii) Contract/Order number (including a reference to any base award for Indefinite-Delivery/Indefinite-Quantity Contracts or Blanket Purchase Agreements);

(iv) Description, quantity, unit of measure, unit price, and extended price supplies delivered or services performed, including:

(a) period of performance for which costs are claimed;

(b) itemized travel costs, including origin and destination;

(c) any other supporting information necessary to clarify questionable expenditures;

(d) the Contractor shall include the award item number for each description, quantity, unit of measure, unit price, and extended price supplies delivered or services performed;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered (Prompt Payment terms other than NET 30);

(vii) Name and address of official to whom payment is to be sent (shall be the same as that in the purchase order/award, or in a proper notice of assignment)

(viii) Name, title, and phone number of person to notify in event of defective invoice;

(ix) Taxpayer Identification Number (TIN);

(x) banking routing transit number of the financial institution receiving payment for Electronic funds transfer (EFT);

(xi) Name and telephone number of the FDA Contracting Officer Representative (COR), as referenced on the award;

(xii) For all Inspections, Time-and-Materials and Labor-Hour Awards, Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance;

(xiii) Any other information or documentation required by the award.

C.

An electronic invoice is acceptable if submitted in adobe acrobat (PDF) format. All items listed in (i) through (xiii) of this clause shall be included in the electronic invoice. Electronic invoices shall be on company letterhead and shall contain no ink changes and be legible for printing.

D.

Questions regarding invoice payments should be directed to the Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets shall either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

SPECIAL REQUIREMENTS

A. GOVERNMENT FURNISHED INFORMATION

1. Any information maintained by the FDA that shall be utilized in analysis and/or the preparation of reports shall be provided to the Contractor by the FDA. This information remains the property of the FDA and shall be returned to the FDA at the conclusion of the analysis. The Contractor is prohibited from copying, maintaining, and/or disclosing the information to anyone.

2. The work product created as a result of this contract shall be stored on storage media owned and operated by the Contractor and shall be secured as Law Enforcement Sensitive / Official Use Only (LES/OUO). The work requests shall be submitted pursuant to a criminal investigation or as part of this assessment process. Therefore, this work product is law enforcement sensitive / official use only. Disclosure may obstruct the investigation and thereby impede enforcement of law. The Contractor shall provide all copies of work product created to FDA-OCI upon written request, including back-up and/or archived records. At the termination of the contract, the Contractor shall turnover all work product to FDA-OCI, and is prohibited from retaining or disclosing (in any fashion) any work product created under the scope of this award.

3. The Contractor shall have all necessary infrastructure, to include sustainable connectivity to the Internet and any Commercial Off-The-Shelf (COTS), Government Off-The-Shelf (GOTs), Contractor-owned and/or Contractor-created software, in place and operational prior to the initiation of the contract services to FDA-OCI.

4. RECOGNITION OF NONDISCLOSURE. At all times during the term of the contract and thereafter, the Contractor shall hold in strictest confidence and shall not disclose, use, lecture upon or publish any FDA Proprietary Information (defined below), except as such disclosure, use or publication may be required in connection with the Contractors work for FDA-OCI, or unless an authorized agent of FDA-OCI expressly authorizes such in writing. The Contractor assigns to FDA-OCI any rights the Contractor may have or acquire in such Proprietary Information and recognizes that all Proprietary Information shall be the sole property of FDA-OCI and FDA-OCI shall be the sole owner of all work product and associated data in connection therewith.

5. The term "Proprietary Information" shall mean confidential knowledge, data or any other proprietary information of FDA-OCI. By way of illustration but not limitation, "Proprietary Information" includes (a) any work product and associated data produced at the request of FDA-OCI; (b)ideas, processes, formulas, source and object codes, data, programs, other works of authorship, know-how, improvements, discoveries, developments, designs and techniques (hereinafter collectively referred to as "Inventions"); and (c) information regarding plans for research and/or investigation, development, investigative / operational plans, licenses, prices and costs, suppliers and customers; and information regarding the skills and compensation of other employees of the Company.

B. THIRD PARTY INFORMATION. The Contractor understands, in addition, that the Contractor shall receive from third parties confidential or proprietary information ("Third Party Information") subject to a duty on the FDA-OCI's part to maintain the confidentiality of such information and to use it only for certain limited purposes. During the term of the contract and thereafter, the Contractor shall hold Third Party Information in the strictest confidence and shall not disclose (to anyone other than FDA-OCI personnel who need to know such information in connection with their work for FDA-OCI) or use, except in connection with work for FDA-OCI, Third Party Information unless expressly authorized by an appropriate agent of FDA-OCI in writing.

C. CLASSIFIED INFORMATION. The Contractor may be required to complete a Classified Information Nondisclosure Agreement (attachment 2).

D. PUBLIC TRUST POSITIONS – SECURITY REQUIREMENTS FOR ACCESS TO SENSITIVE INFORMATION/U.S. CITIZENSHIP REQUIRED. The personnel security access level for this contract is FDA-OCI SENSITIVE, U.S. citizenship, by birth or naturalized, is required. FDA-OCI’s approval to perform on this contract shall be based on a favorably adjudicated National Agency Check and Inquiries (NACI). A favorably adjudicated Minimum Background Investigation (MBI), Limited Background Investigation (LBI), or a favorably adjudicated Single Scope Background Investigation (SSBI) conducted by the Office of Personnel Management (OPM), the Department of Defense/Defense Security Service (DOD/DSS), or other Federal agency shall be accepted pending supplemental record checks conducted by FDA-OCI.

E. PERSONNEL SECURITY CLEARANCE REQUIREMENTS

Contractor Personnel Security Clearance Standards and Residency Requirements (October 2017)

1. BACKGROUND - The Office of the Assistant Secretary for Management and Budget, Department of Health and Human Services (DHHS), requires that Contractor employees (including subContractors) who shall be working in DHHS-owned or leased space and/or who shall have access to DHHS equipment, and non-public privileged, proprietary, or trade secret information, shall undergo a background investigation that results in a favorable determination.

Contractor employees who shall work in DHHS-owned or leased space for less than thirty (30) days are considered visitors and are exempted from background investigation requirements; and therefore, shall not be issued a Personal Identity Verification (PIV) Card. These Contractor employees go through visitor screening each day and shall be escorted at all time while in DHHS- owned or leased space.

2. GENERAL - The Contractor shall submit the following items to the Contracting Officer’s Representative (COR), within five (5) business days of commencement of work under this contract:

a. A roster of Contractor employee names, identifying Key Personnel and Tier designation(s);

b. Confirmation all individual employee security information has been submitted properly; and

c. "Contractor's Commitment to Protect Non-public Information Agreement" forms signed by each employee named in the roster.

Pursuant to HSPD-12, the Contractor shall advise its prospective employees about the security and background requirements stated herein.

For any individual who does not obtain a favorable background investigation he/she shall cease work on the contract immediately.

If a Contractor employee changes job responsibilities under this contract, the Contractor shall notify the COR, and the Government shall make a determination whether an additional security clearance is required.

In the event there are any proposed personnel changes in the Contractor’s staffing roster previously submitted to the COR, the Contractor shall submit an updated roster to the COR, along with a brief explanation for the change. In turn, the COR shall initiate the procedures stated herein to ensure any new Contractor employees obtain a PIV card in a timely manner – prior to that individual commencing work under the contract.

Note: If the proposed personnel change is for a position designated Key Personnel under the contract, a complete justification – along with a resume or curriculum vitae – shall be submitted to the Contracting Officer and COR for review and approval. If approved, the Contracting Officer shall execute a Contract Modification prior to that individual commencing work under the contract.

3. BACKGROUND INVESTIGATIONS - With the exception of costs associated with fingerprinting Contractor employees outside of the FDA Personnel Security Office, the Government shall conduct all required background investigations at no cost to the Contractor. The cost of fingerprinting Contractor employees at any location other than the FDA Personnel Security Office shall be borne by the Contractor. Employees who hold or have previously held a Government security clearance shall advise the FDA Personnel Security Staff of the details of such clearance.

Note: Background investigations shall be conducted by the Office of Personnel Management (OPM)

4. CONTRACT RISK DESIGNATION(S) - Contractor employees who shall be in DHHS-owned or leased space for thirty (30) days or more shall be able to obtain and shall obtain a PIV card pursuant to Homeland Security Presidential Directive-12 (HSPD-12) in order to access to DHHS-owned or leased property without an escort. (See Section 6 for details on the PIV Card process) However, in the event that work shall commence before a security screening can be completed, Contractor employees shall be considered visitors, as described above, and allowed onto DHHS-owned or leased property, but shall be escorted at all times.

All Contractor employees who undergo a background investigation are required to log onto the Office of Personnel Management’s (OPM’s) Electronic Questionnaire for Investigation Processing system (e-Qip) system. The FDA Personnel Security Specialist shall provide access to the e-Qip as well as guidance as to which forms shall be required. The forms required vary with the position risk designations for the contract.

All standard forms submitted to the FDA shall be forwarded to the Office of Personnel Management (OPM) to initiate background investigations. The assigned FDA Personnel Security Specialist shall resolve with the Contractor employee any issues arising out of inaccurate or incomplete forms.

The Risk Designation(s) for this contract is/are Tier(s): 2 There are three (3) potential position risk designations, which are:

a. Non-Sensitive Low Risk (Tier 1) - Positions which involve the lowest degree of adverse impact on the efficiency of the Agency. The forms set forth by the FDA Personnel Security Specialist are required for Non-Sensitive Low Risk Positions.

b. Sensitive Moderate Risk (Tier 2) or Sensitive High Risk (Tier 4) - Public Trust Positions - Positions in which the incumbent's actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned Government activities, whether or not actual damage occurs.

In order to access the e-QIP system, Contractor employees shall provide the appropriate FDA Personnel Security Specialist with the following information: (a) full name; (b) position title; (c) social security number; (d) date of birth; (e) place of birth; (f) email address; and (g) phone number. This information shall be provided on the e-Qip form that shall be electronically sent to the employee. The FDA Personnel Security Specialist shall use this information to enter each Contractor employee into the e-QIP system. Once this is done, each Contractor employee shall receive an email that contains a web link to access the e-QIP system, as well as instructions and additional forms needed to initiate the background investigation.

A Contractor’s failure to comply with the e-QIP processing guidelines shall result in that Contractor’s employees being denied access to FDA property until all security processing has been completed. Furthermore, any such noncompliance may detrimentally impact Contractor performance, Contractor performance evaluations, rights and remedies available at law and equity retained by the Government.

5. PERSONAL IDENTITY VERIFICATION (PIV) CARDS - All PIV Cards (and any other type of Government-issued Access Card) shall remain the property of the Federal Government. At any time, if a Contractor employee is terminated or otherwise ceases work under the contract, or no longer requires a PIV Card for contract performance purposes, the Contractor shall collect the individual’s PIV card and immediately notify FDA Personnel Security Staff in writing, with copies to the respective COR and Contracting Officer. The Contractor shall immediately return the PIV Card(s) to the COR.

Because PIV Cards, like other Government-issued Access Cards are Government property, Contractors and Contractor Employees are hereby placed on notice that any abuse, destruction, defacement, unauthorized transfer or withholding (i.e., failure to return to the Government) may be punishable to the greatest extent at law.

Unauthorized possession of a PIV Card, or any other type of Government-issued Access Card, and/or shallfully allowing any other person to have or to use your Access Card, is prohibited and can be criminally prosecuted under 18 U.S.C. §§ 499 and 70I, which prohibit photographing or otherwise reproducing or possessing HHS identification cards in an unauthorized manner, under penalty of fine, imprisonment, or both. Wrongdoers may also be held financially responsible for any/all civil and equitable remedies – to include, but not limited to, damages for any pecuniary loss suffered by the Government as a result of any of the above-listed actions or failure to act.

6. PIV CARD PROCESS - The COR shall sponsor Contractor employees on the Form HHS 745 and HHS Smart Card Management System (SCMS) for the purpose of obtaining an FDA PIV Card. In order to obtain a PIV card, a Contractor employee shall receive a favorable FBI fingerprint return and complete required security forms. The FDA Personnel Security Specialist shall provide the Contractor employee(s) direction for scheduling fingerprinting appointments at the FDA location or other approved location.

During a fingerprint appointment, each Contractor employee shall present two (2) forms of identification in order to receive his or her PIV Card. One form of identification shall be a Government-issued photo identification document. Acceptable forms of identification are listed in Appendix A, provided below. An individual who receives an unfavorable report may appeal that finding by submitting a written request to the FDA Personnel Security Specialist.

Required background investigations may include, but are not limited to:

a. Review of prior Government/military personnel records;

b. Review of FBI records and fingerprint files;

c. Searches of credit bureaus;

d. Personal interviews; and

e. Written inquiries covering the subject's background.

7. RESIDENCY REQUIREMENTS FOR FOREIGN NATIONALS - Under the requirements for Homeland Security Presidential Directive-12 (HSPD-12), OPM can complete a background investigation only for persons who have resided in the U.S. for a total of at least three (3) of the past five (5). The residency requirements apply only to foreign nationals. If any prospective foreign national Contractor/subContractor employee does not meet the residency requirements, he/she cannot qualify for a PIV Card under HSPD-12.

8. NON-PUBLIC DATA PROTECTION - The Contractor shall protect the privacy of all information reported by or about Contractor employees and protect against unauthorized disclosure.

*Upon a favorable fingerprint return, the Contractor shall be notified to return to the Badging and Credentialing Office for their building pass.

*Food and Drug Administration Badging and Credentialing Office 8:00 a.m. – 11:00 a.m. and 1:00 p.m. – 3:00 p.m., Eastern Time 10903 New Hampshire Avenue Building 32, Room 1205 Silver Spring, MD 20993 No appointment necessary Telephone: (301) 796-4000 Appendix A

Access to Non-Public Information - FDA 3398 (Classified Information Nondisclosure Agreement) All Contractor and subContractor employees are required to sign the Contractor's Commitment to Protect Non-Public Information Agreement form provided as an attachment to this contract (Attachment 2). If a person who has signed this agreement resigns, is dismissed, or is otherwise no longer working on this contract, the Contractor shall notify the FDA Contracting Officer's Technical Representative (P.O.) and Contracting Officer. Any new Contractor and subContractor employees assigned to this contract shall sign the form, and the Contractor shall hand-deliver it (ten (10) days prior to commencement of work) to the Contracting Officer. The prime Contractor, subContractors, and consultants shall not be provided nor possess non-public information in any form unless written approval and a facility clearance have been granted.

Physical Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality:

[ ] Low [X] Moderate [ ] High

Integrity:

[ ] Low [X] Moderate [ ] High

Availability:

[ ] Low [X] Moderate [ ] High

Overall Risk Level:

[ ] Low [X] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf…