RFP_2014-N-15787.pdf

PAGES

15A. NAME

AND

ADDRESS

OF

OFFEROR

SEC. PAGE(S) SEC. PAGE(S)

(Date) (Hour)

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amend-ments to the SOLICITATION for offerors and related documents numbered and dated:

(Type or Print)

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

1 76

2. CONTRACT NO.

3. SOLICITATION NO.

2014-N-15787

4. TYPE OF SOLICITATION

SEALED BID (IFB)

X NEGOTIATED (RFP)

5. DATE ISSUED

03/03/2014

6. REQUISITION/PURCHASE

NO.

00HCVLC1-2014-67758

7. ISSUED BY CODE 2543 8. ADDRESS OFFER TO (If other than Item 7)

Centers for Disease Control and Prevention (PGO)

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 5 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in until 2:00p local time 4/2/2014

CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Patrick Winders

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2669

C. E-MAIL ADDRESS

vxx6@cdc.gov

11. TABLE OF CONTENTS

(x) DESCRIPTION (x) DESCRIPTION

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 44

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 4 X J LIST OF ATTACHMENTS 58

X D PACKAGING AND MARKING 17 PART IV – REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 18 REPRESENTATIONS, CERTIFICATIONS, AND

X F DELIVERIES OR PERFORMANCE 19 X K OTHER STATEMENTS OF OFFERORS 59

X G CONTRACT ADMINISTRATION DATA 21 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 65

X H SPECIAL CONTRACT REQUIREMENTS 25 X M EVALUATION FACTORS FOR AWARD 73

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

AMENDMENT NO. DATE AMENDMENT NO. DATE

CODE FACILITY 16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 2543 25. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention (PGO)

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE Prescribed by GSA

FAR (48 CFR) 53.214©

K

Section B - Supplies Or Services And Prices/Costs

ITEM SUPPLIES / SERVICES

0001 DGMQ Support Services IDIQ

0002 Travel and Other Direct Costs

0003 Optional Requirements

B.1 GENERAL

The purpose of this indefinite delivery, indefinite quantity (IDIQ) contract is to provide the Centers for Disease Control and Prevention (CDC), National Center for Emerging and Zoonotic Infectious Diseases (NCEZID), Division of Global Migration and Quarantine, an “as needed” mechanism to obtain required services through the issuance of individual task orders. This is an 8(a) competitive acquisition.

B.2 TASK ORDER CONTRACT

Orders for services will be placed by individual Requests for Task Order Proposal (RFTOP) under this contract in accordance with Section C.3, Performance Requirements and other applicable contract clauses.

The types and number of awards will be based on the government’s best value determinations (considering technical quality and proposed cost) of the proposals submitted. Ordering under this contract will be conducted through task orders. RFTOPs will be competed among eligible contractors in unless an exception to competition is authorized by the Contracting Officer in accordance with Federal Acquisition Regulations (FAR) 16.505.

B.3 TYPE OF CONTRACT

This is a multiple award, Indefinite Delivery, Indefinite Quantity (IDIQ) type contract. At the discretion of the Contracting Officer, the government may use a variety of task order types under this contract, including Fixed Price, Labor Hours, Time and Materials, and Cost type contracts. As such, applicable clauses for each contract type have been included. Each RFTOP issued under this contract will identify the Government’s determination of task order type.

B.4 MINIMUM GUARANTEE

The contract minimum is $2,000. 00.

B.5 MAXIMUM CONTRACT AMOUNT

The contract ceiling amount is $55,000,000.00.

B.6 Ordering Period

The term of this IDIQ contract is a five (5) year ordering period.

B.7 SERVICE CONTRACT ACT

The contract labor categories are considered bona fide executive, administrative, professional labor and generally exempt from the Service Contract Act. Each RFTOP will be reviewed for applicability.

B.8 ADDITIONAL INFORMATION

See section L for important information as to what is required to be submitted in response to this request for proposal (RFP).

Section C - Description/Specification/Work Statement

Division of Global Migration and Quarantine Professional Services IDIQ

C.1.0 Background & Need

The Division of Global Migration and Quarantine (DGMQ) aims to prevent the introduction, transmission, or spread of communicable diseases from foreign countries into the United States. Major activities include administering regulations related to travelers and imported animals and animal products; developing and coordinating disease screening programs for immigrants and refugees; overseeing CDC quarantine stations; disseminating health information for international travelers; developing measures to prevent the introduction of zoonotic diseases into the United States; and identifying diseases in mobile populations.

To carry out the mission, DGMQ use many different tactics: providing leadership in public health, conducting exemplary science, strengthening preparedness efforts, establishing public health policy, and sharing vital health information with the public and building partnerships.

DGMQ is working on a number of important initiatives including program and performance management, communications and collaboration, research, public health program development and management and program operational support services. In order to accomplish these projects, DGMQ requires contractor support. DGMQ requires support in the approaches and processes for developing and maintaining these as well as potential future initiatives which may be driven by new or emerging legislation or public health requirements.

C.1.1 Project Objectives

To reduce morbidity and mortality among immigrants, refugees, travelers, expatriates, and other globally mobile populations, and to prevent the introduction, transmission, and spread of communicable diseases through regulation, science, research, preparedness, and response.

C.1.2 Scope

The Contractor shall provide non-personal support services and provide deliverables in support of DGMQ as outlined in individual Task Orders. Skill category requirements will include Professional/Technical and General Administrative. The Government will issue performance based Task Orders to the Contractor for individual tasks and projects. Each task order will specify the task, location, service to be provided, performance matrix, level of effort, hourly rates and any contractual terms applicable to the task order. The Contractor shall provide all necessary labor, supervision, materials and equipment, and management to accomplish the identified task/project. The Contractor is responsible for providing timely performance and quality personnel in pursuit of work efforts detailed in all individual orders.

Task Orders will specifically define the scope of the project and schedule of deliverables (if applicable), along with performance standards (if applicable). The Contractor shall perform this work only as required in Task Orders issued by the Government. The Contractor is advised that it is not possible to determine the precise types or amounts of services that will be ordered during the term of the contract. The time of issuance and amount of work in Task Orders cannot be accurately predicted. The labor categories will be used to provide services such as Technical, Professional, Administrative Support, and other General Services and Support requirements outlined in the Statements of Work associated with each Task Order. The Government will reserve the right to negotiate the addition of new labor categories at any time to meet requirements. For each issued task order, the Contractor will propose those labor categories needed to complete the work most efficiently. The Contractor will provide a highly motivated, dedicated, professional staff to perform non-personal services, applicable to the schedule awarded, to support DGMQ programs.

C.2 General Requirements

CDC will award an Indefinite delivery, indefinite quantity (IDIQ) contract that:

o Ensures that CDC has ongoing timely, high quality, cost-effective, efficient, innovative, and comprehensive professional, scientific, and administrative consulting services in as needed leveraging industry best practices and professional standards;

o Ensures related and interdependent functions and disciplines are covered in the contract services;

o Provides a comprehensive performance and solutions-based contract; and o Contributes to the achievement of DGMQs mission and program goals.

C.2.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (CO) immediately.

C.2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

C.2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

C.2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor must maintain continuity between the support operations at the locations listed below and the contractor's corporate offices.

Centers for Disease Control and Prevention Division of Global Migration & Quarantine 1600 Clifton Rd NE Building 16 Atlanta, GA 30329

Centers for Disease Control and Prevention 602 Webb Ginn House Road, Building A Lawrenceville, GA 30045

CDC Atlanta Quarantine Station Hartsfield-Jackson Atlanta International Airport, Concourse F 2600 Maynard H. Jackson Blvd., Suite 2425J Atlanta, GA 30354

CDC Detroit Quarantine Station 2613 World Gateway Place, McNamara Terminal, Bldg. 830 Detroit Metro Airport Detroit, MI 48242

CDC EL PASO Quarantine Station 601 Sunland Park Drive, Ste. 200 El Paso, TX 79912

CDC Miami Quarantine Station Miami International Airport Miami, FL 33126 Terminal Bldg., 3rd Floor Concourse D Miami, FL 33122

Minneapolis St Paul International Airport Lindbergh Terminal 4300 Glumack Drive, Suite G-2256 St Paul, MN 55111-3010

CDC San Diego Quarantine Station 3851 Rosecrans St., Suite #715 San Diego, CA 92110-3115

C.2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support contracts or task orders. The contractor shall assign work effort and maintaining proper and accurate time keeping records of personnel assigned to work on the requirement.

C.2.3.3 Personnel Administration

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees.

C.2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement.

The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Contracting Officer (CO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

C.2.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as defined in the Labor Categories document (see attachment J.1), labor rates, and man-hours utilized in the performance of each Task Order (PWS line item) issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

C.2.6 Travel / Temporary Duty (TDY)

Travel to other government facilities or other contractor facilities may be required and will be specified in the PWS.

All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs and in accordance with Federal Travel Regulation and Joint Travel Regulations.

C.3 Performance Requirements

The following section specifies the Performance Objectives and Performance Elements for the contract.

C.3.1 Provide timely and high-quality responses to requests for Task Orders for services

Performance Standards

a) STANDARD: Submit Task Order proposals within two weeks.

C.3.1.1 The Contractor shall provide responses for services as defined in Task Orders for public health program development, management, and operations.

Development, enhancement and operation of various program operations support services, including administrative support, are needed to maintain ongoing operations and maintain accountability and transparency. DGMQ research and laboratory activities require support in developing and implementing research studies.

Research support/data management: Includes designing and producing tools and materials to support data collection and surveys; providing support for epidemiological investigations;

supporting and conducting data collection and surveys; developing, cleaning, and maintaining data, surveillance systems, and databases; conducting analysis of data;

conducting literature searches and reviews; summarizing case data; monitoring reports for timeliness, completeness, and accuracy; providing recommendations for improvement of systems; conducting training; participating in site visits; entering data; coordinating data entry; coordinating scientific sessions; developing reports, protocols, abstracts and presentations.

Statistical support: Includes identifying methodologies, measures, and research questions for assessment and summarization of findings; initiating, formulating, planning, and executing analytic research projects; selecting and recommending appropriate statistical and epidemiologic techniques and databases; assisting in developing and managing databases for analysis; maintaining quality control programs; ensuring reliability and consistency of the data; providing technical assistance on the use of complex statistical and epidemiologic techniques; serving as technical expert in all phases of statistical interpretation; preparing comprehensive reports of study results; and disseminating results of research projects in a wide range of venues including publications, peer reviewed journals, summaries, manuscripts, and special reports.

Administrative support: Includes providing general administrative and clerical support for project tasks including word processing, filing; graphics, editing, database maintenance, and quality assurance; providing expertise to CDC staff on administrative process and procedures; providing time clerk services; processing travel arrangements, schedules, approvals, authorizations, and vouchers; preparing executive correspondence; recording meeting minutes; preparing reports; assisting with development of presentations and briefing documents; developing recommendations for program policies, procedures, and implementation; developing, tracking, maintaining, and processing files regarding staffing;

and scheduling support.

Fiscal Analysis Support: Includes assisting with the development and execution of financial planning and budget execution on a fiscal year basis; preparing detailed analyses and estimating funding needs to assist management with operation planning and decision-making; developing project guidelines, monitoring financial resources, tracking expenditures, and formulating long and short-term project goals and objectives to ensure benchmarks are met; projecting financial trends; presenting interpretations and findings through spreadsheets, written, and graphical communication; developing recommendations for resources needed for program development and implementation; assisting the formulation of program goals, objectives, operating policies or reports; assisting with the development of Standard Operating Procedures for procurement and budget; reviewing unliquidated obligations; and monitoring purchases and expenditures.

Human resource planning and development: Includes preparing, analyzing, executing, and following up on personnel actions; developing and supporting implementation of personnel standard operating procedures; and providing subject matter expertise and making recommendations on personnel issues.

Facilities and logistics support: Includes planning and logistical support for international and domestic visitors, meetings, conferences, and audio visual and virtual meetings; managing property documentation; preparing reports; assisting with development of presentations and briefing documents; coordinating on-boarding of new staff; developing recommendations for program policies, procedures, and implementation; managing mail, supplies, and equipment; developing, tracking, maintaining, and processing files regarding procurement, property inventory, work requests, and office and storage space.

Project management: Includes creating, managing, and maintaining user accounts, websites, databases, and systems; identifying and resolving system, policy, and procedure issues and challenges; maintain protocols and procedures; managing documents; providing end-user training; coordinate clearance and award submissions; creating reports; providing project management expertise; coordinating informatics projects; and collecting user needs and feedback.

Public Health Program Development and Implementation: develop maps using a variety of mapping tools; managing and querying databases; preparing responses to inquiries;

coordinating, developing; and providing training; coordination and communication with internal and external public health partners and other subject matter experts; data analysis;

preparing reports, communication, and correspondence materials; planning, developing and carrying out field surveillance, protocols, applications, systems, interventions, investigations, training, education, and evaluations; provide public health, medical, mapping, laboratory policies and procedures, preparedness and response planning and exercising, and mobile and web applications subject matter expertise; provide diagnosis and classifications of waiver and medical record reviews; participating in, coordinating, and implementing site visits and emergency response planning, exercising, and execution; conducting proficiency testing; shipping and management of laboratory specimens and reagents; developing templates, protocols, reports, abstracts and presentations.

Performance Standards

a) STANDARD: Quality of content of Task Order proposals are implementable.

C.3.1.3 The Contractor shall provide responses for services as defined in Task Orders for data entry and help desk services.

Management and operations of a Data Entry Center are required.

Management of the EDN Data Entry Center: Includes setting-up and logistics of the data entry center; managing personnel issues, scheduling, timekeeping, and monitoring performance; updating training materials and conducting training; and maintaining and fulfilling user approval procedures and documentation.

Data Entry and Processing: Includes organizing, filing, and recording receipt of documents; investigating delayed documents and discrepancies; scanning forms and entering data into an established data entry system; interpreting handwritten medical data from DS forms; documenting and reporting data errors; and updating standard operating procedures and manuals.

Shipping Requirements/Forms Management: Includes shipping records; storing documents in an orderly manner; conducting quality assurance on scanning and data entry; disposal of documents according to records retention schedules; and documenting procedures.

Management of Help Desk: Includes monitoring, managing, resolving, and responding to help desk inquiries made by phone and email; documenting inquiries and resolutions;

investigating missing records and discrepancies identified in records; assisting with user access issues; updating distribution lists; relaying technical issues; developing reports;

and documenting procedures.

C.3.1.4 The Contractor shall provide responses for services as defined in Task Orders for performance management, strategic planning, and organizational improvement.

DGMQ requires various levels of consulting support services in refining and enhancing the organizations strategic plan, developing the organizational structure and related processes to support the strategic plan, as well as a variety of consulting services in which recommendations are provided on implementing the organizational design, managing changing and developing the workforce to meet organizational objectives.

Strategic planning

Organizational development

Project planning and control

Business process design and performance improvement

Metrics and performance management

Performance Standards

a) STANDARD: Quality of content of Task Order proposals are implementable.

C.3.1.5 The Contractor shall provide responses for services as defined in Task Orders for surge capacity and emergency response.

DGMQ may require support to assist in response efforts for a multitude of emerging zoonotic and infectious diseases.

Surge response services will be consistent with the services provided under C.3.1.1 – C.3.1.4

Performance Standards

a) STANDARD: Quality of content of Task Order proposals is implementable.

C.3.2 Timely and accurate responses to questions/concerns from COR and Contracting Officer

Performance Standards

a) STANDARD: Response time is within a range of an hour up to one day depending on the urgency and complexity.

C.3.3 Submit high quality and accurate monthly progress reports

Performance Standards

a) STANDARD: Reports of high quality, fully edited, and accurate submitted by the 15th of the month.

AQL: 95% of the time

C.3.4 Management of Task Orders

Performance Standards

a) STANDARD: COR receives no more than 4 valid complaints per 12 months.

C.3.5 Submit accurate monthly invoices for each Task Order

Performance Standards

a) STANDARD: No invoices will require suspension or disallowance due to mistakes, incompleteness or unallowable costs.

C.4 Special Requirements

This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

C.4.1 Transition

The contractor shall follow the transition plan submitted as part of the proposal and keep the Government fully informed of status throughout the transition period. Throughout the phase-in/phase-out periods, it is essential that attention be given to minimize interruptions or delays to work in progress that would impact the mission. The contractor must plan for the transfer of work control, delineating the method for processing and assigning tasks during the phase-in/phase-out periods.

C.4.2 Quality Assurance Surveillance Plan (QASP)

The Government shall monitor the Contractors performance under this Task/Delivery Order in accordance with the Governments QASP.

C.5 Monitoring:

CDC will monitor performance for the IDIQ contract based on monthly reports to ensure ceilings are not exceeded and performance is satisfactory on individual tasks.

C.6 Information Systems Security:

For all activities related to information system development completed under this IDIQ contract the contractor must adhere to the following IT security standards:

The below information is extracted from HHS-OCIO Policy for Information Systems Security and Privacy (IS2P) - Handbook, HHS Contractor Oversight Guide, FAR 39.101(d) and NIST Special Publications

Security Compliance http://intranet.hhs.gov/infosec/docs/policies_guides/PISSP/Policy%20for%20Information%20Systems%20Security%20and%20Privacy_appx%20A%20handbook.html http://intranet.hhs.gov/infosec/docs/policies_guides/PISSP/Policy%20for%20Information%20Systems%20Security%20and%20Privacy_appx%20A%20handbook.html http://intranet.hhs.gov/infosec/docs/policies_guides/COG/co_guide_toc.htm

This Performance Work Statement requires the successful offeror to have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government.

IMPORTANT NOTE TO OFFERORS: The following information shall be addressed in a separate section of the Technical Proposal entitled, “Information Security.” Information Security is applicable to this solicitation because all information systems developed, operated, or used by or on behalf of the Federal Government must comply with Federal Information Security laws, policies and standards. We provide the following information to assist in the preparation of proposals in order to assure that the existing data system, which would be licensed for use by CDC grantees and CDC employees, meet the security standards described below.

The EGovernment Act of 2002, (Federal Information Management Act) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government.

These are summarized below.

OMB Circular A-130 (http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system.

Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/drivers/documents/FISMA-final.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, offeror (including sub-offeror), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf), FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)

NIST Special Publication 800-18, Guide to Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf)

NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1- Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf).

NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf).

NIST Special Publication 800-63, Electronic Authentication Guideline (http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf) http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/ http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf

The Offeror should demonstrate understanding of security requirements by attaching a Draft Data System Security Plan or information system security plan (SSP). The SSP should be a brief and general narrative description of the system and its integration with the CDC Network Infrastructure.

The initial draft and all subsequent versions of the SSP must be prepared and submitted by the Offeror to the CDC contracting officer and to the CDC technical monitor, in Microsoft Word compatible format. The successful Offeror shall be responsible for ensuring that the security plan is acceptable to the CDC technical monitor and the NCEZID Center Information System Security Officer (ISSO) as well as any subsequent federal reviewers (e.g., Center and/or HHS officials, OMB officials, etc.). Comments shall be conveyed to the Offeror by the technical monitor and/or the contracting officer.

Once an award is made, the technical monitor and the contracting officer will review the draft SSP and any subsequent versions and submit recommendations/comments to the Offeror within 14 working days after receipt.

The Offeror shall incorporate the technical monitor’s recommendations and submit paper and electronic copies of the security plan to the contracting officer and to the technical monitor within five working days after receipt of the technical monitor's comments. The resultant contract will require the draft SSP to be finalized in coordination with the Contracting Officer’s Representative (COR) no later than 90 calendar days after contract award. Also, the successful Offeror, in conjunction with the CDC NCEZID ISSO, is required to update and resubmit its SSP to CDC every three years following award or when a modification has been made to its internal system. In addition to developing and maintaining an SSP, the successful Offeror in conjunction with the NCEZID ISSO shall be responsible for continuously assessing and assuring information security for the project and for updating the security plan as needed throughout the duration of the agreement.

The SSP is part of the Certification and Accreditation (C&A) process required by the EGovernment Act of 2002 and NIST Special Publication 800-18 and will include selected mandatory controls required by NIST Special Publication 800-53, Volume I & II. The successful offeror in conjunction with the NCEZID Information System Security Officer (ISSO) will submit C&A documentation to the CDC Chief Information Security Officer (CISO). The successful completion of the C&A documents will result in an award of an Authority To Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCEZID ISSO and confirmed by the CDC OCISO Certifying Authority as part of the Certification and Accreditation process.

The successful Offeror is responsible for providing pertinent security information to the NCEZID ISSO and Security Staff and assisting in completing the below CDC Certification and Accreditation documents. Appropriate security templates will be provided to the successful Offeror by the NCEZID Security Staff. Completed documents will be sent to the CDC Chief Information Security Officer (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

Baseline System Information (BSI)

Privacy Impact Assessment (PIA)

Host Characterization Worksheet (HCW)

System Security Plan (SSP)

Security Baseline Worksheet (SBW)

Business Continuity Plan (BCP)

Risk Assessment Report (RAR)

The Offeror shall respond to the following seven security–associated requirements in the application:

(1) Position Sensitivity Designations

CDC requires a Public Trust Level 5 for the following The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-offeror staff) working under the contract that will have the ability to access NCEZID sensitive information from the system. The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer shall notify the licensor of the appropriate level of suitability investigations to be performed, but Licensor employees and subcontractors who have met investigative requirements within the last five years may only require an updated or upgraded investigation. An electronic template, “Roster of Employees Requiring Suitability Investigations,” is available for offeror use at:

http://ais.nci.nih.gov/forms/Suitability-roster.xls. Upon receipt of the Government’s notification of applicable suitability investigations required, the Licensor shall complete and submit the required forms within 30 days of the notification.

Non-Disclosure Agreements The Offeror and any sub-Offerors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Offeror's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and offeror, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Offeror’s Official Responsible for Information Security

The offeror shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the offeror be selected for an award.

(4) Rules of Behavior

The offeror’s employees and subcontractors shall comply with the HHS Information Technology General Rules of Behavior.

(5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful offeror shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Offeror's expense and would be the Offeror's responsibility to plan and arrange.

http://ais.nci.nih.gov/forms/Suitability-roster.xls

The successful offeror shall maintain a listing of all individuals who have completed this training and shall submit this listing to the COR.

(6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS/CDC shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain sensitive CDC- data shall be encrypted using FIPS 140-2 compliant algorithms.

Performance Requirement Summary (PRS)

Statements Standards/AQLs Incentive/Remedy

C.3.1 Provide timely and high-quality responses to requests for Task Orders for services

a) Submit Task Order proposals within two weeks.

Performance will impact the Contractor performance evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future AGENCY contract selections are made.

C.3.1.1 The Contractor shall provide responses for services as defined in Task Orders for public health program development, management, and operations.

a) Quality of content of Task Order proposals are implementable.

evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future

C.3.1.2 The Contractor shall services as defined in Task Orders for communication, training, education, and collaboration.

evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future

C.3.1.3 The Contractor shall services as defined in Task Orders for data entry and help desk services.

evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future

C.3.1.4 The Contractor shall services as defined in Task Orders for performance management, strategic planning, and organizational improvement.

evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future

C.3.1.5 The Contractor shall services as defined in Task Orders for surge capacity and emergency response.

evaluation using the Contractor Performance Assessment Reporting System (CPARS). The evaluation will be considered when future

C.3.2 Timely and accurate responses to questions/concerns from COR and Contracting Officer

a) Response time is within a range of an hour up to one day depending on the urgency and complexity.

Contractor will have to respond to the question/concern. Both positive and negative customer service will be reported into

CPARS.

C.3.3 Submit high quality and accurate monthly progress reports

a) Reports of high quality, fully edited, and accurate submitted by the 15th of the month.

AQL: 95% of the time

Contractor shall re-perform at own expense.

C.3.4 Management of Task Orders

a) COR receives no more than 4 valid complaints per 12 months.

Contractor will have to respond to complaints and address appropriately. Both positive and negative customer service will be reported into

CPARS.

C.3.5 Submit accurate monthly invoices for each Task Order

a) No invoices per 12 months requiring suspension or disallowance due to mistakes, incompleteness or unallowable costs.

Contractor shall re-perform at own expense.

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E - Inspection And Acceptance

FAR SOURCE TITLE AND DATE

52.246-4 Inspection of Services – Fixed-Price (Aug 1996)

52.246-5 Inspection of Services – Cost-Reimbursement (Apr 1984)

52.246-6 Inspection – Time-and-Material and Labor-Hour (May 2001)

E.1 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the COR) at the destination of the articles, services or documentation.

(End of Clause)

Section F - Deliveries Or Performance

FAR SOURCE TITLE AND DATE

52.242-15 Stop-Work Order (Aug 1989)

F.1 Period of Performance (Task/Delivery Order Contracts) (Jul 1999)

(a) Contract: The ordering period of this contract shall be a period of 60 months from September 26, 2014 through August 31, 2019.

(b) Task Orders: The time for completion for each task or delivery order shall be determined under each individual task or delivery order. Task/delivery orders under this contract may be awarded by the Contracting Officer at any time within the contract period. The actual performance of the work may extend beyond the contract period;

however, all performance must be completed within 1 year of the expiration of the ordering period.

(End of Clause)

F.2 Place(s) of Performance (Jul 1999)

The Contractor shall perform all work under this contract at:

Division of Global Migration & Quarantine 1600 Clifton Rd NE Building 16 Atlanta, GA 30329

Centers for Disease Control and Prevention 602 Webb Ginn House Road, Building A Lawrenceville, GA 30045

CDC Atlanta Quarantine Station Hartsfield-Jackson Atlanta International Airport, Concourse F 2600 Maynard H. Jackson Blvd., Suite 2425J Atlanta, GA 30354

CDC Detroit Quarantine Station 2613 World Gateway Place, McNamara Terminal, Bldg. 830 Detroit Metro Airport Detroit, MI 48242

CDC EL PASO Quarantine Station 601 Sunland Park Drive, Ste. 200 El Paso, TX 79912

CDC Miami Quarantine Station Miami International Airport Miami, FL 33126 Terminal Bldg., 3rd Floor Concourse D Miami, FL 33122

Minneapolis St Paul International Airport Lindbergh Terminal 4300 Glumack Drive, Suite G-2256 St Paul, MN 55111-3010

CDC San Diego Quarantine Station 3851 Rosecrans St., Suite #715 San Diego, CA 92110-3115

F.3 Hours of Work

Accomplishment of the results contained in this PWS requires work at locations listed below and at various contractor, subcontractor, and Government facilities (mainly in the continental United States). Normal workdays are Monday through Friday except US Federal Holidays. Workers typically work eight (8) hours per day, 40 hours per week. Flextime workers start not earlier than 6:00 am and not later than 9:00 am. Core hours of work are from 9:00 am to 3:00 pm daily. All employees are expected to be available during core hours.

F.4 Deliverables

Each Task Order will specify the associated deliverables and delivery schedules. CDC will monitor performance for the task order based on monthly reports to ensure ceilings are not exceeded and performance is satisfactory.

Section G - Contract Administration Data

G.1 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

(End of Clause)

G.2 Contracting Officer’s Representative - COR (Jul 1999)

Performance of the work hereunder shall be subject to the technical directions of the designated Contracting Officer’s Representative for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the Contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction. If the Contractor fails to provide the required notification within the said two (2) week period that any technical direction exceeds the scope of the contract, then it shall be deemed for purposes of this contract that the technical direction was within the scope. No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government Contracting Officer’s Representative is not authorized to change any of the terms and conditions of this contract.