1_-_Solicitation_2014-N-16659__Revised.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2014-N-16659

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

09/16/2014

6. REQUISITION/PURCHASE NO.

0000HCWG-2014-73558

Centers for Disease Control and Prevention

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 2 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in N/A until 2:00 pm local time 10/21/2014 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Michael Crow

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-3208

C. E-MAIL ADDRESS

wyv2@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

Sample RFTOP #1 CLINs

This is a fixed price line item.

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

Limitation of Cost.

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Sample RFTOP #2 CLINs

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Sample RFTOP #3 CLINs

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Sample RFTOP #4 CLINs

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

Cost Reimbursable Line Item

Subject to FAR 52.232.20 –

1 Job

The Government intends to issue a single-award Indefinite Delivery/Indefinite Quantity (ID/IQ) contract consisting of one base period of twelve (12) months and four (4) one-year option periods. The aggregate maximum value of all task orders shall not exceed $5,000,000.00.

B.1 Task Order Contract

This is an Indefinite Delivery/Indefinite Quantity (ID/IQ) contract utilizing fixed-pricing (FP) Task Orders with cost reimbursable travel and other direct costs in accordance with Federal Acquisition Regulation (FAR) Part 16.

Individual Fixed Price (FP) task order proposals shall specify the price for labor, other direct/indirect costs, and profit to perform the services required of that specific task order.

Funds shall be obligated on each individual task order. The Contractor shall not exceed the amount negotiated for each individual task order without prior written approval of the Contracting Officer. The Government is not obligated to reimburse the Contractor for costs incurred in excess of the amount negotiated for each individual task order, or for costs that are specifically identified in this contract as being unallowable.

The Contractor shall not commence work until a task order or other notification for a specific assignment is issued by the Contracting Officer. If mailed, a task order is considered "issued" when the Government deposits the order in the mail. Orders may be issued orally, by facsimile, or electronically.

The Contracting Officer is the only person authorized to request work plans or issue task orders under this contract. The Government is not obligated to reimburse the Contractor for cost incurred before issuance of a task order or other notification by the Contracting Officer.

B.2 Minimum Guarantee

The master ID/IQ contract has a guaranteed minimum of $5,000.00 for the base year only. There are no guaranteed minimums applicable to the Option Periods. In the event that during the base year of the contract the Contractor receives obligations of less than this minimum, the Government will reimburse the Contractor for the difference between the actual obligations and the guaranteed minimum.

B.3 Maximum Program Value

The maximum dollar value which includes the base period and each of the option periods is $5,000,000.00. In no event will the sum of the base period and each option period exceed the maximum of $5,000,000.00. If the Government's requirements for services set forth in the solicitation do not result in orders in the amounts described as “maximum," the event shall not constitute the basis for an equitable price adjustment under this contract.

B.4 Ordering of Services

Orders for services shall be placed through the issuance of individually negotiated task orders in accordance with the clauses set forth in Section H.15 “Issuance of Task Orders”, I-2.2 “Ordering”, and I-2.3 “Order Limitations”.

Section C – Description/Specification/Work Statement

Background and Need:

CDC works with several executive agencies in support of the President’s Emergency Plan for AIDS Relief (PEPFAR). These efforts include interaction via assistance funding mechanisms (grants/cooperative agreements) with foreign government agencies, small local grantees, academic institutions and private firms near CDC field offices and in various international locations. CDC is required to exercise proper oversight in the business services areas of acquisition, assistance, and financial management. CDC requires additional resources to monitor and assist with the implementation of internal controls for grants and cooperative agreements in the international arena. Foreign grant recipients are subject to the same audit requirements as for-profit organizations, which are specified in the Code of Federal Regulations (CFR) at 45 CFR 74.26(d). An audit is required per 45 CFR 74.26(d) if the recipient expends a total of $500,000 or more under one or more Department of Health and Human Services (HHS) awards (either as a direct recipient or as a sub-recipient) during the recipient’s fiscal year. A financial audit is also required per 45 CFR 74.26(d) as defined in the Government Auditing Standards, at http://www.gao.gov/yellowbook, where the recipient receives awards under only one HHS program, or a financial audit of all HHS awards if awards are received under multiple HHS programs. The terms and conditions of the official Notice of Award (NoA) issued by CDC to each grant recipient contains this requirement. Office of Management and Budget (OMB) Circular A-133 sets forth the requirements and guidance for program-specific audits, which may be requested to follow a financial audit in the case of adverse findings from the regulatory audits, or they may simply be requested to protect the interestes of the US taxpayer. In addition, some audit findings may result in a need for special or forensic audits.

Project Objective:

The CDC’s objective is to obtain services to conduct audits over the next five years. The Audit Firm shall assist CDC with determining whether CDC-awarded funds are spent in accordance with the terms and conditions of the grants and that all grant funds are expended in conformance with US Government standards for cost allowability and allocability.

Scope of Work:

The types of audits that may be ordered under this contract include:

Financial audit:

Financial related audits include determining whether (a) financial information is presented in accordance with established or stated criteria, (b) the entity has adhered to specific financial compliance requirements, or (c) the entity's internal control structure over financial reporting and/or safeguarding assets is suitably designed and implemented to achieve control objectives.

(*See sample task order SOW)

Forensic audit:

A forensic audit is an examination of an organization's or individual's economic affairs, resulting in a report designed especially for use in a court of law. A forensic audit can have several goals, including mapping cash flow/cash transactions, identifying accounting errors and enumerating total assets.

(*See sample task order SOW)

Program-specific audit:

An audit of the financial statement(s) for the Federal program in accordance with GAGAS that also surveys internal controls, tests whether the auditee has complied with laws, regulations and provisions of contracts or grant agreements that could have a direct and material effect on the Federal program, and follows-up on prior audit findings, assesses reasonableness of the auditee’s summary schedule of prior audit findings.

(*See sample task order SOW)

Special audit:

An assessment based on a report by an auditor that requests further analysis of a business practice (digs deeper into an adverse audit finding) to determine whether fraud, embezzlement or other crimes are taking place.

(*See sample task order SOW) The grantee audits requested shall:

1. Conform to Generally Accepted United States Government Auditing Standards (GAGAS)

2. Provide sufficient information to assure that CDC funding is being used exclusively to support the purposes of the grant and is not being misapplied, misused, or unaccounted for.

3. Report on the status and reliability of the recipient’s:

a) Accounting system, including accounting for all supplies, personnel, contracting and other costs associated directly with the award, as prescribed in 45 CFR 74.21, Standards for financial management systems.

b) Purchasing system, including the use of acquisition techniques that conform with standards outlined in 45 CFR 74, sections 40 through 48, including:

§74.41 Recipient responsibilities.

§74.42 Codes of conduct.

§74.43 Competition.

§74.44 Procurement procedures.

§74.45 Cost and price analysis.

§74.46 Procurement records.

§74.47 Contract administration.

c) Financial reporting as required by 45 CFR 74.52

d) Other aspects of financial control, equipment management and application of grant funding as contained in 45 CFR 74 and prescribed by GAGAS.

The HHS Awarding Agency Grants Administration Manual (AAGAM) Chapter 6.99.103 and the HHS Grants Policy Statement (and its applicable cost principles) may be used as references. AAGAM Chapter 6.99.103-4: “Financial management systems include the accounting, budgeting, human resources, property management, and procurement systems, as well as the financial management policies, procedures and internal controls maintained by an organization that affect the incurrence of costs.”

Period of Performance:

12 Months from the date of award, with 4, 12-month option periods to follow.

Place of Performance:

All work will be based internationally in PEPFAR Countries; specific locations will be described on individual task orders.

Special Considerations:

The Contractor shall be knowledgeable in generally accepted accounting principles, government accounting principles and the audit function. Professional Certification(s): A certificate as a Certified Public Accountant or a Certified Internal Auditor is required. The Contractor must have all licenses and/or certifications necessary to perform financial, forensic, program-specific, and special audits. The Contractor must have experience in performing complex multi-site audits. Some international travel is required. Travel and accommodations shall be in accordance with the Federal Travel Regulations.

· Knowledge of accounting and auditing theory, concepts, and standards and knowledge of advanced audit techniques for designing, planning, directing, and executing broad-scoped reviews or performance audits of major, complex programs or activities as related to PEPFAR.

· Ability to apply effective project management skills and work on a team, whether as a team member or leader, to accomplish project objectives and goals.

· Ability to maintain effective liaison relationships with foreign government officials, CDC officials, recipients, audit organizations, and other interested parties on significant audit matters and to resolve issues or problems

· Ability to develop written audit reports and correspondence that are clear, concise, and persuasive

The contractor must possess expertise in Generally Accepted Accounting Standards (GAAP), Generally Accepted Government Auditing Standards (GAGAS) and evaluative principles, practices, and standards to plan and perform work consisting of a systematic examination of records, reports, management control, policies and practices affecting or reflecting condition and operation of CDC projects and programs as executed by both internal CDC offices and external grant recipient organizations funded by CDC grants.

The contractor must demonstrated experience in developing audit plans, establishing and meeting milestones, consolidating findings and writing reports. The contractor must demonstrate expertise in advising, planning, and performing work consisting of a systematic examination of records, reports, management controls, internal controls, and practices affecting the execution of CDC’s projects and programs as executed by both internal CDC offices and external grant recipient organizations funded by CDC grants in accordance with generally accepted accounting principles.

The contractor must possess the ability to clearly and concisely communicate both orally and in writing authoritative findings, guidance, and recommendations in accordance with professional standards. Results shall aim to impact the overall efficiency and economy of CDC's programs and determine CDC's grantees’ compliance with applicable federal laws, regulations, and guidelines.

Key Personnel:

Key personnel for this ID/IQ contract and any task orders thereunder include the Project Manager and Senior Accountant(s). Minimum experience for key personnel includes a minimum of 5 years’ experience performing audits overseas with USG and local government and Non-Governmental Organizations (NGOs). Experience performing forensic audits for a minimum of 3 years within the past 7 years is also required. Note: auditing US domestic organizations and governmental entities does NOT meet this requirement. Certified Fraud Examiner (CFE) credentials are desired, but not required, for key personnel. Although not considered key personnel, all business officials and accountants performing duties under individual task orders must meet the qualifications identified in the preceding “Special Considerations” subsection.

Government-Furnished Property:

The Contractor will furnish all the necessary personnel, facilities, supplies, equipment and travel required to provide these services and in accordance with international labor and tax laws. The Contractor must also demonstrate the legal authorization and capability to work in international countries.

Access to USG computers and systems will not be provided by USG. The Contractor shall supply its own laptops, flash drives, Blackberries, local cell phone and minutes, etc. for all business activities.

The Contractor should assume that office space will not be provided by the CDC.

Riding in US Government vehicles is permitted by the Contractor as necessary to complete the tasks stated in each task order.

Reporting Requirements and Deliverables:

The Contractor shall initiate, schedule, and conduct meetings and site visits as needed and according to the specified tasks requested in individual task orders. The items specified for delivery are subject to the inspection and approval by the COR before final acceptance.

The Contractor shall provide the following as Deliverables:

Q1: December 31

Q2: March 31

Q3: June 30

Q4: September 30

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E - Inspection And Acceptance

E.1 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Contracting Officer's Technical Representative ) at the destination of the articles, services or documentation.

(End of Clause)

Section F - Deliveries Or Performance

F.1 Deliverable(s) Schedule (Jul 1999)

The Contractor shall deliver to the Contracting Officer's Representative (COR) and Contracting Officer any reports or deliverables as may be specified in the individual task orders within the time frames specified.

(End of Clause)

F.2 Period of Performance (Task/Delivery Order Contracts)

(a) Contract: The period of performance of this contract shall be a base period of twelve (12) months from the effective date of the contract and four (4) one year option periods. The effective date of the contract will be the date of award.

(b) Task Orders: The time for completion for each task shall be determined on each individual task order. Task/delivery orders under this contract may be awarded by the Contracting Officer at any time within the contract period.

F.3 Place(s) of Performance

Place(s) of performance will be identified on each individual task order. The place(s) of performance could be either at the contractor’s facility or in one of the countries identified below. The Center for Global Health (CGO) currently supports activities in 73 countries and regional programs including: Afghanistan, Angola, Bangladesh, Benin, Bolivia, Botswana, Brazil, Burkina Faso, Cambodia, Cameroon, Central African Republic, China, Colombia, Cote d’Ivoire, Democratic Republic of the Congo, Denmark, Dominican Republic, Ecuador, Egypt, El Salvador, Ethiopia, Ghana, Guatemala, Guyana, Haiti, Honduras, India, Indonesia, Iraq, Jamaica, Jordan, Kazakhstan, Kenya, Korea, Laos, Lesotho, Liberia, Madagascar, Malawi, Malaysia, Mali, Mexico, Morocco, Mozambique, Namibia, Nepal, Nicaragua, Niger, Nigeria, Pakistan, Panama, Papa New Guinea, Paraguay, Peru, Philippines, Republic of Georgia, Russia, Rwanda, Senegal, Sierra Leone, Somalia, South Africa, Sudan, Suriname, Swaziland, Tanzania, Thailand, Uganda, Ukraine, Vietnam, Yemen, Zambia, Zimbabwe, Asia Regional, Caribbean Regional, Central America Regional, and Central Asia Regional. The intent of this contract is to cover activities to be conducted in the above listed countries and all other countries that may be added to the CDC international portfolio in the future.

Section G - Contract Administration Data G.1 Contracting Officer's Representative (Jul 1999)

Performance of the work hereunder shall be subject to the technical directions of the designated Contracting Officer's Technical Representative for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the Contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction. If the Contractor fails to provide the required notification within the said two (2) week period that any technical direction exceeds the scope of the contract, then it shall be deemed for purposes of this contract that the technical direction was within the scope. No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government Contracting Officer's Technical Representative is not authorized to change any of the terms and conditions of this contract. Changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the delegation memorandum for the Contracting Officer's Technical Representative. Any changes in Contracting Officer's Technical Representative delegation will be made by the Contracting Officer in writing with a copy being furnished to the Contractor.

G.2 Reimbursement of Cost (Apr 2000)

(a) For the performance of this contract, the Government shall reimburse the Contractor the cost determined by the Contracting Officer to be allowable (hereinafter referred to as allowable cost) in accordance with the clause entitled Allowable Cost and Payment in Section I, Contract Clauses. Examples of allowable costs include the following:

(1) All direct materials and supplies which are used in the performing of the work provided for under the contract, including those purchased for subcontracts and purchase orders.

(2) All travel costs plus per diem or actual subsistence for personnel while in an actual travel status in direct performance of the work and services required under this contract. These costs will be in accordance with the Contractor’s policy and subject to the following:

(i) Air travel shall be by the most direct route using “air coach” or “air tourist” (less than first class) unless it is clearly unreasonable or impractical (e.g., not available for reasons other than avoidable delay in making reservations, would require circuitous routing or entail additional expense offsetting the savings on fare, or would not make necessary connections).

(ii) Rail travel shall be by the most direct route, first class with lower berth or nearest equivalent.

(iii) Costs incurred for lodging, meals, and incidental expenses shall be considered reasonable and allowable to the extent that they do not exceed on a daily basis the per diem rates set forth in the Federal Travel Regulation (FTR).

(iv) Travel via privately owned automobile shall be reimbursed at not more than the current General Services Administration (GSA) FTR established mileage rate.

(b) Except as stated herein, the Contractor shall not incur costs unless the prior written authorization of the Contracting Officer has been obtained. When costs are incurred without such prior authorization, with the intent of claiming reimbursement as direct costs, it shall be at the contractor’s risk.

G.3 Applicable Service Contract Act Wages (Jul 1999)

The attached Wage Determination, No. 05-2133 dated 08/05/2014 specifies hourly rates of wages that shall be paid to applicable employees performing work required under this contract in Georgia. These rates have been determined by the Secretary of Labor in accordance with the provisions of the Service Contract Act of 1965, as amended. (See FAR 52.222-41, incorporated by reference in Section I.)

G.4 Contractor Performance Assessment Reporting System (CPARS) Requirements (April 2003)

In accordance with FAR 42.15, the Centers for Disease Control and Prevention (CDC) will review and evaluate contract performance. FAR 42.1502 and 42.1503 requires agencies to prepare evaluations of contractor performance and submit them to the Past Performance Information Retrieval System (PPIRS). The CDC utilizes the Department of Defense (DOD) web-based Contractor Performance Assessment Reporting System (CPARS) to prepare and report these contractor performance evaluations. All information contained in these assessments may be used by the Government, within the limitations of FAR 42.15, for future source selections in accordance with FAR 15.304 where past performance is an evaluation factor.

The CPARS system requires a contractor representative to be assigned so that the contractor has appropriate input into the performance evaluation process. The CPARS contractor representative will be given access to CPARS and will be given the opportunity to concur or not-concur with performance evaluations before the evaluations are complete. The CPARS contractor representative will also have the opportunity to add comments to performance evaluations.

The assessment is not subject to the Disputes clause of the contract, nor is it subject to appeal beyond the review and comment procedures described in the guides on the CPARS website. Refer to: www.cpars.gov for details and additional information related to CPARS, CPARS user access, how contract performance assessments are conducted, and how Contractors participate. Access and training for all persons responsible for the preparation and review of performance assessments is also available at the CPARS website.

The contractor must provide the CDC contracting office with the name, e-mail address, and phone number of their designated CPARS representative who will be responsible for logging into CPARS and reviewing and commenting on performance evaluations. The contractor must maintain a current representative to serve as the contractor representative in CPARS. It is the contractor’s responsibility to notify the CDC contracting office, in writing (letter or email), when their CPARS representative information needs to be changed or updated. Failure to maintain current CPARS contractor representative information will result in the loss of an opportunity to review and comment on performance evaluations.

(End of Clause)

G.5 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

(End of Clause)

G.6 Contract Communications/Correspondence (Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

G.7 Payment by Electronic Funds Transfer (Dec 2005)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer – Central Contractor Registration, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Financial Management Office at (404) 498-4050.

(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention

Financial Management Office (FMO)

P.O. Box 15580

Atlanta, GA 30333

Or – Fax copy to: 404-638-5342

(End of Clause)

G.8 CDCAG001 Invoice Submission - Part 1 (Mar 2006)

(a) The Contractor shall submit the original contract invoice/voucher to the Financial Management Office (FMO) as shown below:

The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 3033

Or – The Contractor may submit the original invoice/voucher via facsimile or email:

Fax: 404-638-5324

Email: FMOAPINV@CDC.GOV NOTE: Submit to only one (1) of the above locations.

(b) The contractor shall submit 2 copies of the invoice/voucher to the cognizant contracting office previously identified in this contract. These invoices/voucher copies shall be addressed to the attention of the Contracting Officer.

(c) The Contractor is required to submit a copy of each invoice directly to the Contracting Officer's Representative concurrently with submission to the Contracting Officer.

, is not

(d) In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Financial Management Office is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(e) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Task Order Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice

(11) Name, title and telephone number of person to be notified in the event of a defective invoice

(12) Payment Address, if different from the information in (c) (1).

(13) DUNS + 4 Number

Section H - Special Contract Requirements

H.1 HHSAR 52.222-70 Contractor Cooperation in Equal Employment Opportunity Investigations (January 2010)

(a) In addition to complying with the clause in FAR 52.222-26, Equal Opportunity, the Contractor shall, in good faith, cooperate with the Department of Health and Human Services (Agency) in investigations of Equal Employment Opportunity (EEO) complaints processed pursuant to 29 C.F.R. Part 1614. For purposes of this clause, the following definitions apply:

(1) “Complaint” means a formal or informal complaint that has been lodged with Agency management, Agency EEO officials, the Equal Employment Opportunity Commission (EEOC), or a court of competent jurisdiction.

(2) “Contractor employee” means all current Contractor employees who work or worked under this contract. The term also includes current employees of subcontractors who work or worked under this contract. In the case of Contractor and subcontractor employees, who worked under this contract, but who are no longer employed by the Contractor or subcontractor, or who have been assigned to another entity within the Contractor’s or subcontractor’s organization, the Contractor shall provide the Agency with that employee’s last known mailing address, e-mail address, and telephone number, if that employee has been identified as a witness in an EEO complaint or investigation.

(3) “Good faith cooperation” cited in paragraph (a) includes, but is not limited to, making Contractor employees available for: (i) formal and informal interviews by EEO counselors or other Agency officials processing EEO complaints; (ii) formal or informal interviews by EEO investigators charged with investigating complaints of unlawful discrimination filed by federal employees; (iii) reviewing and signing appropriate affidavits or declarations summarizing statements provided by such Contractor employees during the course of EEO investigations; (iv) producing documents requested by EEO counselors, EEO investigators, Agency employees, or the EEOC in connection with a pending EEO complaint; and (v) preparing for and providing testimony in hearings before the EEOC and U.S. District Court.

(b) The Contractor shall include the provisions of this clause in all subcontract solicitations and subcontracts awarded at any tier under this contract.

(c) Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause may be grounds for the Contracting Officer to terminate this contract for default.

(End of clause)

H.2 HHSAR 352.239-70 Standard for Security Configurations (Oct 2009)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops--regardless of function--but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Approved security configurations are identified in NIST checklists (http://web.nvd.nist.gov/view/ncp/repository) or contained in a DoD DISA security technical implementation guide or security checklist http://iase.disa.mil/stigs/index.html. If CDC specific security configuration requirements are later determined to apply, they will be provided subsequent to contract award and incorporated by contract modification.

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings--see http://nvd.nist.gov/validation.cfm. The

Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart

4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause) H.3 HHSAR 352.239-71 Standard for Encryption Language (Oct 2009)

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered ``sensitive'' in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer’s Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer’s Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

(End of clause)

H.4 HHSAR 352.239-72 Security Requirements for Federal Information Technology Resources (Oct 2009)

(a) Applicability. This clause applies whether the entire contract or order (hereafter ``contract''), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term ``information technology (IT)'', as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their--

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)--due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)--due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)--due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)--due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems--see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer’s Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in ``HHS-Controlled Facilities and Information Systems Security'' requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that--

(1) Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

(i) Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

(…