2011-N-13400 - Ferrets - Final.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2011-N-13400

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

06/10/2011

6. REQUISITION/PURCHASE NO.

Centers for Disease Control and Prevention (CDC)

Procurement and Grants Office (PGO)

Acquisition & Assistance, Branch II, Team I

2920 Brandywine Road

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 3 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in address in block 7., mailroom 1110 until

3:30PM EST.

07/11/2011 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Jeff Miller

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2651

C. E-MAIL ADDRESS

afx2@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section A – Solicitation/Contract Form (Continued)

EXECUTIVE SUMMARY

1. Description of the supplies being procured:

The Statement of Work (SOW – Section C) establishes the requirements for Contractor provided services to include the coordination of activities. The purpose of this contract is to ensure a stable supply of ferrets that are seronegative for influenza A and B viruses so that the Influenza Laboratories at CDC can produce and distribute strain specific serum for influenza diagnostic purposes, for testing of pandemic vaccine candidates and for antigenic characterization of currently circulating influenza strains including avain strains.

2. Type of Contract:

Firm-Fixed Price Indefinite Delivery Indefinite Quantity (IDIQ) supply contract

3. Format of the Contract:

This contract will have a base year for twelve (12) months and four (4) one (1) year option periods. NOTE: USG will fund this requirement by issuing delivery orders to the contractor. It is USG’s decision as to whether or not any of the option years will be executed and the contract extended beyond the base year.

4. The North American Industry Classification System (NAICS):

The NAICS code for this acquisition is 112930. The small business size standard is $7.0 million.

5. Contract Administration:

Please submit any and all questions in writing to afx2@cdc.gov . All questions must be submitted in writing by e-mail NLT June 29, 2011. See Section L, clause L.7.

6. Additional information:

See Section L for important information as to what is required to be submitted in response to this request for proposal (RFP).

Section B - Supplies Or Services and Prices/Costs

B.1 Description of Supplies This is a firm-fixed-price indefinite delivery indefinite quantity (IDIQ) type contract to provide live ferrets to the Centers for Disease Control and Prevention (CDC). Ferrets shall be provided in accordance with the specifications included in Section C, and as ordered (delivery orders) by the Government at the prices stated herein. Prices for each item shall be FOB Destination and include shipment of ferrets in HEPA-filtered containers (containers are to be air conditioned in summer). NOTE: The quantities shown are estimates only. CDC will purchase a minimum of 50 prebleeds and 50 ferrets from any CLIN.

BASE YEAR (YEAR I) 9-17-2011 THROUGH 9-16-2012

FERRET

UNIT PRICE

EXTENDED PRICE

TOTAL PRICE – BASE YEAR $____________

OPTION YEAR ONE (YEAR II) 9-17-2012 THROUGH 9-16-2013

FERRET

UNIT PRICE

EXTENDED PRICE

TOTAL PRICE – OPTION YEAR ONE $____________

OPTION YEAR TWO (YEAR III) 9-17-2013 THROUGH 9-16-2014

FERRET

UNIT PRICE

EXTENDED PRICE

TOTAL PRICE – OPTION YEAR II $____________

OPTION YEAR THREE (YEAR IV) 9-17-2014 THROUGH 9-16-2015

FERRET

UNIT PRICE

EXTENDED PRICE

TOTAL PRICE – OPTION YEAR THREE $____________

OPTION YEAR FOUR (YEAR V) 9-17-2015 THROUGH 9-16-2016

FERRET

UNIT PRICE

EXTENDED PRICE

TOTAL PRICE – OPTION YEAR FOUR $____________

TOTAL AGGREGATE PRICE (BASE AND ALL OPTION YEAR) $________________

Section C - Description/Specification/Work Statement

1. Introduction/Background

Influenza virus strain-specific ferret serum is used by the Influenza Division laboratories at CDC for diagnostic testing and to monitor antigenic drift among emerging influenza strains received by the Influenza Division reference laboratory in order to assist with the influenza vaccine recommendations. Antibody free ferrets are needed to produce strain-specific serum and for safety and efficacy testing of pandemic vaccine candidates. In the past, lack of a steady supply of antibody free ferrets has lead to delays in safety testing potential vaccine candidates. This ferret serum is also used to prepare reagent kits that are sent out for diagnostic and reference laboratories around the world. With the on-going outbreaks of highly pathogenic avian influenza in Asia, the demand for reagents to assist regional and global laboratory capacity has increased dramatically. Without a steady supply of seronegative ferrets, we cannot produce enough reagents to meet the demand.

2. References

National Research Council, Guide for the Care and Use of Laboratory Animals, 1996, National Academy Press, Washington D.C.

Code of Federal Regulations, Title 9 – Animals and Animal Products, Chapter1, Part 3, revised January 1, 2005

3. Scope and Requirement:

a. Delivery of 116 pre-bleeds/month (total quantity of 1392 max annually in which 896 are age restricted to 6-12 months of age) from influenza sero-negative ferrets. Occasionally, sera may have interference that appears as a false positive by HI testing. Additional sera would provide other possible ferrets to select from rather than delay the decision with repeat testing.

b. 12 deliveries of selected ferrets from the pre-bleed testing confirmed and identified by CDC (not to exceed 1336 ferrets per calendar year and not more monthly than can be transported in a single truck delivery). For example, one month CDC may only need 96 ferrets in a month and in the next month CDC may need 116 ferrets in that month. Each shipment may contain both age-dependant and age-independent ferrets as determined by the COTR based on the needs of the division.

Ferret Inventory Maintenance:

All CDC-bound ferrets at the vendor will be maintained inside of a HEPA-filtered enclosure. All staff entering the enclosure will wear appropriate personal protective equipment, including respirator. Inventory numbers will be maintained so that a maximum of 116 ferrets (the maximum capacity of the transport vehicle) will be available for any given month, not to exceed 1336 ferrets per year. The age of 896 of these ferrets is restricted to 6-10mths of age at the time of delivery while 440 have no age restrictions. By the 5th of each month, the current ferret inventory, including date-of-births for each lot, will be communicated by the vendor to CDC via e-mail.

Delivery of ferret prebleeds:

From the vendor inventory list, up to 116 ferrets will be selected by CDC for screening each month. The vendor will draw blood samples from each selected ferret and isolate approximately 0.5 mL of serum from each sample. This will be accomplished by centrifugation of whole blood and transfer of the separated top layer containing the serum to a fresh vial that is labeled with the corresponding ferret ear tag number. Serum samples will be shipped refrigerated via overnight delivery to CDC. The sera will be tested for the presence of influenza antibody at CDC and pending the test results, the sero-negative ferrets will be selected by the COTR for shipment to CDC. Ferrets dying in transit will be replaced by the ferret breeding facility at no cost to the Influenza Branch. Ferrets identified as sero-positive after being tested upon arrival to Influenza Division will be replaced by the ferret breeding facility at no cost to the Influenza Division.

Delivery of influenza-sero-negative ferrets:

Delivery of ferrets will be arranged between the vendor and CDC 12 times per year, not to exceed 1336 ferrets annually, less than the 1392 pre-bleeds. The additional pre-bleeds are necessary in the event that some of the ferrets test positive for influenza. The testing performed does not guarantee that the ferret has been exposed and could be attributed to cross reactivity of components in the sera. Thus, additional bleeds will allow the COTR to identify a subset of the animals suitable for use.

Shipment of the selected animals will be scheduled within two weeks of when the screening results are communicated to the vendor. All ferrets will be housed inside HEPA-filtered animal transport containers and will be delivered in an enclosed, climate controlled vehicle. Transport containers will be positioned so that ample airflow is maintained between the containers during transport to CDC. The ferrets must be housed in an influenza-free environment, handled by staff wearing proper personal protective equipment (PPE). Handling of the ferrets by staff infected with influenza could pass infection to the ferrets and contaminate the entire lot of ferrets. Handling of ferrets in transit by staff not wearing PPE could also infect previously clean and COTR approved ferrets. The vendor’s driver and any additional staff will wear a respirator during all loading and unloading activities. In the event of transport vehicle malfunction, a backup vehicle will be available to deliver animals in a timely manner.

Other

· Ferrets are to be housed as prescribed in chapter two, “Animal Environment, Housing and Management,” in the 1996 National Research Council’s Guide for the Care and Use of Laboratory Animals. When using this guide, refer to the requirements described for cats, as they are closest to ferrets in regards to care, feeding and housing.

· Personnel caring for ferrets should be appropriately trained and provided with clearly defined procedures for conducting their duties including but not limited to personal hygiene, zoonoses, chemical safety, microbiologic and physical hazards (1996, National Research Council, page 15).

· All staff in direct contact with these ferrets must wear personal protection equipment that includes respirators, gloves, and hair and shoe covers at all times when in the facility. Street clothes and shoes are not to be worn in this facility at any time.

Special Considerations

The Public Health Service (PHS) Policy on Humane Care and Use of Laboratory Animals requires that institutions receiving PHS support for activities involving animals base their programs of animal care and use on the 1996 National Research Council’s Guide for the Care and Use of Laboratory Animals and comply, as applicable, with the Animal Welfare Act and other Federal statutes and regulations relating to animals.

Section D - Packaging And Marking D.1 Packaging Requirements (Nov 2003) Ferrets are to be shipped in hepa-filtered containers (containers are to be air conditioned in summer). Ferrets are to be shipped in such a manner as to assure safe arrival at destination.

(End of Clause)

D.2 Marking Requirements (May 1998)

Shipping containers will be marked indicating that live animals are inside and that ferrets are to remain in hepa-filtered containers until ferrets are removed from the hepa-filtered containers at final CDC destination.

Also, the contractor must mark/stencil all shipping containers with the following information:

Agency

Description of Contents

CDC Contract Number

Contractor’s Name and Address

(End of Clause)

Section E - Inspection And Acceptance E.1 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.arnet.gov/far http://farsite.hill.af.mil/VFFARa.htm or VFFAR1.htm

(End of Clause)

E.2 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Project Officer) at the destination of the articles, services or documentation.

Section F - Deliveries Or Performance F.1 52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.arnet.gov/far http://farsite.hill.af.mil/VFFARa.htm or VFFAR1.htm

(End of Clause)

F.2 Place of Delivery (May 1998)

Deliveries shall be made F.O.B. Destination to the following address:

Centers for Disease Control and Prevention

Receiving – Building 11 1600 Clifton Road, N.E.

Atlanta, GA 30033

(End of Clause)

F.3 Period of Performance (Jul 1999)

The period of performance shall be a base period of twelve (12) months, with options for four (4) 12 (twelve) month option periods, for a total contract period not to exceed sixty (60) months.

F.4 Deliverable(s) Schedule (Jul 1999)

TO BE ESTABLISHED ON INDIVIDUAL DELIVERY ORDERS

Inventory of the number and ages of available ferrets

Pre-bleeds

One (1) – Due by the 5th of each month

Maximum Twelve (12) deliveries – Fifty (50) - 1392 pre-bleeds within one (1) week after delivery order is sent to contractor (not to exceed 116 pre-bleeds per delivery) CDC COTR and Technical Monitor

CDC COTR and Technical Monitor

The Contractor shall deliver, within the time frames specified above, Item(s) No. 01 through 04 to CDC COTR at the address shown in clause F.2.

F.5 Ordering of Supplies

CDC Contracting Officer will e-mail a delivery order to the contractor the first week of every month (via e-mail) if ferrets are needed, after the inventory of available ferrets has been forwarded from the contractor to CDC (COTR), to inform the contractor as to how many and what kind of ferrets will need to be delivered to CDC for that particular month (COTR will also be forwarded this e-mail). Contractor will confirm by e-mail that the number and kind of ferrets required by CDC are available and will be delivered in accordance with the terms and conditions of the delivery order/contract. Contractor will deliver ferrets in their own motor vehicle.

Section G - Contract Administration Data

G.1 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

G.2 Contract Communications/Correspondence (Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

G.3 Payment by Electronic Funds Transfer (Dec 2005) (Dec 2005)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer – Central Contractor Registration, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Financial Management Office at (404) 498-4050.

(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention

Financial Management Office (FMO)

P.O. Box 15580

Atlanta, GA 30333

Or – Fax copy to: 404-638-5342 (End of Clause)

G.4 Invoice Submission (Mar 2006) CDCAG001 – Invoice Submission (Mar 2006)

(a) The Contractor shall submit the original contract invoice/voucher to the shown below:

The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 3033

Or – The Contractor may submit the original invoice/voucher via facsmile or email:

Fax: 404-638-5324

Email: FMOAPINV@CDC.GOV NOTE: Submit to only one (1) of the above locations.

(b) The contractor shall e-mail a copy of the invoice/voucher to the cognizant contracting office previously identified in this contract.

(c) The Contractor is FORMCHECKBOX , is not [X] required to submit a copy of each invoice directly to the Project Officer concurrently with submission to the Contracting Officer.

(d) In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Financial Management Office is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(e) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Task Order Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice

(11) Name, title and telephone number of person to be notified in the event of a defective invoice

(12) Payment Address, if different from the information in (c)(1).

(13) DUNS + 4 Number

(End of Clause)

G.5 Payment Methods

Authorized payment under this contract will be made in accordance with conventional Government fixed-price contracts, but also by the Government IMPAC/VISA payment vehicle. The contractor will abide by all billing and invoice regulations required by the Government in meeting IMPAC/VISA regulations.

(End of Clause)

G.6 COTR & Technical Monitor (Jul 1999)

(a) Performance of the work hereunder shall be subject to the technical directions of the designated Contracting Officer’s Technical Representative (COTR) for this contract. Dr. Taronna Maines is hereby designated as the COTR for this contract. The COTR mailing address is: Centers for Disease Control and Prevention (CDC), Attn: Dr. Taronna Maines – M/S G16, 1600 Clifton, Atlanta, GA 30333. The Technical Monitor for this contract is Dr. Taronna Maines. The Technical Monitor’s mailing address is Centers for Disease Control and Prevention (CDC), Attn: Dr. Taronna Maines – M/S G16, 1600 Clifton Road, Atlanta, GA 30333.

(b) As used herein, technical directions are directions to the contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify and adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction. If the contractor fails to provide the required notification within the said two (2) week period that any technical direction exceeds the scope of the contract, then it shall be deemed for purposes of this contract that the technical direction was within the scope. No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

(c) The Government Project Officer is not authorized to change any of the terms and conditions of this contract. Changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

G.7 Evaluation of Contractor Performance (Supplies) (Jan 2000)

(a) Purpose

In accordance with FAR 42.1502, the Contractor's performance will be periodically evaluated by the Government, in order to provide current information for source selection purposes. These evaluations will therefore be marked "Source Selection Information."

(b) Performance Evaluation Period

The Contractor's performance will be evaluated at least annually.

(c) Evaluators

The performance evaluation will be completed jointly by the Project officer and the Contracting officer.

(d) Performance Evaluation Factors

The contractor's performance will be evaluated in accordance with the attachment listed in Section J titled Performance Evaluation Report.

(e) Contractor Review

A copy of the evaluation will be provided to the contractor as soon as practicable after completion of the evaluation. The contractor shall submit comments, rebutting statements, or additional information to the Contracting Officer within 30 calendar days after receipt of the evaluation.

(f) Resolving Disagreements Between the Government and the Contractor

Disagreements between the parties regarding the evaluation will be reviewed at a level above the Contracting Officer. The ultimate conclusion on the performance evaluation is a decision of the contracting agency. Copies of the evaluation, contractor's response, and review comments, if any, will be retained as part of the evaluation.

(g) Release of Contractor Performance Evaluation Information

The completed evaluation will not be released to other than Government personnel and the contractor whose performance is being evaluated. Disclosure of such information could cause harm both to the commercial interest of the Government and to the competitive position of the contractor being evaluated as well as impede the efficiency of Government operations.

(h) Source Selection Information

Departments and agencies may share past performance information with other Government departments and agencies when requested to support future award decisions. The information may be provided through interview and/or by sending the evaluation and comment document to the requesting source selection official.

(i) Retention Period

The agency will retain past performance information for a maximum period of three years after completion of contract performance for the purpose of providing source selection information for future contract awards.

G.8 Online Representations and Certification Application (ORCA) (Dec 2006)

(a) All potential Contractors are required to complete electronic annual representations and certifications at http://orca.bpn.gov in conjunction with registration in the Central Contractor Registration (CCR) database per FAR 4.1102 and FAR 4.1201. Certifications in ORCA are required prior to the submission of contract proposals.

(b) Contractors shall update the representations and certifications submitted to ORCA as necessary, but at least annually, to ensure they are kept current, accurate, and complete. All Contractors with current contracts shall notify the Contracting Officer in writing when changes are made to ORCA. The representations and certifications are effective until one year from date of submission or update to ORCA.

(End of Clause)

Section H - Special Contract Requirements H.1 Health and Safety Requirements (Oct 2007) The Contractor shall be responsible for implementing the appropriate controls for protection to the life and health of employees and other persons in the performance of the contract. The contractor shall comply with all applicable federal, state and local environmental, health and safety regulations and standards, nationally recognized guidelines, and any specific requirements specified by the Government, such as, but not limited to 1) 29 CFR part 1910 – Occupational safety and health standards, including the requirements for hazard assessments, personal protection equipment selection, training of employees and other persons in the recognition of hazards and specific procedures implemented to protect from exposure, such as appropriate work practices, emergency procedures, proper use and limitations of personal protective equipment, and medical management, including immunizations, medical surveillance and incident reporting procedures, and medical evaluation and follow-up; 2) 40 CFR parts 1 – 799, Environmental protection Agency; 3) 10 CFR parts 0 – 199, Nuclear Regulatory Commission; 4) Biosafety in Microbiological and Biological laboratories, U.S Department of Health and Human Services, HHS Publication No. CDC93-8395; 5) Biosafety in the Laboratory: Prudent Practices for Handling and Disposal of Infectious Materials; 6) Prudent Practices for Handling Hazardous Chemicals in the Laboratory; and 7) Prudent Practices for the Disposal of Chemicals from the Laboratory.

(End of Clause) H.2 352.270-9 Care of Laboratory Animals.

(a) The following provision shall be included in solicitations expected to involve vertebrate animals:

Notice to Offerors of Requirement for Adequate Assurance of Protection of Vertebrate Animal Subjects (SEP 1985)

The PHS Policy on Humane Care and Use of Laboratory Animals by Awardee Institutions establishes a number of requirements for research activities involving animals. Before award may be made to an applicant organization, the organization shall file, with the Office of Laboratory Animal Welfare (OLAW), National Institutes of Health (NIH), a written Animal Welfare Assurance which commits the organization to comply with the provisions of the PHS Policy on Humane Care and Use of Laboratory Animals by Awardee Institutions, the Animal Welfare Act, and the Guide for the Care and Use of Laboratory Animals prepared by the Institute of Laboratory Animal Resources. In accordance with the PHS Policy on Humane Care and Use of Laboratory Animals by Awardee Institutions, applicant organizations must establish a committee, qualified through the experience and expertise of its members, to oversee the institution's animal program, facilities and procedures. No award involving the use of animals shall be made unless the Animal Welfare Assurance has been approved by OLAW. Prior to award, the Contracting Officer will notify Contractor(s) selected for projects that involve live vertebrate animals that an Animal Welfare Assurance is required. The Contracting Officer will request that OLAW negotiate an acceptable Animal Welfare Assurance with those Contractor(s). For further information, OLAW may be contacted at NIH, Bethesda, Maryland 20892 (301-496-7041).

(End of Provision)

H.3 Care of Live Vertebrate Animals (JAN 2001)

(a) Before undertaking performance of any contract involving animal related activities, the Contractor shall register with the Secretary of Agriculture of the United States in accordance with 7 U.S.C. 2136 and 9 CFR sections 2.25 through 2.28. The Contractor shall furnish evidence of the registration to the Contracting Officer.

(b) The Contractor shall acquire vertebrate animals used in research from a dealer licensed by the Secretary of Agriculture under 7 U.S.C. 2133 and 9 CFR Sections 2.1-2.11, or from a source that is exempt from licensing under those sections.

(c) The Contractor agrees that the care and use of any live vertebrate animals used or intended for use in the performance of this contract will conform with the PHS Policy on Humane Care of Use of Laboratory Animals, the current Animal Welfare Assurance, the Guide for the Care and Use of Laboratory Animals prepared by the Institute of Laboratory Animal Resources and the pertinent laws and regulations of the United States Department of Agriculture (see 7 U.S.C. 2131 et seq. and 9 CFR Subchapter A, Parts 1-4). In case of conflict between standards, the more stringent standard shall be used.

(d) If at any time during performance of this contract, the Contracting Officer determines, in consultation with the Office of Laboratory Animal Welfare (OLAW), National Institutes of Health (NIH), that the Contractor is not in compliance with any of the requirements and/or standards stated in paragraphs (a) through (c) above, the Contracting Officer may immediately suspend, in whole or in part, work and further payments under this contract until the Contractor corrects the noncompliance. Notice of the suspension may be communicated by telephone and confirmed in writing. If the Contractor fails to complete corrective action within the period of time designated in the Contracting Officer's written notice of suspension, the Contracting Officer may, in consultation with OLAW, NIH, terminate this contract in whole or in part, and the Contractor's name may be removed from the list of those contractors with approved PHS Animal Welfare Assurances.

Note: The Contractor may request registration of its facility and a current listing of licensed dealers from the Regional Office of the Animal and Plant Health Inspection Service (APHIS), USDA, for the region in which its research facility is located. The location of the appropriate APHIS Regional Office, as well as information concerning this program may be obtained by contacting the Animal Care Staff, USDA/APHIS, 4700 River Road, Riverdale, Maryland 20737.

(End of Clause

H.4 HHSAR 352.239-70 Standard for Security Configurations (Oct 2009)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops--regardless of function--but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Approved security configurations are identified in NIST checklists (http://web.nvd.nist.gov/view/ncp/repository) or contained in a DoD DISA security technical implementation guide or security checklist http://iase.disa.mil/stigs/index.html. If CDC specific security configuration requirements are later determined to apply, they will be provided subsequent to contract award and incorporated by contract modification.

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings--see http://nvd.nist.gov/validation.cfm. The

Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart

4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause)

H.5 HHSAR 352.239-71 Standard for Encryption Language (Oct 2009)

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered ``sensitive'' in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

H.6 HHSAR 352.239-72 Security Requirements for Federal Information Technology Resources (Oct 2009)

(a) Applicability. This clause applies whether the entire contract or order (hereafter ``contract''), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term ``information technology (IT)'', as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their--

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)--due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)--due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)--due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)--due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems--see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in ``HHS-Controlled Facilities and Information Systems Security'' requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COTR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that--

(1) Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting Officer…