2011-N-13483 CFS.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2011-N-13483

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

07/14/2011

6. REQUISITION/PURCHASE NO.

Centers for Disease Control and Prevention (CDC)

Procurement and Grants Office (PGO)

Acquisition & Assistance, Branch II, Team I

2920 Brandywine Road

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 3 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in address in block 7., mailroom 1110 until

3:30 PM EST

local time 08/15/2011 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Jeff Miller

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2651

C. E-MAIL ADDRESS

afx2@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section A – Solicitation/Contract Form (Continued)

EXECUTIVE SUMMARY

1. Description of the Service being procured:

The Statement of Work (SOW – Section C) establishes the requirements for Contractor provided services to include the coordination of activities. The purpose of this contract is to provide CDC with clinical expertise of 3-5 CFS clinical practices, and data collected on clinical, functional and epidemiologic characteristics using a standardized approach from a minimum of 50 CFS patients (ideally 100) per practice. An outcome is to provide a forum for dialogue between contractors about clinical issues relating to all aspects of diagnosis and management of CFS, to develop a consensus on key instruments and variables on which to stratify CFS patients and to ascertain the extent of patient heterogeneity between practices.

2. Type of Contract:

Firm-Fixed Price service contract

3. Format of the Contract:

The contract period of performance is one (1) year.

4. The North American Industry Classification System (NAICS):

The NAICS code for this acquisition is 541690. The small business size standard is $7.0 million.

5. Unusual/Specific Aspects of the Acquisition:

Review of Data

a. The CDC Contracting Officer and Project Officer must review any materials or data generated under this contract prior to dissemination, release or publication by the Contractor. Review and approval shall be performed in accordance with the current CDC policies and procedures.

Dissemination of Information

b. No information related to data obtained or collected under this contract shall be released or published (including all publications) without the prior written consent of the CDC Contracting Officer and Project Officer and also reviewed and approved by the CDC Office of Communication prior to publication.

Multiple Awards

c. The Government contemplates 3-5 contracts (3-5 CFS clinical practices) will be awarded for this requirement depending upon the availability of funding. It is solely the Government’s decision and determination as to how many contracts will be awarded. NOTE: The award of any contract(s) for this requirement is subject to the availability of funds.

Invitation to Propose Performance-Based Payments

d. Contractor is allowed to propose performance-based payments – see clause 52.232-28 in Section L.

6. Contract Administration:

Please submit any and all questions in writing to afx2@cdc.gov . All questions must be submitted in writing by e-mail NLT July 29, 2011. See Section L, clause L.10.

7. Additional information See Section L for important information as to what is required to be submitted in response to this request for proposal (RFP).

Section B - Supplies Or Services And Prices/Costs

B.1 Description of Services

Contractor will perform a study to provide CDC with clinical expertise from physicians caring for patients with CFS to obtain clinical, functional and epidemiologic data using a standardized approach. Results from each contractor will be used to ascertain the extent of heterogeneity within and between clinical practices. This information will enable CFS researchers to provide a standardized approach to definition use in clinical diagnosis and management of CFS and improve standardization, integration and sharing of CFS data to benefit research.

ESTIMATED PERFORMANCE PERIOD: 9-15-2011 THROUGH 9-14-2012

UNIT PRICE

EXTENDED PRICE

YEAR

The contract period of performance is twelve (12) months.

TOTAL PRICE $____________

Section C - Description/Specification/Work Statement Title of Project: Multi-site Clinical Assessment of CFS

C.1 Background and Need –

Chronic fatigue syndrome (CFS) is a debilitating condition of unknown etiology and pathogenesis characterized by unexplained severe fatigue of at least 6 months duration that interferes with daily activities and is accompanied by additional symptoms, most characteristically post-exertional malaise, muscle aches and pain, and concentration problems. Currently the diagnosis is made on the basis of excluding other conditions. Several case definitions are in use for research and clinical studies [1, 2], and varying degrees of overlap with fibromyalgia, chemical sensitivities, post-infectious fatigue and post-traumatic stress disorder are recognized.

While it is clear that physicians world-wide recognize an illness with similar features [3], there is marked heterogeneity in patients. While additional disease stratification was recommended in the 1994 International Research Case Definition [1], few measures beyond acute and chronic onset of illness have been widely used. To make progress, collection of standardized data on key dimensions of the illness from a large number of CFS patients from multiple clinical practices is needed.

Direct dialogue and consultation with clinical experts in CFS about best practices in evaluating new patients and management of CFS are needed to build consensus and develop evidence-based guidance for continuing medical education. Achieving this goal also requires systematic data collection from a large number of CFS patients from multiple clinical practices.

C.2 Project Objective –

The purpose of this contract is to provide CDC with clinical expertise of 3-5 CFS clinical practices, and data on clinical, functional and epidemiologic characteristics using a standardized approach from a minimum of 50 CFS patients (ideally 100) per practice. An outcome is to provide a forum for dialogue between contractors about clinical issues relating to all aspects of diagnosis and management of CFS, to develop a consensus on key instruments and variables on which to stratify CFS patients and to ascertain the extent of patient heterogeneity between practices.

C.3 Scope of Work –

At an initial face-to-face meeting, CDC and the contractors will agree on a set of standardized instruments and methods for collection of clinical data, including diagnostic tests, on a minimum of 50 CFS patients per practice. The contractor may enroll any patient in their practice that is being managed as a CFS patient, and patients meeting criteria for myaglic encephalomyelitis or post-infective fatigue would be eligible. The contractor will share with CDC their clinical protocols for first visit evaluation of patients with CFS symptoms, including laboratory and other diagnostic tests performed, copies of all instruments and scoring algorithms (when such are in use) and other management tools. The process by which the applicant uses this information to make a diagnosis of CFS should be described. This information will be shared with all those awarded contracts under this mechanism. Data collection forms and instruments will include but are not limited to:

· Basic demographic data

· History of present illness to include time of onset, circumstances (acute infection, trauma, stress, etc.)

· Physical Exam

· Current Medications

· Multidimensional Fatigue Inventory (MFI-20)

· Medical Outcomes Study 36-Item Short Form Health Survey (SF-36v2)

· CDC Symptom Inventory

· Detailed Medical History

· Psychiatric Illness Screen

Contractors will enroll patients with informed consent for sharing of clinical data stripped of all personal identifiers, and seek permission for prospective data collection and willingness to be contacted for participation in future studies. Data collected in this contract will be submitted to CDC, and analysis will be performed by CDC with input from the contractors. Contractors will be required to use functional measures that will allow comparison of patients within and between clinics (e.g., the MFI, the CDC Symptom Inventory, and the SF-36 as well as other instruments and data collection forms agreed upon at the initial face-to-face meeting). This phase of the study will be restricted to adults (≥ 18 years of age) with clinically diagnosed chronic fatigue syndrome.

C.4 Technical Requirements – The contractor shall perform the following tasks:

1) Develop study protocol. The contractor will attend a 2-day on-site meeting at CDC with all contract awardees to discuss CFS diagnosis techniques currently being used, the currently used approach to exclusionary or co-morbid conditions, and to adopt instruments for data collection, standardize the data structure and establish a dictionary for how the variables are coded and organized in the final database at CDC, and determine the data management and sharing guidelines.

Deliverables:

· Provide a copy (preferably electronic format) of their clinical protocols for first visit evaluation of CFS patients, including laboratory and other diagnostic tests performed, and/or instruments and scoring algorithms and other management tools prior to face-to-face meeting at CDC with all contract awardees.

· Presentation at CDC meeting about the background information on Contractors’ clinics and proposed study questionnaires

· The Contractor shall obtain initial and annual local IRB approval and shall submit one electronic and one hard copy to the Project Officer

· Final list of data collection instruments based on the meeting consensus and direction provided by the CDC

2) Prepare the study. The contractor shall provide and train staff to enroll patients, collect data, check data quality, and transmit data to CDC. Training shall be in accordance with the protocol developed collaboratively by CDC and the contractors. The staff will attend a conference call conducted by the CDC to train them on standardization of data collection techniques and finalize process implementation measures. A data manager is essential. Staff will include:

· Those responsible for contacting eligible subjects, obtaining informed consent, scheduling appointments, sending advance materials to patients, checking subjects into the clinic, reviewing all materials that subjects complete to insure completeness of information, reviewing and abstracting medical records.

· Staff to administer the physical exams, collect physical measurements, and review self-administered questionnaires with subjects.

· Staff clinicians (psychologists, psychiatric social workers) or non-clinicians with experience in psychological assessment to interview patients regarding depression, substance abuse, anorexia or bulimia nervosa or other comorbidities.

Deliverable:

· A study preparation and training report with a list of study staff and their responsibilities.

3) Enroll patients and collect required information. The contractor will enroll at least 50 (ideally 100) CFS patients (new and/or established) who have given informed consent for data collection and sharing. The contractor will attend monthly conference calls with CDC.

· Subjects will receive a study number. Personal identifiers will be stored separately and will only be accessible to the study coordinator at the participating site. De-identified data will be delivered to the CDC central data coordination site.

· Permission should be sought from those enrolled for future contact by study site workers

· Assist in CDC staff’s site visits (1 or 2 per awardee) to monitor data collection and study implementation, and perform random data checks

· The Contractor shall key all raw response data collected from paper forms into a database compatible with the data structure and dictionary standardized by the group and submit electronic files of 1) medication history, the physical examination form including medical history, 2) laboratory test results, 3) the questionnaires and 4) a spreadsheet containing the study numbers of the records with no personal identifier

Deliverables:

· When data collection and entry for the first 5 subjects are complete, transfer the raw response data and entered data to CDC for data validation and procedure quality control purpose.

· Upload entered data to dedicated CDC secure FTP server quarterly.

· Prepare one single-spaced, typewritten copy of a summary of yearly enrollment report and provide to the Project Officer on an annual basis.

· Provide a spreadsheet containing the study numbers of the records with no personal identifiers.

4) Final study report and data transfer. The contractor will transfer the final data set and all required documentations to CDC. The contractor will also attend a 1-day on-site meeting at CDC with all contract awardees to summarize the study and discuss issues and potential solutions for future studies.

Deliverables:

· Prepare one single-spaced, typewritten copy of a comprehensive study report and present to other contract awardees and CDC at the end of study.

· The final data set and all required documentations.

C.5 Reporting Schedule –

· Within 2 weeks of the award date, all contractors provide their clinical protocols for evaluation of new patients, including laboratory and other diagnostic tests performed, copies of all instruments and scoring algorithms and other management tools to CDC in electronic format (preferred) or hard copy.

· Within 3 to 4 weeks of the award date, the contractor and data manager will attend a meeting at the CDC to discuss study data collection, data coding, data delivery, data management and data sharing. All contractors will present background information on their clinic and proposed study questionnaires at the CDC meeting using PowerPoint presentations.

· Within 1 week of the CDC meeting all contractors will submit study approval to their IRB, including study data collection forms. Contractors will submit verification of the IRB submission to the CDC and follow-up when IRB approval has been attained.

· Within 6 weeks of the award date, contractors will attend a study staff conference call conducted by the CDC to train study staff on standardization of data collection techniques and finalize process implementation measures.

· Contractors are expected to attend monthly conference calls with CDC.

· CDC staff will make 1 to 2 site visits to each contractor to monitor data collection, study implementation and perform random data checks.

· Within one month of the data collection of last enrollee, the contractor will deliver the complete final data files to CDC.

· Within one month of the final data deliverable, the contractor will submit a final data report

C.6 Special Considerations –

Contractors must be willing to collaborate with other contract holders to determine the questionnaires, specimens and clinical testing to be done for this study. Contractors must be willing to collect the data agreed upon by all contractors at a planning meeting held at the start of the contract. All contractors must commit to attending at least one planning meeting in person at the CDC in order to standardize protocols and determine methods for data integration and sharing. Contractor must have documented expertise in clinical diagnosis and management of CFS. Contractor must be able to provide a description of their current CFS patient population in order to document feasibility of enrolling the required numbers of CFS patients. A data management coordinator is essential. Contractors must be willing to share current diagnosis criteria and methods to determine exclusionary conditions in use at their clinic.

C.7 Government Furnished Property

The government will provide a detailed IRB-approved clinical protocol to the contractor. The government will also provide the required copies of the informed consent, epidemiologic and clinical questionnaires that will need to be completed for each subject. The government will also provide data storage for the final data sets at CDC and secure FTP website for transferring data.

C.8 References –

1. Fukuda K, Straus SE, Hickie I, Sharpe MC, Dobbins JG, Komaroff AL and the International CFS study group, The chronic fatigue syndrome: a comprehensive approach to its definition and study. Annals of Internal Medicine, Vol. 121, December 15, 1994, pp. 953-959.

2. Carruthers BM, Jain AK, De Meirleir KL, Peterson DL, Klimas NG, Lerner AM, et al. Myalgic Encephalomyelitis/Chronic fatigue syndrome: Clinical Working case definition, Diagnostic and Treatment protocols. Journal of Chronic Fatigue Syndrome, Vol. 11(1) 2003 Canadian Case Definition

3. Ian Hickie, Tracey Davenport, Suzanne D. Vernon, Rosane Nisenbaum, William C. Reeves, Dusan Hadzi-Pavlovic, Andrew Lloyd, and the International Chronic Fatigue Syndrome Study Group. Are chronic fatigue and chronic fatigue syndrome valid clinical entities across countries and healthcare settings? Australian and New Zealand Journal of Psychiatry 2009; 43:25-35.

Deliverables

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E - Inspection And Acceptance

NOTE: the full text of a clause may be accessed electronically at this/these address(es):

http://www.arnet.gov/far http://farsite.hill.af.mil/VFFARa.htm or VFFAR1.htm

Section F - Deliveries Or Performance

F.1 Deliverable(s) Schedule (Jul 1999)

(End of Clause)

F.2 Period of Performance (Jul 1999)

The period of performance shall include a twelve (12) month base period with four (4) twelve (12) month option periods.

(End of Clause)

Section G - Contract Administration Data

G.1 Contracting Officer’s Technical Representative (COTR) (Jul 1999)

Performance of the work hereunder shall be subject to the technical directions of the designated COTR for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the Contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction. If the Contractor fails to provide the required notification within the said two (2) week period that any technical direction exceeds the scope of the contract, then it shall be deemed for purposes of this contract that the technical direction was within the scope. No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government COTR is not authorized to change any of the terms and conditions of this contract. Changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the delegation memorandum for the COTR. Any changes in COTR Delegation will be made by the Contracting Officer in writing with a copy being furnished to the Contractor.

G.2 Payment by Electronic Funds Transfer (Dec 2005)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer – Central Contractor Registration, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Financial Management Office at (404) 498-4050.

(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention

Financial Management Office (FMO)

P.O. Box 15580

Atlanta, GA 30333

Or – Fax copy to 404-638-5342

(End of Clause)

G.3 Voucher/Invoice Submission – (Mar 2006)

(a) Contractor voucher requests for reimbursement shall conform to the form, format, and content requirements as stated below.

(b) The Contractor shall submit the original contract invoice/voucher the address shown below:

The Centers for Disease Control and Prevention

Financial Management Office (FMO)

P.O. Box 15580

Atlanta, GA 30333

Or – The Contractor may submit the original invoice/voucher or progress payment via facsimile or email:

Fax: 404-638-5324

Email: FMOAPINV@CDC.GOV NOTE: Submit to only one (1) of the above locations.

(c) The contractor shall e-mail (afx2@cdc.gov) a copy of the invoice/voucher or progress payment to the cognizant contracting office previously identified in this contract (see below). These invoices/voucher copies shall be addressed to the attention of the Contracting Officer.

(d) The Contractor is X, is not FORMCHECKBOX required to provide a copy of each voucher requests for reimbursement to the Project Officer (or to the Task Order Project Officer or Technical Monitor if this is a task order contract).

(e) In accordance with 5 CFR part 1315 (Prompt Payment), CDC’s Financial Management Office is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(f) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Task Order Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice

(11) Name, title and telephone number of person to be notified in the event of a defective invoice

(12) Payment Address, if different from the information above

(13) DUNS + 4 Number

(g) The Contractor shall, in addition to the above requirements, submit a detailed breakout of costs as supporting backup and shall place the following signed Contractor Certification on each invoice/voucher submitted under this contract:

I certify that this voucher reflects (fill in Contractor’s name) request for reimbursement of allowable and allocable costs incurred in specific performance of work authorized under Contract (fill in contract number)/Task (fill-in task order number, if applicable), and that these costs are true and accurate to the best of my knowledge and belief.

(Original Signature of Authorized Official)

Typed Name and Title of Signatory

G.4 Evaluation of Contractor Performance (Service) (Jan 2000)

(a) Purpose

In accordance with FAR 42.1502, the Contractor's performance will be periodically evaluated by the Government, in order to provide current information for source selection purposes. These evaluations will therefore be marked "Source Selection Information."

(b) Performance Evaluation Period

The Contractor's performance will be evaluated at least annually.

(c) Evaluators

The performance evaluation will be completed jointly by the Project officer and the Contracting officer.

(d) Performance Evaluation Factors

The contractor's performance will be evaluated in accordance with the attachment listed in Section J titled Performance Evaluation Report.

(e) Contractor Review

A copy of the evaluation will be provided to the contractor as soon as practicable after completion of the evaluation. The contractor shall submit comments, rebutting statements, or additional information to the Contracting Officer within 30 calendar days after receipt of the evaluation.

(f) Resolving Disagreements Between the Government and the Contractor

Disagreements between the parties regarding the evaluation will be reviewed at a level above the Contracting Officer. The ultimate conclusion on the performance evaluation is a decision of the contracting agency. Copies of the evaluation, contractor's response, and review comments, if any, will be retained as part of the evaluation.

(g) Release of Contractor Performance Evaluation Information

The completed evaluation will not be released to other than Government personnel and the contractor whose performance is being evaluated. Disclosure of such information could cause harm both to the commercial interest of the Government and to the competitive position of the contractor being evaluated as well as impede the efficiency of Government operations.

(h) Source Selection Information

Departments and agencies may share past performance information with other Government departments and agencies when requested to support future award decisions. The information may be provided through interview and/or by sending the evaluation and comment document to the requesting source selection official.

(i) Retention Period

The agency will retain past performance information for a maximum period of three years after completion of contract performance for the purpose of providing source selection information for future contract awards.

(End of Clause)

G.5 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

G.6 Contract Communications/Correspondence (Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

(End of Clause)

G.7 Online Representations and Certification Application (ORCA)

(a) All potential Contractors are required to complete electronic annual representations and certifications at http://orca.bpn.gov in conjunction with registration in the Central Contractor Registration (CCR) database per FAR 4.1102 and FAR 4.1201. Certifications in ORCA are required prior to the submission of contract proposals.

(b) Contractors shall update the representations and certifications submitted to ORCA as necessary, but at least annually, to ensure they are kept current, accurate, and complete. All Contractors with current contracts shall notify the Contracting Officer in writing when changes are made to ORCA. The representations and certifications are effective until one year from date of submission or update to ORCA.

(End of Clause) Section H - Special Contract Requirements H.1 HHSAR 352.239-70 Standard for Security Configurations (Oct 2009)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops--regardless of function--but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Approved security configurations are identified in NIST checklists (http://web.nvd.nist.gov/view/ncp/repository) or contained in a DoD DISA security technical implementation guide or security checklist http://iase.disa.mil/stigs/index.html. If CDC specific security configuration requirements are later determined to apply, they will be provided subsequent to contract award and incorporated by contract modification.

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings--see http://nvd.nist.gov/validation.cfm. The

Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart

4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause)

H.2 HHSAR 352.239-71 Standard for Encryption Language (Oct 2009)

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered ``sensitive'' in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

H.3 HHSAR 352.239-72 Security Requirements for Federal Information Technology Resources (Oct 2009)

(a) Applicability. This clause applies whether the entire contract or order (hereafter ``contract''), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term ``information technology (IT)'', as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their--

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)--due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)--due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)--due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)--due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems--see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in ``HHS-Controlled Facilities and Information Systems Security'' requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COTR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that--

(1) Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

(i) Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

(j) Contractor responsibilities upon physical completion of…