VSD SolicitationFINAL.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2012-N-14282

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

05/10/2012

6. REQUISITION/PURCHASE NO.

0HCVLD12-2012-43830

8. ADDRESS OFFER TO (If other than Item 7)

Centers for Disease Control and Prevention Procurement and Grants Office Acquisition and Assistance Branch II 2920 Brandywine Road, MS K-14, Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and handcarried, in the depository located in 2:00pformtext until local time 06/11/2012 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Linda Williams

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2692

C. E-MAIL ADDRESS

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention Procurement and Grants Office, Acquisition and Assistance Branch II, 2920 Brandywine Road, MS K-14, Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

Base Period: 9/1/2012 – 8/31/2014

ITEM

Vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations in accordance with the Performance Work Statement (PWS) and to be cited on individual Task Orders.

All pricing will be submitted with task order proposals

Option Period I: 9/1/2014 – 8/31/2016

ITEM

Vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations in accordance with the Performance Work Statement (PWS) and to be cited on individual Task Orders.

Option Period II: 9/1/2016 – 8/31/2018

ITEM

Vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations in accordance with the Performance Work Statement (PWS) and to be cited on individual Task Orders.

Option Period III: 9/1/2018 – 8/31/2020

ITEM

Vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations in accordance with the Performance Work Statement (PWS) and to be cited on individual Task Orders.

Option Period IV: 9/1/2020 – 8/31/2022

ITEM

Vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations in accordance with the Performance Work Statement (PWS) and to be cited on individual Task Orders.

B.1 GENERAL

The purpose of this indefinite delivery, indefinite quantity (IDIQ) contract is to provide the Centers for Disease Control and Prevention (CDC), National Center for Emerging and Zoonotic Infectious Diseases (NCEZID), Division of Healthcare Quality Promotion (DHQP), Immunization Safety Office (ISO), an “as needed” mechanism to obtain required services through the issuance of individual task orders in support of vaccine safety monitoring and evaluation that meet public health priorities for CDC. Work performed under this contract will be based on the following technical requirements: VSD Project infrastructure activities; Active surveillance and monitoring; and Epidemiologic studies and evaluations.The awardees of the resultant contracts, independently and not as an agent of the United States Government, shall furnish personnel, facilities, supplies and equipment (except that specifically addressed within the individual task order) necessary to perform the individual Task Orders under the contract.

B.2 TASK ORDER CONTRACT

Orders for services will be placed by individual Request for Task Order Proposals (RFTOPs) under this contract in accordance with Section C.5, Technical Requirements and other applicable contract clauses.

The types and number of awards will be based on the government’s best value determinations (considering technical quality and proposed cost) of the proposals submitted. Ordering under this contract will be conducted through task orders. RFTOPs will be competed among eligible contractors in unless an exception to competition is authorized by the Contracting Officer in accordance with Federal Acquisition Regulations (FAR) 16.505.

B.3 TYPE OF CONTRACT

This is a multiple award, IDIQ type contract. At the discretion of the Contracting Officer, the government may use a variety of task order types under this contract, including Firm Fixed Price(FFP), Labor Hours (LH), Time and Materials (T&M), and Cost Plus Fixed Fee (CPFF) contracts.

Each RFTOP issued under this contract will identify the Government’s determination of task order type.

B.4 MINIMUM GUARANTEE

The contract guarantees that task orders amount to a minimum of $3,000. In the event that during its contract term the contractor receives obligations of less than this minimum, the Government will fund the difference between the actual obligation and the guaranteed minimum.

B.5 MAXIMUM CONTRACT AMOUNT

The contract ceiling amount is $200,000,000.00 B.6

BASE AND OPTION PERIODS

The term of this IDIQ contract is a two (2) year base period and four (4) two-year option periods, comprising a ten (10) year ordering period if all options are exercised by the Government.

B.7

SERVICE CONTRACT ACT

The contract labor categories are considered bona fide executive, administrative, professional labor and generally exempt from the Service Contract Act. Each RFTOP will be reviewed for applicability.

B.8 CONTRACT ADMINISTRATION

Please submit any and all questions in writing to Linda Williams at luw9@cdc.gov . All questions must be submitted in writing by e-mail NLT Monday, May 21, 2012.

B.9 ADDITIONAL INFORMATION

See section L for important information as to what is required to be submitted in response to this request for proposal (RFP).

Section C - Description/Specification/Performance Work Statement Title: Vaccine Safety Datalink Project

C.1 Background and Need

High vaccination coverage has significantly reduced vaccine-preventable disease morbidity and mortality worldwide, especially among children. Vaccines are generally regarded as safe and effective; however serious adverse events following immunization (AEFI) can occur. While vaccine safety is rigorously assessed during pre-licensing clinical trials, sample sizes are not adequate to detect rare adverse events, long term adverse events are not examined, and populations are not heterogeneous. In recent years, public concerns about the safety of vaccines have grown. Immunization safety programs are an important component to inform public policy and maintain the public trust in our national immunization program. Close monitoring of vaccine safety protects the public’s health and contributes to safer vaccines and vaccination practices.

The Vaccine Safety Datalink (VSD) project, created in 1990 by Centers for Disease Control and Prevention (CDC), is a post-licensure vaccine safety system that has made important contributions to addressing urgent questions about vaccine safety and other immunization-related issues and has helped inform US vaccination policy. Through its partnership with participating US managed care organizations, the VSD has adapted to a changing environment over time. Such adaptations include the development of a distributed data model and the development of dynamic data files as well as the implementation of near-real time adverse event monitoring for new vaccines. In addition, the evolution of the VSD has allowed for increase of the population under study, creation of innovative study designs and statistical methodologies, and the ability to expand to other data sources.

With the current vaccine safety contract mechanism coming to an end, the Immunization Safety Office seeks to continue to conduct rigorous vaccine safety evaluation and monitoring through a large, diverse, population-based system.

C.2 Project Objectives

The purpose of the VSD Project IDIQ contract is to provide the Centers for Disease Control and Prevention (CDC), Division of Healthcare Quality Promotion (DHQP), Immunization Safety Office (ISO) an “as needed” mechanism to obtain required services through the issuance of individual task orders in support of vaccine safety monitoring and evaluation that meet public health priorities for CDC.

1) Overview of contract requirements for the VSD Project

i. Execute awarded task orders under three technical requirements

· VSD Project infrastructure activities

· Active surveillance and monitoring

· Epidemiologic studies and evaluations

ii. Furnish Monthly and Annual Progress Reports as required on individual task orders.

2) VSD Project Objectives: The purpose of this project is to conduct vaccine safety research and surveillance. Contractors will provide a data infrastructure and expertise in which adverse events following immunization can be evaluated and that can support the enhancement and development of vaccine safety methodologies. The objectives of the VSD project are divided into two categories: Scientific and Programmatic.

Scientific Project Objectives

1) Monitor and evaluate the safety of newly licensed vaccines

2) Evaluate the safety of new vaccine recommendations for existing vaccines

3) Evaluate clinical disorders following immunizations

4) Assess vaccine safety in special high-risk populations

5) Develop and evaluate methodologies for vaccine safety assessment

6) Respond to vaccine safety concerns and/or vaccine safety signals through ad-hoc analyses and studies

Programmatic Project Objectives

1) Create quality core data infrastructure through administrative/computerized data-files and data linkages in order to efficiently conduct vaccine safety monitoring and evaluation,

2) Ensure quality data by regularly conducting data quality and data assurance checks

3) Ensure access to additional data sources such as medical chart review, member surveys, and ad-hoc data sources

4) Establish a secure distributed data model which allows each participating contractor to maintain ownership of their data while allowing access to researchers in order to transfer analytic datasets and/or summarized output and to conduct vaccine safety monitoring and evaluation.

5) Ensure high quality research though a rigorous research proposal process

6) Rigorously evaluate and monitor the safety of vaccines and respond to emerging vaccine safety concerns

7) Participate in a data sharing program, as outlined in the National Center for Health Statistics Research Data Center’s Guidelines for Proposal Submission (http://www.cdc.gov/nchs/data/r&d/guidelines_10_14_08c.pdf) C.3 Contract Structure

The basic contract will establish the general scope and ordering period for task orders to be issued against this contract. The term of this IDIQ contract is a two (2) year base period and four (4) two-year option periods, comprising a ten (10) year ordering period if all options are exercised by the Government. It is anticipated that multiple task orders will be issued to the contractors to work on VSD in areas identified in this Scope of Work. Each task order shall have a discrete period of performance independent of the basic contract and no task order shall extend more than six (6) months beyond the expiration date of the basic contract.

Individual task orders exceeding $3,000 not awarded to all contractors will be competed in accordance with the fair opportunity process described in FAR 16.505(b)(1) unless an exception to fair opportunity in documented in accordance with FAR 16.505(b)(2). All tasks orders will be solicited by email. Contractors will have a minimum of 10 calendar days to respond.

C.4 Scope of work

The purpose of this contract is to create a data infrastructure that will allow the Government and contractors to conduct work surrounding the monitoring and evaluation of adverse events following vaccination.

The three main requirements for this VSD IDIQ include:

1. Conduct high-quality VSD infrastructure activities that will allow for scientifically rigorous and efficient monitoring of vaccine safety.

2. Conduct active surveillance and monitoring of adverse events following immunization

3. Evaluation of selected vaccine safety questions or select questions that support future vaccine safety questions by analysis of data through single- and multi-site studies

C.5 Technical Requirements

5.1 - Requirement 1: Conduct VSD infrastructure activities that will allow for scientifically rigorous and efficient monitoring of vaccine safety.

The contractor, as an independent organization and not as an agency of the Government, shall furnish the personnel, facilities, equipment, and supplies necessary to establish a working infrastructure to support both project support services as well as data management of VSD data files.

Under this contract requirement, contractors will conduct all activities that would support the management and development of work within the VSD as required in the applicable Task Orders. This includes all program support tasks that support the VSD. Examples of such work include participation on VSD conference calls, working groups, site visits, and annual meetings. It also includes management of overall project activities such as study tracking, Institutional Review Board (IRB) and Data Use Agreement (DUA) documentation as well as support for external presentation of ongoing VSD work.

In addition to program support services, creation and maintenance of a high quality data infrastructure is considered an ongoing need of the government so that rigorous and efficient vaccine safety monitoring and evaluation can be conducted. The contractor shall establish a study population for all ages whose total medical history of health care encounters is readily accessible electronically. Data created from the study population will be organized following a standardized data dictionary in which data will be accessed through a distributed data model. Data will be available through annual data files and well as through data files that are updated on a more frequent basis (weekly or monthly). The contractor shall be responsible for maintaining the integrity of each data file on a continual basis by repeated error checking and editing procedures. The contractor shall be responsible to conduct chart reviews for up to 0.03% of their total enrolled population per year as a necessary part of the VSD infrastructure.

Deliverables: to be specified within individual task orders.

5.2 - Requirement 2: Active Surveillance and Monitoring of Adverse Events following Immunization.

Work under this requirement will include all activities, as identified by the Government, regarding the active surveillance and monitoring of adverse events following immunization. Vaccine safety active surveillance and monitoring can occur for vaccines that are recently licensed or with new immunization recommendations, as well as for specific adverse health outcomes following vaccinations of interest. Specific vaccine safety surveillance projects will be identified through a surveillance task order on an annual basis but may be also implemented ad hoc, particularly to monitor adverse health outcomes that may be designated as a potential vaccine safety concern (i.e., “signal”) or in emergency situations. Surveillance protocols may be written by CDC or a task order may be issued for a protocol to be written. Additional task orders may be issued for contractors to contribute data for surveillance studies as well as conduct chart review according to the written protocol.

VSD conducts near real-time monitoring for vaccines that have been recently licensed or with new recommendations called Rapid Cycle Analysis (RCA). RCA is a near real-time surveillance method that uses sequential statistical methodologies. Examples of active vaccine safety surveillance activities using RCA that may be conducted through this contract requirement include:

1. Influenza vaccine safety

2. PCV 13 vaccine safety in adults

3. HPV4 vaccine safety among males

4. HPV2 vaccine safety among females

Other types of surveillance and monitoring may include screening analyses of vaccines using non-sequential statistical methodologies, outcomes based surveillance which is surveillance of health outcomes following many vaccines, and other data mining methods. Through this requirement, it is expected that surveillance activities will be conducted in an efficient manner, including expeditious processes for IRB and DUA approvals and modifications. During the period of surveillance, response to a potential vaccine safety signal may be required. Contractors will be required to conduct signal assessment/refinement/investigation. Any contractor leading a specific surveillance analysis for which a signal arises will be required to conduct signal verification and follow-up. Contractors contributing data (participating on the surveillance analysis) in which a potential signal arises will conduct chart review as needed in order to provide support for signal verification and follow-up.

Results shall be documented and submitted as required by applicable Task Orders.

Deliverables: to be specified within individual task orders.

5.3 - Requirement 3: Evaluation of selected vaccine safety questions by analysis of data through single- and multi-site studies.

Specific studies will be ordered as individual subtasks on an as needed basis under this requirement. The contractor shall perform studies or contribute data for studies as required by applicable Task Orders. Studies may be led by the Government or a task order may be issued in which one contractor will be selected to lead a study. Additional task orders may be issued for participation for contractors to contribute data for specific studies as well as conduct chart review.

Vaccine safety studies or studies that may support future vaccine safety studies may include automated data only (i.e. standardized data files that follow the VSD data dictionary) or may use automated data supplemented with other types of data such as additional electronic data (pharmacy, laboratory data), medical record review, interviews with patients, surveys, or clinical or laboratory information. The contractor shall evaluate new methodologies for vaccine safety as part of this requirement. Results shall be documented and submitted as required by applicable Task Orders. The contractor shall attend technical reviews, meetings, conference calls, and conferences as required.

Deliverables: to be specified within individual task orders.

(End of Clause)

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E - Inspection And Acceptance

E.1 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Project Officer) at the destination of the articles, services or documentation.

(End of Clause)

Section F - Deliveries Or Performance

F.1 Deliverable(s) Schedule (Jul 1999)

Deliverables requirements will be as set forth in individual task orders.

(End of Clause)

F.2 Period of Performance (Task/Delivery Order Contracts) (Jul 1999)

(a) Contract: The term of this IDIQ contract is a two (2) year base period and four (4) two-year option periods, comprising a ten (10) year ordering period if all options are exercised by the Government.

(b) Task Orders: The time for completion for each task or delivery order shall be determined under each individual task or delivery order through the mutual agreement of the parties involved. Task/delivery orders under this contract may be awarded by the Contracting Officer at any time within the contract period. The actual performance of the work shall not extend more than 6 months beyond the basic contract period of performance.

F.3 Place(s) of Performance (Jul 1999)

The Contractor shall perform all work under this contract at the contractor’s facilities..

(End of Clause)

Section G - Contract Administration Data G.1 Evaluation of Contractor Performance (Service) (Jan 2000)

(a) Purpose

In accordance with FAR 42.1502, the Contractor's performance will be periodically evaluated by the Government, in order to provide current information for source selection purposes. These evaluations will therefore be marked “Source Selection Information.”

(b) Performance Evaluation Period

The Contractor's performance will be evaluated at least annually.

(c) Evaluators The performance evaluation will be completed jointly by the Project officer and the Contracting officer.

(d) Performance Evaluation Factors The contractor's performance will be evaluated in accordance with the attachment listed in Section J titled Performance Evaluation Report.

(e) Contractor Review A copy of the evaluation will be provided to the contractor as soon as practicable after completion of the evaluation. The contractor shall submit comments, rebutting statements, or additional information to the Contracting Officer within 30 calendar days after receipt of the evaluation.

(f) Resolving Disagreements Between the Government and the Contractor Disagreements between the parties regarding the evaluation will be reviewed at a level above the Contracting Officer. The ultimate conclusion on the performance evaluation is a decision of the contracting agency. Copies of the evaluation, contractor's response, and review comments, if any, will be retained as part of the evaluation.

(g) Release of Contractor Performance Evaluation Information The completed evaluation will not be released to other than Government personnel and the contractor whose performance is being evaluated. Disclosure of such information could cause harm both to the commercial interest of the Government and to the competitive position of the contractor being evaluated as well as impede the efficiency of Government operations.

(h) Source Selection Information Departments and agencies may share past performance information with other Government departments and agencies when requested to support future award decisions. The information may be provided through interview and/or by sending the evaluation and comment document to the requesting source selection official.

(i) Retention Period The agency will retain past performance information for a maximum period of three years after completion of contract performance for the purpose of providing source selection information for future contract awards.

G.2 Payment by Electronic Funds Transfer (Dec 2005)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer – Central Contractor Registration, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Financial Management Office at (404) 498-4050.

(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 30333 Or – Fax copy to: 404-638-5342 (End of Clause)

G.3 Electronic Subcontracting Reporting System (eSRS) (Dec 2005)

The contractor shall register with the Electronic Subcontracts Reporting System (eSRS) for the submission of its Individual Subcontract Report (SF 294) and the Annual Summary Reports (SF 295). Before registering in eSRS, the contractor information must be correct in Central Contractor Registration database. The eSRS is a world wide web-based application available at: http://www.esrs.gov. The eSRS website provides training and instruction for data submission.

(End of Clause)

G.4 Invoice Submission

(a) The Contractor shall submit the original contract invoice/voucher to the shown below:

The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 30333 Or – The Contractor may submit the original invoice/voucher via facsimile or email:

Fax: 404-638-5324 Email: FMOAPINV@CDC.GOV NOTE: Submit to only one (1) of the above locations.

(b) The contractor shall submit 1 copy of the invoice/voucher to the cognizant contracting office previously identified in this contract. These invoices/voucher copies shall be addressed to the attention of the Contracting Officer. luw9@cdc.gov

(c) The Contractor is required to submit a copy of each invoice directly to the Contracting Officer Technical Representative concurrently with submission to the Contracting Officer. JGee@cdc.gov

(d) In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Financial Management Office is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(e) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Task Order Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice

(11) Name, title and telephone number of person to be notified in the event of a defective invoice.

(12) Payment Address, if different from the information in (c)(1).

(13) DUNS + 4 Number (End of Clause) G.5 Payment (Performance-Based Services) (Jul 1999)

(a) General

It is the objective of the Government to obtain complete and satisfactory performance in accordance with the terms of the specifications and requirements of this contract. The procedures set forth in the clause entitled Criteria for Deductions will be used by the Government in determining monetary deductions for nonperformance of work under this contract, or for deficiencies in the performance of work, and supplements the Inspection of Services clause contained in Section E of this contract.

(b) Adjusting Payments

(1) Under the Inspection of Services clause of this contract, payments may be adjusted if any service does not conform with contract requirements. The Contracting Officer or a designated representative will inform the Contractor, in writing, of the type and dollar amount of proposed deductions by the l0th workday of the month following the performance period for which the deductions are to be made.

(2) The Contractor may, within 10 working days of receipt of the notification of the proposed deduction, present to the Contracting officer specific reasons why any or all of the proposed deductions are not justified. Reasons must be solidly based and must provide specific facts that justify reconsideration and/or adjustment of the amount to be deducted. Failure to respond within the 10 day period will be interpreted to mean that the Contractor accepts the deductions proposed.

(3) All or a portion of the final payment may be delayed or withheld until the Contracting Officer makes a final decision on the proposed deduction. If the Contracting Officer determines that any or all of the proposed deductions are warranted, the Contracting officer shall so notify the Contractor, and adjust payments under the contract accordingly.

(End of Clause)

G.6 Criminal Liability (Jan 2000)

It is understood that disclosures of information relating to the work or services hereunder to any person not entitled to receive it, or failure to safeguard any classified information as defined in Executive Order 11652 that may come to the Contractor or any person under the Contractor’s control in connection with the work under this contract, may subject the Contractor, his agents or employees to criminal liability under Title 18, Section 793, 794 and 798 of the United States Code.

G.7 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

G.8 Contract Communications/Correspondence (Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

G.9 Contracting Officers Technical Representative (COTR) Technical Guidance (Sep 2009)

CDC0_G008 Contracting Officers Technical Representative (COTR) Technical Guidance

Performance of the work hereunder shall be subject to the technical directions of the designated COTR for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the Contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction. If the Contractor fails to provide the required notification within the said two (2) week period that any technical direction exceeds the scope of the contract, then it shall be deemed for purposes of this contract that the technical direction was within the scope. No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government COTR is not authorized to change any of the terms and conditions of this contract. Changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the delegation memorandum for the COTR. Any changes in COTR delegation will be made by the Contracting Officer in writing with a copy being furnished to the Contractor.

(End of Clause) G.10 Task Orders Task orders are officially awarded by the Contracting Officer that commission work for a specific CDC organization for a defined function or purpose. Task orders can have one or more deliverable products or recurring services required. Task orders specify and authorize work to be accomplished by the Contractor to satisfy the Government’s requirements. They specify the scope of work, schedule for completion, technical requirements, deliverable product(s) and/or services, performance standards, acceptance criteria for deliverable products and/or services, and the total price/cost of the work/service to be performed. Subsequent work orders can be issued under the task order to further specify the nature of the work, instructions to follow, deliverables to produce, etc.

Contracting Officers Technical Representatives are officials of the organization requiring the work who are responsible at the task order level for technical oversight of the work. Contracting Officer’s Technical Representatives may designate Technical Contacts within their organizations to provide the Contractor with additional technical contact points for day-to-day technical guidance, problem solving and liaison. Neither Contracting Officer’s Technical Representatives nor Technical Contacts are authorized to make any changes to task orders or waive any contract requirements.

(End of Clause)

Section H - Special Contract Requirements

H.1 HHSAR 352.239-70 Standard for Security Configurations (Oct 2009)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops--regardless of function--but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Approved security configurations are identified in NIST checklists (http://web.nvd.nist.gov/view/ncp/repository) or contained in a DoD DISA security technical implementation guide or security checklist http://iase.disa.mil/stigs/index.html. If CDC specific security configuration requirements are later determined to apply, they will be provided subsequent to contract award and incorporated by contract modification.

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings--see http://nvd.nist.gov/validation.cfm. The

Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart

4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause)

H.2 HHSAR 352.239-71 Standard for Encryption Language (Oct 2009)

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered ``sensitive'' in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause)

H.3 HHSAR 352.239-72 Security Requirements for Federal Information Technology Resources (Oct 2009)

(a) Applicability. This clause applies whether the entire contract or order (hereafter ``contract''), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term ``information technology (IT)'', as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their--

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)--due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)--due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)--due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)--due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems--see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in ``HHS-Controlled Facilities and Information Systems Security'' requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COTR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and…