2015-N-16885.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2015-N-16885

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

3/17/2015

6. REQUISITION/PURCHASE NO.

000HCVG1-2015-79491

Centers for Disease Control and Prevention

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 3 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located inSee Instructions for submission of Offers in Sect L of this Solicitationuntil 5:00pmlocal time 04/20/2015 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Maria S. Shamburger

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2057

C. E-MAIL ADDRESS

Mshamburger@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention

Procurement and Grants Office

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

Alan W. Sims

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

Base Period of Performance: 8/31/2015-9/1/2016

Option Year 1: 8/31/2016-9/1/2017

Option Year 2: 8/31/2017-9/1/2018

Option Year 3: 8/31/2018-9/1/2019

Option Year 4: 8/31/2019-9/1/2020

Option Periods and Option CLINS are subject to clauses 52.217-8 and 52.217-9 and may be exercised unilaterally by the Government.

Travel is for a Not To Exceed amount and shall be billed in accordance with Federal Travel Regulations referenced at http://www.gsa.gov/portal/content/104790

There are no clauses/provisions included in this section.

Section C - Description/Specification/Work Statement

C.1 Maintenance and Support Services for SAP based solutions C.1.1

BACKGROUND

Over the last decade, National Center for Immunization and Respiratory Diseases (NCIRD) has implemented several information technology innovations to modernize CDC’s vaccine supply chain program including centralized distribution, Vaccine tracking System (VTrckS) and NCIRD Advanced Business Analytics Platform (NABIP).

VTrckS and NABIP are SAP based solutions. SAP stands for Systems Applications and Products in Data Processing. SAP system comprises of a number of fully integrated modules, which covers virtually every aspect of the business management. In 2010, NCIRD implemented VTrckS, an enterprise-wide ordering supply chain management system integrating vaccine ordering, forecasting, budget management, and contract management that enables effective and efficient management of CDC’s public vaccine programs. Integration of the vaccine business processes will provide a comprehensive, end-to-end, singular view of the program. VTrckS is a web-based system for provider ordering and automated approvals that improve operational efficiency and internal controls. It is a SAP based comprehensive IT solution that provides a scalable platform, and facilitates central administration of vaccine management. VTrckS allows providers to order directly from the Internet, improves internal controls, significantly reduces manual processes, and provides transparency into provider usage patterns improving data analysis capability. This real-time inventory visibility improves preparedness, allows for a greater focus on public health, and reduces time and resources devoted to managing vaccines and funding.

VTrckS is scaled to service three levels of users: CDC, immunization program offices ( awardees), and individual users (located in approximately 44,000 vaccine provider locations). Accomplishments since December 2010 Go-Live include approximately 1 to 2 million vaccine orders are placed through VTrckS annually and approximately 90 million vaccine doses shipped to providers annually.

In FY2014, to further enhance and advance NCIRD’s public health mission, NCIRD invested in an advanced business intelligence platform leveraging SAP HANA technology. This Platform provides robust technology to integrate large data from various CDC and non-CDC systems to provide near real-time information for decision making. This Platform will enhance decision-making, enable efficient data services and potentially leverage analytic capabilities across CDC Programs through a shard service approach. Sample benefits of the advanced business intelligence platform include improve advanced real-time scalable data analytics capacity and capability, rapid data analysis for large (big) data, online sentiment data analysis for immunization and respiratory related issues hot spots and topics, Predictive analysis, and presentation of information through new dashboards. In FY15, at least two use cases are being brought into NABIP for data analytics and reporting. As the first use case, VTrckS data will be loaded into NABIP (SAP HANA) for rapid data analysis and reporting. As the second use case, TIPS project data will be loaded into NABIP (SAP HANA) for data cleansing, provisioning, analysis and reporting. CDC/NCIRD will continue to identify advanced analytic needs to be supported by HANA.

C.1.2

OBJECTIVE

The objective is to provide integrated and comprehensive support for responsive, efficient, and cost-effective operations and maintenance support for CDC’s SAP based solutions, VTrckS (SAP ERP solution) and SAP HANA based NCIRD Advanced Business Analytics Platform (NABIP). The Contractor is expected to comply with all CDC security requirements.

The Contractor shall support SAP applications in all aspects of daily operations and maintenance, implement approved change requests to the system, enhancements, bug fixes, and level II and III technical support.

The Contractor will also support the maintenance of existing use cases and implementation of new use cases in NABIP. The implementation of new use cases should leverage project management best practices for SAP HANA related projects.

C.1.3

SCOPE OF WORK

The scope of work will be related to supporting VTrckS in all aspects of operations and maintenance. This includes maintenance of the SAP software in different environments (i.e. development, QA/testing, training, production, and others as deemed necessary by the VTrckS Project Management Office), SAP functional and development support, interfaces monitoring and maintenance, data warehouse maintenance, service level agreements, end user support – level II and III technical support, test management, release management, technical change management, defect resolution and its management, and data conversion and master data maintenance. The support will also include release/patch planning, maintaining the SAP application to approved levels of patches and maintenance updates.

Furthermore, the scope of work includes operation and maintenance of NCIRD Advanced Business Analytics Platform. This will entail to the maintenance of existing use cases (projects) and the development and implementation of new use cases (projects) for CDC public health programs. This includes requirements gathering, configuration, data modeling data provisioning, data services, data translation, data migration and visualization of data. The support will also include integration of SAP predictive analysis, business objects and sentiment analytical tools with geo-spatial information to bring together disparate sources of data and provide information through new dashboards and reports that best meet CDC public health business needs.

C.1.4

HIGH LEVEL TASKS

Below are the high level task areas. Tasks 1 to 9 are VTrckS specific and Task 10 is specific for NABIP (SAP HANA).

1. Application Management, Maintenance and Support

2. Technical Change Management Support

3. End User Support

4. User Authentication and Security

5. Interfaces monitoring and maintenance

6. Solution testing and defect management

7. Data conversion and master data maintenance

8. Functional, Configuration and Development Support

9. Analytics Business Intelligence/Business Warehouse (BI/BW)

10. NCIRD Advanced Data Analytics/Reporting Platform (SAP HANA) support

11. Project Management

C.1.4.1 TASK 1 APPLICATION MANAGEMENT, MAINTENANCE, AND SUPPORT

VTrckS is a SAP based solution and its technical landscape includes development, QA, Training, Staging and Production environments. The landscape is comprised of physical and VM servers running in CDC data center. Major tasks included in the management and maintenance of VTrckS are:

· Install/upgrade, configure and test various SAP and associated Products (such as SAP, u Perform/Productivity Pack, TAO, Business Objects, Load Runner, TREX, HPQC, Web Dispatcher, GRC Tool) per custom business process requirements

· Perform simple to moderate SAP multi-tier/integrated processes and procedures to support the complex SAP Landscape

· Patch management

· Identify and distribute security patches

· Efficient, automated, and policy-based electronic software distribution scheduled deployments during business and non-business hours

· Perform, test SAP software products based on customer requirements

· Perform simple to moderate tasks in support all non-SAP interfaces with the SAP Suite of Products across the complex SAP Landscape ensuring the progression of workflow/tasks are performed in order of SAP Methodology of Change Management

· Perform maintenance of CDC installed SAP router to connect to SAP Government Secure Services for solution troubleshooting and technical checks

· Perform simple to moderate tasks in support of SAP projects/tasks such as STMS, Support Stacks, add-on packages, Printers, OSS Connections, EarlyWatch, GLFU Sessions, Language Imports, Kernel Patches, Parameter Changes, Op Modes, Logon Groups, Load Balancing, Batch Management, Basic SAP Debug, Output Management, and sap router

· Identify, track and maintain documentation of all VTrckS issues related to data centers

· Develop and support business continuity plans and processes including Disaster Recovery exercises

· Development of automated test scripts in HPQC supporting changes in the system due to defects resolution and break fixes

· Technical support on the update and maintenance of uPerform documentation

· Perform simple to moderate tasks in support of SAP multi-tier processes and procedures for:

· SAP Backup, Recovery and SAP system copies/refreshes

· SAP Audit requirements and Compliance

· SAP Transport Facilities for Java and ABAP Systems

· SAPServer, SAPApps, SAPDB buffer tuning, early watch alerts, and work process utilization

· SAP OSS Notes

· General SAP system administration

· Perform simple to moderate problem analysis/determination

· Reporting - Monthly Staffing Reports - The Contractor shall provide staffing reports on a monthly basis that by labor category to each task identified in this SOW. The reports shall include current and forecasted needs by category.

C.1.4.2.

TASK 2 TECHNICAL CHANGE MANAGEMENT PROCESS SUPPORT

The project has established and maintains a process that successfully introduces changes and upgrades to the VTrckS environment by tracking the submission, coordination, review, evaluation, categorization, approval and implementation of all changes from system perspective.

Major tasks include:

Support and execute VTrckS project change management process as required

Support and execute, as required, the VTrckS technical change management process

Maintain, track, execute all technical change requests

Support the change request process through procedural documentation

Coordinate the schedule and resources to implement the approved changes

Ensure all technical documentation for the Enterprise Performance Life Cycle (EPLC) is complete and maintained as necessary when changes occur

Support Technical change management processes using HPQC for defect resolution management

C.1.4.3

TASK 3 END USER SUPPORT

The primary (level I) support to the VTrckS users is provided by an outsourced contact center. VTrckS End User Support includes Level II and III support. Level II support includes assistance by the individuals that have SAP functional/configuration expertise as well as program functional knowledge. Level III support includes the involvement by individuals with SAP application development expertise.

Trouble tickets that cannot be resolved at the VTrckS Level II support are escalated to VTrckS Level III support (technical development support).

Examples of Level II tickets may include the following:

· Triage of the trouble tickets received from Level I support

· Communicate to the end users regarding the trouble tickets, if required

· Creating new provider site, and related user, records in VTrckS

· Problems that users encounter logging on to the application that are not related to the Security Access Management Services (SAMS)

· Troubleshooting problems that users are experiencing in navigating the application

· Troubleshooting user records discrepancies between SAMS and the VTrckS solution

· Other tickets which are escalated from Level I

The following items will be handled by the Security Desk. These items will normally flow through the VTrckS Level II Support.

· Activation of individual users in VTrckS after confirming the completion of the identity proofing process

· Troubleshooting user access records discrepancies between SAMS and VTrckS

Examples of Level III tickets may include the following:

· Implement solutions to the VTrckS defects and issues reported by the users

· VTrckS interfaces related issues that require changes in interfaces specifications and mappings related to defects and break fixes

· VTrckS module changes which require coding changes related to defects and break fixes

· Other tickets which are escalated from Level II

C.1.4.4

TASK 4 USER AUTHENTICATION AND SECURITY

This activity is to support the ongoing user authentication and security process related to VTrckS (SAP) and CDC Secure Access Management Services (SAMS). Additionally, the contractor will participate in the Certification and Accreditation (C&A) process to address any security vulnerabilities that appear during VTrckS security scans.

Examples of tasks include:

· User provisioning and authorizations in VTrckS and SAMS

· Support VTrckS security roles management processes and maintain all related documentation

· Liaison to CDC SAMS team for user provisioning and authentication tasks

· Maintain all user access related documentation, authentication issues, and other security related issues

· Work with NCIRD Information System Security Team and CDC Office of the Chief Information Officer in addressing information system security related issues

· Maintain SAP based GRC tool

· Analyze and run reports on system access for senior management

C.1.4.5

TASK 5 SOLUTION TESTING AND DEFECTS MANAGEMENT

This activity is to include solution testing related to defects and break fixes. In addition, it supports Defect Management using HPQC. Major activities will include the following:

· Solution performance testing using Loadrunner to assess any performance impacts

· Build Loadrunner test scripts and testing and excusing scenarios for performance testing

· Conduct Unit testing of the defects and break fixes as required

· Regression testing to make sure that there is no undesired impact on the established VTrckS solution function and design

· Participation in testing and providing functional and technical support to the program team during break fixes and regression testing

C.1.4.6

TASK 6 VTRCKS INTERFACES MONITORING AND MAINTENANCE

VTrckS is an SAP application that CDC utilizes to support vaccine ordering for over 44,000 immunization providers in 64 areas, covering all States and Territories of the United States (U.S.). Interfaces are a critical component of VTrckS. VTrckS interfaces with the Department of Health and Human Services (DHHS) Unified Financial Management System (UFMS), CDC’s financial system of record for financial data. VTrckS also interfaces with CDC’s centralized vaccine distributor and seven vaccine manufacturers through via Electronic Data Interchange (EDI). The EDI solution utilizes BizTalk, which is maintained by CDC internal partner organizations.

This activity includes the monitoring and maintenance of all VTrckS interfaces on a regular basis. Examples of the underlying tasks include:

· Monitor and maintain all VTrckS interfaces

· Troubleshoot any issues related to interface maintenance including working with the End User support team

· Track and maintain complete records of all incidents and related resolution

· Work with CDC internal partners including the Management Information Systems Organization (MISO) and Office of the Chief Financial Officer (OCFO) and external partners including vaccine distributor and manufacturers to troubleshoot and track any interface related issues

· Develop, update and manage interface specific Operations & Maintenance (O&M) documentation

· Provide support in the creation and maintenance of VTrckS specific IDOCs

· Support the development of interfaces (IDOCs, BAPI, BADI, web services, SAP PI) as required

· Utilize SAP’s data dictionary, ABAP workbench

· Perform regression and end-to-end testing, and defect resolution from an interface perspective

· Perform functional and technical system and user support to ensure that interfaces are meeting overall business requirements and objectives

· Provide support for resolving issues as identified by the reconciliation teams

C.1.4.7 TASK 7 DATA CONVERSION AND MASTER DATA MANAGEMENT

This activity supports CDC and grantees in preparing, extracting, loading and managing master data.

Examples of major tasks include:

· Assist CDC and grantees in preparing, cleansing, and loading and the data for conversion to VTrckS

· Participate in the cutover data activities for rolling out system to non-pilot grantees

· Assist in the coordination of data cleansing, migration, and validation procedures

· Work with the CDC immunization program team and awardees to handle any master data issues

· Support data warehouse and BI/BW activities for data extraction, cleansing and mapping

· Update and maintain VTrckS technical documentation

C.1.14.8

TASK 8 FUNCTIONAL, CONFIGURATION, DEVELOPMENT AND ENHANCEMENT SUPPORT

This activity supports any needs regarding functional, configuration, development and enhancement support in SAP modules and associated products used by VTrckS for O&M. Additionally, it includes support for Java, PL/SQL, and SQL programming. Examples of specific tasks include:

· Provide functional and development support in CRM, ECC, ABAP, Java, SQL, Middleware, Workflow, VTrckS Spend Plan module, and Business Analysis

· Perform detail system analysis and provide Functional and Development support for SAP CRM, current version 7.0, including ISA, ICSS and SM components

· Monitor and ensure that CRM module is working properly and interfaces/integration with other SAP components

· SAP ECC components, current version 6.0, implemented in VTrckS include MM, PP, FI/FM, SD, SM, PP, PI, XI

· Functional and development support for VTrckS implemented ECC components

· Monitor and ensure that all modules are integrated as required

· Monitor and ensure all ECC interfaces are working properly, especially VACMAN interface and orders processing for VACMAN orders

· Provide technical support for PI environment and monitor system activity across entire VTrckS solution

· Provide technical support, monitor and ensure that CRM and ECC replication (middleware) is functioning properly as designed

· Monitoring and maintenance of ExIS interface

· Monitoring and maintenance of SAP Solution Manager (SolMan) to utilize configuration, integration, issue management, business process change and other project support activities

· Monitoring and Maintenance of SAP Portals

· Provide functional support to the programmatic, Organization and Change Management and VMBIP Project Management Office teams

· Maintain SAP developed Mass Upload tool for updating inventory, provider data and other master data into VTrckS system

· Update and maintain any existing VTrckS technical documentation

· Prepare and maintain any new documentation required to capture SAP functional processes and development objects as required

· Participate in the cutover activities for rolling out system to non-pilot grantees

· Maintain and update SAP customized objects and their detailed documentation

· Work closely with the other technical teams in handling VTrckS O&M activities

C.1.4.9

TASK 9 ANALYTICS: BUSINESS INTELLIGENCE/BUSINESS WAREHOUSE (BI/BW)

This activity supports the creation, maintenance of data warehouse and supports the current legacy and interim data warehouses. In addition, it supports all VTrckS BI/BW activities to accomplish business needs. Examples of major tasks include:

· Creation and maintenance support of VTrckS data warehouse, Interim data warehouse and legacy data warehouse (historical legacy vaccine orders history).

· SAP Business Intelligence and Business Objects Reporting

· Utilize SAP ERP queries, SAP BI/BW, Open Hub and other SAP data analysis Identify business requirements, functional and process designs, prototyping, testing, training and defining support procedures

· Utilize Extraction, Transfer and Loading (ETL) tools such as, Business Objects, , BOBJ, etc.

· Design reporting solutions to meet business requirements, develop data models and info cubes, as well as logical and physical databases, PL/SQL and SQL to support business reporting

· Utilize PL/SQL, triggers, stored procedures, Xelcius, Crystal Reports and BW

· Design, develop and support database systems within VTrckS and outlining systems

· Verify SAP BI/BW reports are populated with correct legacy data

· Perform regular data validation checks to ensure all data has been properly extracted and loaded from the legacy systems

· Utilize web intelligence report design and development to support business requirements

· Utilize Data Warehousing knowledge and communicate with business and technical groups

· Utilize interactive/dynamic dashboards, scenario analysis and forecasting to include dashboards with drill drown capabilities

· Update and maintain VTrckS technical documentation

C.1.4.10 TASK 10 NCIRD Advanced Business Analytics Platform (SAP HANA) support This activity represents the operation and maintenance support required for NCIRD’s advanced analytics business intelligence platform which is based on SAP HANA. Examples of tasks under this activity include:

· Maintain and support the use cases (projects) transitioned/migrated into CDC SAP HANA based advanced analytics platform. Implement bug fixes and enhancements as required

· Design, configure and transition/ migrate/ extract/ import new use cases (projects) and their data, as identified by CDC, into CDC SAP HANA based solution in support of CDC reporting and analytics needs. This includes full life cycle of the project from requirements, blueprinting, design, configuration, testing, training, deployment and operations and maintenance.

· Design, configure, and maintain an SAP-based data services solution that satisfies the business performance, functional, and technical requirements in support of CDCs needs, including but not limited to event deduplication and application of data complex business rules.

· Design, configure and maintain reports and dashboards using SAP HANA and associated products

· Provide Business Intelligence and Analytics support as it relates to applying HANA to existing software used to carry out data processing and analytics, such as Business Objects, SAS and other scientific tools

· Design, configure and maintain objects for data analysis, reporting and dashboards in support of CDC business needs

· When required, create data analytical models in SAP HANA for data analysis and reporting

· Design, build and maintain ETL jobs for loading data and real-time replication from disparate sources into SAP HANA.

· Ensure delivered designs are scalable to meet future business development.

· Define and build data views for analysis, reporting and dashboards

· Verify that the HANA database is properly populated with the appropriate source data.

· When applicable, utilize and integrate data with SAP® Social Media Analytics application by NetBase, SAP Lumira, SAP Business Objects and geospatial information

· Develop and maintain a quality program to ensure that data services processes and delivered solutions are produced in accordance with industry best practices in systems development and engineering, federal government IT program requirements, and applicable project standards and requirements.

· Provide knowledge transfer to NCIRD or its designated resources including developing the appropriate training, documentation, and sessions.

· Provide the necessary consultation and Basis support for maintenance of the SAP HANA hardware and application including but not limited to software upgrades, patch management, exception management and reporting, platform user access, disaster recovery, etc.

· When required, provide support for integrating Geographical Information System (GIS) capabilities into NABIP (SAP HANA) for analysis and reporting

C.1.4.11

TASK 11 PROJECT MANAGEMENT

This activity supports the CDC VTrckS Project Manager in executing the technical tasks. Examples of tasks under this activity include:

· Management of all tasks and work under this contract

· Consultation on SAP best practices principles and methods

· Recommend technical direction on the development, design and systems integration of SAP based solutions

· Assist the CDC Project Managers on SAP system development life cycle implementation

· Provide solution architecture input/guidance in the implementation of SAP technology

· Provide advice on technical aspects of system development and integration with use of relevant technical strategies, standards and practices C.1.5.

OPTIONAL SERVICES FOR INCREASED SUPPORT REQUIREMENTS

As needed, and when ordered by the Contracting Officer, the contractor shall provide the necessary support to respond to particular circumstances within 72 hours after notification from the Contracting Officer. The nature of the support required for this project may require that the contractor provide increased support to include increased labor-hours, an extended work schedule and/or additional personnel on short notice. The nature of the work may require that the contractor perform work on site at CDC or at alternative sites. Tasks may include:

· Application Management, Maintenance and Support

· Technical Change Management Process Support

· VTrckS End-User Support

· User Authentication and Security

· Solution Testing and Defect Management

· VTrckS Interfaces Monitoring and Maintenance

· Data Conversion and Master Data Management

· Functional Configuration, Develop and Enhancement Support

· Analytics Business Intelligence and Business Warehouse (BI/BW)

· NCIRD Advanced Data Analytics/Reporting Platform (SAP HANA) support C.1.6.

REPORTING

All reports shall be available on a daily basis and delivered as described below:

1. The Contractor shall provide by Close of Business the first Friday of each month a monthly status report that contains at a minimum, the following information:

· A brief description of requirements accomplishments during the reporting period and significant events encountered during this period.

· Deliverables submitted or progress on deliverable products.

· A brief summary of activity planned for the next reporting period.

· Any concerns related to contract and projects in general including problems, risks, issues and outstanding actions.

2. The contractor will create and provide a weekly report containing a dashboard of key O&M activities for NABIP and VTrckS encompassing at a minimum all defects handled, transactions, system errors, aging, and issues reported. Additionally, the contractor shall include in a weekly report status information for use cases implemented under NABIP and other information pertaining to the O&M activities for VTrckS and NABIP, such as the following:

· Meetings attended

· A brief description of requirements accomplishments during the reporting period and significant events encountered during this period.

· Deliverables submitted or progress on deliverable products.

· A summary of activities completed during the reporting period

· A brief summary of activity planned for the next reporting period.

· Any concerns related to contract and projects in general including problems, risks, issues and outstanding actions.

The weekly report is due by COB the 4th business day of each week.

3. A weekly report of level II and III trouble tickets, including total number received, total number resolved, number of level II tickets escalated to Level III, trouble ticket identifier, chronological time to resolve, and resolution. This report may change and will be finalized after contract award.

4. A listing of defect counts to-date including description, status, priority, defect #, estimated time of completion, current owner, defects closed, etc., related to open defects as well as any activity (i.e., closures). All defect counts should be aggregated by week (new, open, closed, etc.) for the last three months. Data prior to the last three months should be aggregated as a single data point at > 3 months back to the start of the calendar year.

5. A weekly summary of orders created and processed in VTrckS. This report should group data for the most recent week as well as a yearly summary. The report should include the number of orders submitted by originating system, orders and related transactions processed in the system and any differences identified.

6. The Contractor shall provide on a ongoing basis, the status of in-process change request to include an estimated level of effort to implement the change, as well as risk and impact associated using the applicable project standard for processing and documenting change requests.

7. The Contractor shall provide notification of planned outages and application maintenance due to support stacks, patches, and application code at least five days in advance except in case of emergencies.

8. The Contractor shall provide the analysis on user access to the system on a weekly basis. This includes the number of new users provided access to the system and number of users removed from the system.

9. The contractor shall provide the following VTrckS interface monitoring and maintenance reports:

· Daily - Interface Control Reports. These reports must show transaction counts and dollar totals – by type of transaction, by type of order, by originating system. Period to date totals (weekly, monthly, quarterly, annually). All exceptions must be noted.

· Weekly - Interface Performance: To include such information as interface files not available at scheduled times, performance trending of batch and EDI processing times

· Weekly- Incident/Exception tracking: New and outstanding incidents since the last report

· Weekly - Inventory and Finance Reconciliation: Reports of detailed transaction and associated research to support reconciling out of balance situations

10. The contractor will provide the system performance report on a weekly basis. This includes SAP early watch report.

11. Cost and Scheduling Reporting : The contractor shall provide cost and schedule reporting for the project. The report will be submitted by the 5th of every month or as requested by the government. At a minimum, the report will include planned project activities/ milestones, planned and actual costs, planned and actual dates for the activities, percentage of planned and actual work completed and cost and schedule variances.

C.1.7 DELIVERABLES: The Contractor shall provide to the Contracting Officer and Technical Monitor, the following products within the time frame specified below.

C.1.8

TRAVEL REQUIREMENTS

Limited travel may be required to stakeholders’ locations, mainly to awardees locations for VTrckS support.

C.1.9 PLACE OF PERFORMANCE

Work will be performed at the offices of the Centers for Disease Control and Prevention, in Atlanta, GA. Approval from the COR will be required for any work to be completed at alternate locations. Government will provide computer equipment and software for work at its facilities. Laptop computers and other hardware will be furnished when needed.

C.1.10 HOURS OF WORK

The CDC has a flexible work program schedule that allows individuals to begin work as early as 6:30AM and end as late as 6:00 PM at the discretion of the project officer. Normal business hours are 8:00 AM to 4:30 PM, Monday through Friday, except Government observed holidays C.1.11

KEY PERSONNEL CLAUSE

Contractors shall provide a detailed statement of staffing proposed for this contract, including (1) resumes from key personnel (limited to 10 pages) outlining the credentials and background of key management, professional, and technical personnel to be used for this contract, including the percent time on this and other projects; (2) a detailed plan that describes current staff available for this task order and how the team will interface with CDC, as well as descriptions of methods used to recruit professional and technical staff as workloads increase, and/or emergencies or staff turnovers occur; and (3) a clear delineation of staff authorities and line of responsibility.

If key personnel leave the Contractor’s employ or are reassigned to other programs, the Contractor shall notify the Contracting Officer reasonably in advance and shall submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. The Contractor shall not replace or divert any key personnel without the written consent of the Contracting Officer. If a suitability determination of the approved substituted key personnel is required, the Contractor shall comply with the instructions in clause titled “Suitability Determination Requirements (Nov 2002)” to obtain the determination.

C.1.12 508 COMPLIANCE

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Provisions (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit:

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility provisions. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access- board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this solicitation are identified in the Statement of Work/Specification/Performance Work Statement. In order to facilitate the Government’s evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific Section 508 standard. Instructions for preparing the HHS Section 508 Product Assessment Template may be found at http://508.hhs.gov.

Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards in its completed HHS Section 508 Product Assessment Template, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility in the Product Assessment Template, remediation of the products and/or services to the level of conformance specified in the vendor’s Product Assessment Template will be the responsibility of the Contractor at its expense.

The Applicable provisions of this solicitation are: 1194.21, .22, .31, and .41

C.1.13 SECURITY AND PRIVACY

Standard for Security Configurations (January 2010)

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. (Note: FDCC is applicable to all computing systems using Windows XP™ and Windows Vista™, including desktops and laptops—regardless of function—but not including servers.)

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

(NOTE: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.)

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings – see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Standard for Encryption Language (January 2010)

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-(PDF) compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered “sensitive” in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer’s Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer’s Technical Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor’s property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Security Requirements for Federal Information Technology Resources

(January 2010)

(a) Applicability. This clause applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS’ mission. The term “information technology (IT)”, as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting federal information and federal information systems in order to ensure their—

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii)…