ATTACHMENT_2-Domain_2_Sample_RFTOP.doc

ATTACHMENT 2 SAMPLE TASK ORDER 2

DOMAIN 2: RFTOP 2016-02-Task Order 001 Improving antibiotic use through implementation and evaluation of Core Elements of Hospital Antibiotic Stewardship Programs Estimated Price Range:

FORMCHECKBOX

Over $$2,700,000 but less than $3,300,000 Proposed Period of Performance: This award will be for a period of 36months..

Page Suggestion: The Contractor shall limit the proposal for this task order to 15 pages single-spaced pages.

SECTION B – DESCRIPTION OF WORK

1. Background and Need

Antibiotics have transformed the practice of medicine, making once lethal infections readily treatable and making other medical advances, like cancer chemotherapy and organ transplants, possible. The prompt initiation of antibiotics to treat infections has been proven to reduce morbidity and save lives, with a recent example being the rapid administration of antibiotics in the management of sepsis. However, 20-50% of all antibiotics prescribed in U.S. acute care hospitals are either unnecessary or inappropriate.

[1-4] ADDIN EN.CITE Like all medications, antibiotics have serious side effects, including adverse drug reactions and increasing susceptibility to Clostridium difficile infection (CDI). Patients who are unnecessarily exposed to antibiotics are placed at risk for serious adverse events with no clinical benefit. The misuse of antibiotics has also contributed to the growing problem of antibiotic resistance, which has become one of the most serious and growing threats to public health. Unlike other medications, the potential for spread of resistant organisms means that the misuse of antibiotics can adversely impact the health of patients who are not even exposed to them. The Centers for Disease Control and Prevention (CDC) estimates more than two million people are infected with antibiotic-resistant organisms, resulting in approximately 23,000 deaths annually. [5] Improving the use of antibiotics is an important patient safety and public health issue as well as a national priority. The 2006 CDC guideline “Management of Multi-Drug Resistant Organisms in Healthcare Settings” stated that control of multi-drug resistant organisms in healthcare “must include attention to judicious antimicrobial use.

A growing body of evidence demonstrates that hospital based programs dedicated to improving antibiotic use, commonly referred to as “Antibiotic Stewardship Programs (ASPs)”, can both optimize the treatment of infections and reduce adverse events associated with antibiotic use. These programs help clinicians improve the quality of patient care and improve patient safety through increased infection cure rates, reduced treatment failures, and increased frequency of correct prescribing for therapy and prophylaxis. They also significantly reduce hospital rates of CDI and antibiotic resistance. Moreover these programs often achieve these benefits while saving hospitals money. In recognition of the urgent need to improve antibiotic use in hospitals and the benefits of antibiotic stewardship programs, in 2014 CDC recommended that all acute care hospitals implement Antibiotic Stewardship Programs.

The Centers for Disease Control and Prevention (CDC) have released Core Elements of Hospital Antibiotic Stewardship Programs.

The Core Elements of Hospital Antibiotic Stewardship Programs are:

· Leadership Commitment: Dedicating necessary human, financial and information technology resources.

· Accountability: Appointing a single leader responsible for program outcomes. Experience with successful programs show that a physician leader is effective.

· Drug Expertise: Appointing a single pharmacist leader responsible for working to improve antibiotic use.

· Action: Implementing at least one recommended action, such as systemic evaluation of ongoing treatment need after a set period of initial treatment (i.e. “antibiotic time out” after 48 hours).

· Tracking: Monitoring antibiotic prescribing and resistance patterns.

· Reporting: Regular reporting information on antibiotic use and resistance to doctors, nurses and relevant staff.

· Education: Educating clinicians about resistance and optimal prescribing.

While CDC has released the Core Elements guidance, the various options for implementation and the full range of potential impacts of optimal implementation of the Core Elements are unknown. This Request for Task Order Proposal aims to evaluate optimal implementation of the Core Elements in Hospitals. http://www.cdc.gov/getsmart/healthcare/implementation/core-elements.html

2. Scope of Work CDC will contract with the selected contractor(s) to improve antibiotic stewardship programs in a group of at least 10 hospitals through implementation and evaluation of CDC’s Core Elements of Hospital Antibiotic Stewardship. The goals of the project will be to:

1. Design and implement scalable and sustainable antibiotic stewardship programs incorporating all of the Core Elements of Hospital Antibiotic Stewardship Programs.

2. Assess baseline volume of overall antibiotic use and appropriateness of antibiotic use.

3. Evaluate ASP program activities based on overall volume of overall antibiotic use and, appropriateness of antibiotic use.

4. Track other key patient-safety outcomes related to improved antibiotic use, including, treatment outcomes, length of stay, hospital readmissions, Clostridium difficile infections, antibiotic resistance and mortality.

5. Assess feasibility and acceptability of various implementation approaches for the CDC Core Elements for antibiotic stewardship programs in hospitals.

6. Assess barriers and potential solutions to implementation of the CDC Core Elements.

Assess the financial impact (e.g. cost savings) associated with implementation of the Core Elements.

3. Contractor Furnished Property The contractor shall provide all labor, expertise, materials, and supplies and perform all services required to carry out the work under this contract.

Base Period

Task 1: Communications with CDC Science Officer and Contracting Officers Representative (COR) Task 1a: Arrange and Attend Start Up Meeting

· Within 2 weeks of the effective date of the task order, the contractor shall schedule a teleconference with the COR/CDC Science Officer and other relevant staff identified at time of award.

· The contractor shall provide an agenda for the teleconference at least three days prior to the scheduled call.

· The purpose of this meeting will be to discuss critical contract performance milestones, to delineate roles and responsibilities, and to establish communication protocols. Each task and deliverable will be reviewed during this meeting.

· The contractor shall provide meeting minutes no later than 1 week after the teleconference.

Task 1b: Maintain Communication with COR/Science Officer

· The contractor shall arrange monthly conference calls between the contractor and COR/CDC Science Officer during the duration of the project.

· The contractor shall provide an agenda 2 business days prior to call and meeting minutes within 2 business days for all monthly conference calls.

· The contractor shall communicate with the CDC Science Officer whenever a problem/ change arises in the project.

· The contractor shall respond to all e-mail and telephone communications from the COR/CDC Science Officer or designee within 3 business days.

Task 1c: Submit Quarterly Progress Reports

· The contractor shall produce written quarterly progress reports that shall be submitted to COR/CDC Science Officer on the 10th day following the three months being reported.

· The reports shall include, at minimum, the current status of all tasks, problems encountered during the previous quarter, proposed or implemented solutions, planned activity for the upcoming quarter, and interim data analyses.

· The reports shall include project status updates and invoicing.

· The 12 month quarterly report shall include: The contractor shall provide, within 14 days of the end of the base period, an interim final report that summarizes the work to date and next steps including a summary of selected facilities, and a summary of the collection and analysis of the baseline data, including:

· A retrospective assessment of the overall volume and rate of systemic antibiotic use per patient days of therapy (DOT) at the ward/unit and facility level during baseline period

· A retrospective assessment of systemic antibiotic use and selection at the ward/unit level and facility level during the baseline period

· Patient level outcomes associated with antibiotic use and/or under-prescribing during the baseline period

· The 24 month quarterly report shall include: The contractor shall provide, within 14 days of the end of the Option Period 1, an interim final report that summarizes the implementation process and preliminary evaluation of primary and secondary outcomes. The report will also include preliminary lessons learned, recommendations for necessary modifications to the interventions based on lessons learned and plans for next steps.

Task 2: Recruitment of Included Facilities Task 2a: Select hospitals to implement the Core Elements of Hospital Antibiotic Stewardship Programs The contractor shall have access to a mixture of hospital networks of varying bed sizes in different geographic areas (rural, urban, etc.), including a mix of academic and non-academic hospitals. No more than half of the included sites shall be academic hospitals. No more than one third of the hospitals shall be federally owned (e.g. VA Hospitals). The contractor will choose at least 50 hospitals to include in the project representing a variety of sizes and geographic areas.

· Final site selection shall be in coordination with the COR/CDC Science Officer.

· Each included hospital shall include a physician champion to assist with education and implementation of interventions.

· The contractor shall provide to the COR/CDC Science Officer the characteristics of included facilities, including

· Type of facility (for-profit, not-for-profit; academic, non-academic; tertiary care, community, critical access)

· Number of providers

· Number of beds

· Urban, suburban or rural location

· Specialty status

· Overall mix of payers of patients served

Task 2b: Ensure the basic elements of Antibiotic Stewardship Programs (ASP’s) are in place at desired facilities; this will set the framework for the full implementation of all of the Core Elements of Hospital Antibiotic Stewardship Programs. The contractor will provide to the COR/CDC Science Officer a brief report stating the capabilities of selected facilities in terms of the ability to implement the all of Core Elements of Hospital Antibiotic Stewardship Programs.

This report shall include:

· Demonstrated leadership and financial commitment at the facility level, evidenced by a culture dedicated to improving antibiotic stewardship within the facility (ex: staff hours dedicated to ASP’s, facility led/implemented educational programs for providers, a history of quality improvement projects focused on improving antibiotic use, etc.)

· Identify individuals to be held accountable for antibiotic stewardship activities.

· Identify a pharmacist co-leader to bring drug expertise to the program activities.

· Ensure a tracking and reporting system is in place before the project start; use the Antibiotic Use (AU) reporting option for hospitals within the CDC’s National Healthcare Safety Network (NHSN). The NHSN AU option allows for standardized antibiotic use data, submitted electronically, to be aggregated and summarized for developing facility-adjusted national benchmarks.

Task 3: Protocol Development

Task 3a: Define 1-year baseline period

· The baseline period shall include a full year of hospital antibiotic prescribing.

· The baseline period shall be retrospective in order to complete the project in the three year time period.

Task 3b: Develop IRB protocol

· The contractor shall develop a protocol to be submitted for Institutional Review Board (IRB) approval.

· The contractor shall develop the protocol in coordination with the COR/CDC Science Officer and staff.

· The protocol shall include data collection forms and consent forms for the project.

· The IRB protocol shall include basic analytic plan for monitoring outcomes of interventions.

· The protocol shall be approved by the COR/CDC Science Officer prior to submission to IRB.

Task 3c: Obtain and maintain IRB approval

· The contractor shall obtain all needed local IRB approvals or exemptions. Any modifications to the protocol required by IRB shall be approved by COR/CDC Science Officer and the contractor.

· The contractor shall provide the COR/CDC Science Officer with all documentation of IRB approvals.

· The contractor shall renew IRB approval as required by IRB.

· The contract shall prepare and submit any needed protocol modifications or addendums for IRB approval.

· The COR/CDC Science Officer will submit for CDC IRB approval as required.

Task 4: Collection and Analysis of Baseline Data

Task 4a: Assess overall volume and rate of systemic antibiotic use per patient days of therapy (DOT) at the ward/unit and facility level during baseline period (retrospectively)

· Assessment of antibiotic use and rate shall include total antibiotic use, by class and agent.

· Rates shall be calculated as days of therapy (DOT).

· The contractor shall develop a sustainable, automated system to produce feedback reports at the ward/unit and facility level on overall antibiotic use as the primary outcome of the project.

· The facilities shall utilize the Antibiotic Use (AU) reporting option for hospitals within the CDC’s National Healthcare Safety Network (NHSN). The NHSN AU option allows for standardized antibiotic use data, submitted electronically, to be aggregated and summarized for developing facility-adjusted national benchmarks.

· The contractor shall update analytic plan as necessary in collaboration with COR/CDC Science Officer.

Task 4b: Assess appropriateness of use and selection of systemic antibiotics at the ward/unit and facility level during baseline period (retrospectively)

· To determine appropriateness, the contractor shall obtain the following information on patient encounters from the medical record such as

· Patient demographic characteristics: age and sex

· Diagnoses and indications for antibiotic use for each encounter

· Laboratory testing results,

· Patient comorbidities

· Medication allergies

· Recent systemic antibiotic use prior to illness episode

· The contractor shall define instances in which to assess appropriate antibiotic use based either on infectious diseases (e.g. urinary tract infections, pneumonia, skin and soft tissue infections) or on specific antibiotics or combinations of antibiotics (e.g. vancomycin, fluoruquinolones). Appropriate therapy shall be defined based on local and national best practices.

· Ideally, the contractor shall involve providers at intervention facilities in defining targeted conditions.

· The contractor shall develop a sustainable, automated system to produce feedback reports at the provider and facility level on appropriateness of antibiotic prescribing for targeted conditions as this will be a primary outcome of this project.

· The contractor shall update analytic plan as necessary in collaboration with COR/CDC Science Officer.

Task 4c: Measure patient-level outcomes associated with antibiotic use and/or under-prescribing during baseline period

· The contractor shall use longitudinal data to measure patient-level outcomes, including the following:

· Clostridium difficile infections

· Antibiotic resistance rates

· Hospital readmissions within 30 days of index encounter

· Mortality

· Appropriateness of antibiotic prescribing

· The contractor shall update analytic plan as necessary in collaboration with the COR/CDC Science Officer.

Task 5: Design Scalable and Sustainable Antibiotic Stewardship Interventions that Incorporate All Core Elements of Hospital Antibiotic Stewardship Programs The contactor shall develop interventions that incorporate all Core Elements of Hospital Antibiotic Stewardship Programs:

· Leadership Commitment: Show that there are dedicated human, financial and information technology resources.

· Accountability: Appoint a single leader responsible for program outcomes. Experience with successful programs show that a physician leader is effective.

· Drug Expertise: Appoint a single pharmacist leader responsible for working to improve antibiotic use.

· Action: Implement at least one recommended action, such as systemic evaluation of ongoing treatment need after a set period of initial treatment (i.e. “antibiotic time out” after 48 hours).

· Tracking: Monitor antibiotic prescribing and resistance patterns.

· Reporting: Regularly report information on antibiotic use and resistance to doctors, nurses and relevant staff.

· Education: Educate clinicians about resistance and optimal prescribing.

· Interventions shall be scalable to multiple differing hospitals without negatively impacting operations.

· Interventions shall be sustainable, such that if found to be effective, these interventions can be continued after the end of the evaluation period.

· Ideally, the contractor will include providers at program facilities in the development activities/interventions.

· The contractor shall design program activities that help providers overcome barriers to appropriate prescribing.

· Interventions shall target either: 1) overall antibiotic use; and/or 2) appropriateness of antibiotic use; or 3) selection for targeted conditions (e.g. pneumonia, urinary tract infections, skin and soft tissue infections) or antibiotics. Overall antibiotic use and appropriateness for targeted conditions shall be tracked as outcome measures.

Task 6: Attend a joint meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD contractors Task 6: Attend a joint meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD contractors

· The contractor shall attend a meeting at CDC for all Office of Antibiotic Stewardship SHEPherD contracts in which contractors will share lessons learned and interim results.

· The purpose of this meeting will be to encourage cross-cutting collaboration between antibiotic stewardship activities across the spectrum of healthcare and to update funders on progress made to date.

· Meeting is being planned for fall 2017.

Task 7: Implementation and Evaluation of Interventions based on Core Elements

Task 7a: Implement scalable and sustainable antibiotic stewardship programs based on all of the Core Elements of Hospital Antibiotic Stewardship Programs across a variety of hospitals.

· The contractor shall implement previously designed interventions in all included facilities.

Task 7b: Begin the assessment of primary and secondary outcomes of interventions (will continue into Option Period 2 if funded).

Primary outcomes:

1. Overall volume and rate of systemic antibiotic use per days of therapy at the ward/unit and facility level

2. Appropriateness of use and selection of antibiotics for targeted conditions at the provider and facility level

Secondary outcomes

1. Patient-level outcomes potentially associated with

a. Clostridium difficile infections within 12 weeks of index encounter

b. Antibiotic resistance rates

c. Hospital readmissions within 30 days of index encounter

d. Mortality

2. Intervention-level outcomes

a. Acceptability in hospitals among providers

b. Feasibility and sustainability of interventions

c. Cost of interventions

d. Potential cost-savings of interventions

· The contractor shall conduct quarterly interim analyses of primary outcomes and patient-level secondary outcomes and include results of these interim analyses in quarterly progress reports.

· The contractor shall monitor primary and secondary outcomes for the duration of Option Period 1 after implementation of programs.

· The contractor shall report preliminary results of all outcomes in the interim final report.

Task 7c: Arrange and attend site visit by CDC staff during implementation.

· The contractor shall arrange and attend site visit with contractor and CDC Science Officer at included facilities within first two weeks of implementation.

· Additional site visits during implementation may be arranged as necessary.

Task 8: Continued Implementation and Evaluation of Interventions based on Core Elements

Task 8a: Continue to implement scalable and sustainable antibiotic stewardship programs based on all of the Core Elements of Hospital Antibiotic Stewardship Programs across a variety of hospitals.

· The contractor shall continue to implement designed and modified (if needed) interventions in all included facilities.

Task 8b: Continue the assessment of primary and secondary outcomes of interventions, over a minimum of 18 months total.

Primary outcomes:

1. Overall volume and rate of systemic antibiotic use per days of therapy at the ward/unit and facility level

2. Appropriateness of use and selection of antibiotics for targeted conditions at the provider and facility level

Secondary outcomes

1. Patient-level outcomes potentially associated with

a. Clostridium difficile infections within 12 weeks of index encounter

b. Antibiotic resistance rates

c. Hospital readmissions within 30 days of index encounter

d. Mortality

2. Intervention-level outcomes

a. Acceptability in hospitals among providers

b. Feasibility and sustainability of interventions

c. Cost of interventions

d. Potential cost-savings of interventions

· The contractor shall conduct quarterly interim analyses of primary outcomes and patient-level secondary outcomes and include results of these interim analyses in quarterly progress reports.

· The contractor shall monitor primary and secondary outcomes for a minimum of 18 months after implementation of programs (can span Option Period 1 and Option Period 2).

· The contractor shall report results of all outcomes in the final report.

Task 8c: Arrange and attend site visit by CDC staff during continued implementation.

· The contractor shall arrange and attend site visit with contractor and CDC Science Officer at included intervention facilities .within the first quarter of Option Period 2.

· Additional site visits during implementation may be arranged as necessary.

Task 9: Final Reports

Task 9a: Analyze final data and present findings

· The contractor shall finalize the analytic plan to be reviewed with CDC staff.

· The contractor shall analyze data to determine effectiveness of interventions by comparing baseline and intervention periods for primary and secondary outcomes.

· The contractor shall conduct a cost-effectiveness analysis of interventions.

· The contractor shall present analyses to CDC Science Officer.

Task 9b: Final reports

· The contractor shall produce final written reports of implementation and evaluation of Core Elements of Hospital Antibiotic Stewardship Programs. These reports shall include draft and final reports. The final report shall be ready within 6 weeks of submission of a draft final report and within 4 weeks after receiving comments and recommendations on the report by CDC staff.

· Reports shall include the effectiveness of interventions by comparing baseline and intervention periods for primary and secondary outcomes and cost-effectiveness analyses.

· Reports shall include lessons learned and recommendations for future efforts to implement the Core Elements of Hospital Antibiotic Stewardship Programs.

· Additionally, the contractor shall lead a peer-reviewed manuscript to be written in collaboration with CDC staff.

Deliverables Summary Table

The following deliverables shall be provided to the Science Officer and relevant CDC staff no later than the dates specified below:

Base Period Tasks

Frequency Due Date

Minutes – 2 days after each scheduled call

Frequency Due Date

Frequency Due Date

4. General Information

A. Place of Performance: The work to be performed under this contract will be performed at the Contractor’s facility and associated academic, healthcare or research facilities as required.

B. Type of Contract: The government will award a firm-fixed price contract.

C. Contractor Travel: The contractor shall attend a meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD contractors in which contractors will share lessons learned and interim results. The purpose of this meeting will be to encourage cross-cutting collaboration between antibiotic stewardship activities across the spectrum of healthcare. Travel shall be in accordance with the Federal Travel Regulation (FTR).

D. Data Rights: 52.227-14 Rights in Data-General, Alternate IV (Dec 2007). As prescribed in 27.409(b)(5), substitute the following paragraph (c)(1) for paragraph (c)(1) of the basic clause: (c) Copyright—(1) Data first produced in the performance of the contract. Except as otherwise specifically provided in this contract, the Contractor may assert copyright in any data first produced in the performance of this contract. When asserting copyright, the Contractor shall affix the applicable copyright notice of 17 U.S.C. 401 or 402, and an acknowledgment of Government sponsorship (including contract number), to the data when such data are delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. For data other than computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. For computer software, the Contractor grants to the Government and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public), by or on behalf of the Government.

E. Confidentiality of Information: Work on this project may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The user agency will identify and provide direction and guidance for safeguarding all information subject to the Privacy Act. Reports and case files containing individual personal information are confidential. The CDC is not authorized to release individual case reports, and access to individual case data is strictly controlled. The contractor personnel are required to work with case records as well as databases. It is a requirement that the data remain in a controlled access environment.

F. Section 508: Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services. Regardless of format, all Web content or communications materials produced for publication on or delivery via CDC Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors1) or consultants responsible for preparing or posting content intended for use on an CDC-funded or CDC-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material. Checklists for various file formats are available at http://www.hhs.gov/web/508/index.html.

The following Section 508 provisions apply to the content or communications material identified in this SOW or PWS: 36 CFR 1194.21 (for software and programmatic elements in websites), 36 CFR 1194.22 (for documents and websites), and 36 CFR 1194.24 (for video and multimedia content) References: HHS Policy for Section 508 Electronic and Information Technology (E&IT) (January 2005): http://www.hhs.gov/od/Final_Section_508_Policy.html HHS Section 508 Web site: http://508.hhs.gov/ HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm 1 Prime contractors may enter into subcontracts in the performance of a Federal contract, The proponderance of the work is performed by the prime is preferred.

G. The below information complies with HHSA Security compliance requirements for E-Government Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA 2014)

Security Compliance

The contractor must have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government. We provide the following information to assist in the preparation of documents necessary for the Security Assessment and Authorization (SA&A) of an Information System. The FISMA 2014, (Federal Information Security Modernization Act of 2014) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (https://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/drivers/documents/FISMA-final.pdf ) and the Federal Information Security Modernization Act of 2014 (P.L. 113-283) (FISMA 2014) (https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

· FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

· FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf),

· NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf),

· NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf),

· NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

· NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf),

· NIST Special Publication 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the FISMA 2014 and NIST Special Publication 800-18, 800-37 and will include selected mandatory controls required by NIST Special Publication 800-53, Volume I & II. The successful contractor in conjunction with the NCEZID Information System Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer (CISO). The successful completion of the SA&A documents will result in an award of an Authority To Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCEZID ISSO and confirmed by the CDC Certifying Authority as part of the SA&A process.

The successful contractor is responsible for providing pertinent security information to the NCEZID ISSO and Security Staff and assisting in completing the below CDC SA&A documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCEZID Security Staff. Completed documents will be sent by the NCEZID Security Staff to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

· Baseline System Information (BSI)

· Privacy Impact Assessment (PIA)

· System Security Plan (SSP)

· Business Continuity Plan (BCP)

· Risk Assessment Report (RAR)

The Contractor shall respond to the following seven security–associated requirements in the application:

(1) Position Sensitivity Designations CDC requires a Public Trust Level 5 for the following

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-contractor staff) working under the contract that will have the ability to access NCEZID sensitive information from the system. .

Non-Disclosure Agreements

The Contractor and any sub-Contractors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Contractor's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact Assessment (PIA) as defined by Section 208 of the FISMA 2014. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and contractor, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Contractor’s Official Responsible for Information Security The contractor shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the contractor be selected for an award.

(4) Rules of Behavior The contractor’s employees and subcontractors shall comply with the HHS Information Technology General Rules of Behavior.

(5) Information Security Training HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful contractor shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Contractor's expense and would be the Contractor's responsibility to plan and arrange.

The successful contractor shall maintain a listing of all individuals who have completed this training and shall submit this listing to the Science officer.

(6) HSPD-12 Compliance Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all contractors providing hardware and software to the federal government are now required to ensure that these PIV cards will integrate with their software and hardware at the application level. Contractor must be able to implement and support PIV card integration.

(7) Encryption All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain CDC- data shall have full-disk encryption using FIPS 140-2 compliant algorithms.

5. Government Furnished Property, Equipment, and Services

Contractor will provide all necessary equipment, property and services to complete this task order. No government furnished property, equipment and services shall be used.

6. Payment Terms

Payment will be subject to receipt of deliverables in accordance with the payment schedule established herein and in accordance with FAR 52.232-25. Prompt Payment, which states that the due date for making invoice payments shall be the 30th day after the designated billing office (see block 21 of the order) has received a proper invoice from the contractor or the 30th day after Government acceptance of the services provided by the contractor, whichever is later.

Schedule of Milestones for Performance-Based Payments In accordance with FAR 52.232-32, PERFORMANCE BASED PAYMENTS (April 2012), upon successful completion of an event, the contractor may request performance based payments. The determination of eligibility for receipt of payment will be made by the Contracting Officer upon written certification from the Contracting Officer’s Representative (COR) that the performance milestone has been met. It is anticipated that each milestone payment will approximate the estimated timeline listed below but variation is anticipated and eligibility for payment could occur sooner or later depending upon the time of completion of the designated milestone. Milestone payments are subject to the terms of FAR 52.232-32 incorporated in this contract.

The COR receiving and acceptance of monthly performance based payments is based on verification that work on the contract was satisfactorily performed during the month and that, at a minimum, the following activities were satisfactorily performed.

Performance Based Payment Schedule – Base Period

Submission of quarterly status reports including, summary of modified program activities for implementation and analyses of primary and secondary outcomes

Selection of facilities to implement the Core Elements of Hospital Antibiotic Stewardship Programs and characteristics of included facilities, including their ability to implement the core elements

Brief report stating the overall volume and rate of systemic antibiotic use during the baseline period

Summary of information on…