ATTACHMENT_4-Domain_4_Sample_RFTOP.doc

ATTACHMENT 4 SAMPLE TASK ORDER 4

Domain 4: RFTOP 2016-4-Task Order 001 Improving Infection Prevention to Reduce Bloodstream Infections in Hemodialysis Estimated Price Range:

FORMCHECKBOX

Over $1,000,000 but less than $1,300,000 Base Award

FORMCHECKBOX

Over $1,900,000 but less than $2,370,000 Option Period 1 Proposed Period of Performance: This award will be a base period of 12 months, which includes one 24 month option period. Work for the base period shall begin from date of award of the order and shall continue for a period of 12 months. Funding for Option Period 1 of 24 months will be subject to availability of funds.

SECTION B – DESCRIPTION OF WORK

1. Background and Need More than 370,000 U.S. persons receive long-term hemodialysis (HD). Infection is a leading cause of morbidity and is second only to cardiovascular disease as the leading cause of death in the chronic uremic patient on hemodialysis. In comparison to the general population, the incidence of sepsis in patients with end stage renal disease (ESRD) can be up to 100 times higher. Infections are a major reason for hospitalizations in this population, estimated to be responsible for as many as 20 percent of all inpatient admissions. These infections also confer a higher risk of mortality than in the general population. Additionally, it has been predicted that the number of ESRD patients will increase approximately 1.5-fold by the year 2020, underscoring the importance for prevention efforts in this population to reduce the physical, emotional and financial cost of infections.

Most hemodialysis treatments occur in freestanding clinics outside of hospitals. Much like other outpatient settings, these facilities typically lack dedicated staff and resources for infection prevention. During investigations of HAI outbreaks in dialysis settings, CDC has repeatedly identified gaps in basic infection control procedures. These lapses in infection prevention practice (e.g., inadequate hand hygiene or improper vascular access care) may contribute to the spread of antibiotic resistant organisms and acquisition of serious infections, like bloodstream infections, during dialysis care.

CDC has the goal of eliminating healthcare-associated infections (HAIs) wherever patients receive care and is currently at the forefront of the federal effort to protect patients; its efforts to protect vulnerable ESRD patients date back several decades. Recently, the Department of Health and Human Services National Action Plan to Prevent Healthcare-Associated Infections announced a goal to decrease all bloodstream infections in hemodialysis patients by 40 percent in five years and reduce access-related bloodstream infections by 50 percent in five years. CDC’s Dialysis Bloodstream Infection Prevention Collaborative demonstrated, over a fifteen-month period, a 32 percent decrease in bloodstream infections and a 54 percent decrease in access-related bloodstream infections following implementation of CDC prevention guidelines. Further analysis demonstrated that early reductions in access-related BSI were sustained 4 years after initiation. Additionally, CDC has recently facilitated enrollment of 97% of all Medicare-eligible dialysis facilities into its healthcare-associated infections tracking system, the National Healthcare Safety Network (approximately 6,400 dialysis facilities total).

The Core Interventions for Dialysis Bloodstream Infection Prevention include:

· Surveillance and feedback using NHSN

· Conduct monthly surveillance for BSIs and other dialysis events using CDC’s National Healthcare Safety Network (NHSN). Review facility rates and actively share results with front-line clinical staff.

· Hand hygiene observations

· Perform observations of hand hygiene opportunities monthly and share results with clinical staff.

· Catheter/vascular access care observations

· Perform observations of vascular access care and catheter accessing quarterly. Assess staff adherence to aseptic technique when connecting and disconnecting catheters and during dressing changes. Share results with clinical staff.

· Staff education and competency

· Train staff on infection control topics, including access care and aseptic technique. Perform competency evaluation for skills such as catheter care and accessing every 6-12 months and upon hire.

· Patient education/engagement

· Provide standardized education to all patients on infection prevention topics including vascular access care, hand hygiene, risks related to catheter use, recognizing signs of infection, and instructions for access management when away from the dialysis unit.

· Catheter reduction

· Incorporate efforts (e.g., through patient education, vascular access coordinator) to reduce catheters by identifying and addressing barriers to permanent vascular access placement and catheter removal.

· Chlorhexidine for skin antisepsis

· Use an alcohol-based chlorhexidine (>0.5%) solution as the first line skin antiseptic agent for central line insertion and during dressing changes.

· Catheter hub disinfection

· Scrub catheter hubs with an appropriate antiseptic after cap is removed and before accessing. Perform every time catheter is accessed or disconnected.

· Antimicrobial ointment

· Apply antibiotic ointment or povidone-iodine ointment to catheter exit sites during dressing change.

Unfortunately, only a small number of dialysis facilities are likely to be fully implementing the prevention efforts associated with CDC’s Dialysis Bloodstream Prevention Collaborative at this time. CDC has released the prevention tools associated with the collaborative, including checklists and audit tools, but lacks resources to ensure their implementation in all dialysis facilities in the country. This Request for Task Order Proposal aims to extend the success seen in the prevention collaborative in order to evaluate implementation of the Core Interventions for Dialysis Bloodstream Infection Prevention. CDC believes extending this initiative can make a positive impact on hemodialysis patient bloodstream infections and access-related bloodstream infections by promoting the timely and thorough uptake of its proven prevention activities, resources and strategies and by educating and empowering dialysis patients as active partners in this effort. http://www.cdc.gov/dialysis/prevention-tools/core-interventions.html

2. Scope of Work CDC intends to improve infection prevention to reduce bloodstream infections in hemodialysis outpatients through assessing current infection control practices and implementation and evaluation of Core Interventions for Dialysis Bloodstream Infection Prevention. The goals of the project will be to:

1. Assess, at both the facility- and aggregate group facility level, the baseline rate of bloodstream infections, access-related blood stream infections and other dialysis events (e.g., intravenous antibiotic starts) based on existing data reported into NHSN.

2. Assess gaps in current infection control practices and bloodstream infection prevention practices in dialysis facilities and identify areas for improved focus and education for dialysis staff, patients and their family members.

3. Implement an educational component aimed at increasing awareness among dialysis staff, patients and their family members about preventing infections during dialysis care.

4. Implement scalable and sustainable bloodstream infection reduction programs based on the Core Interventions for Dialysis Bloodstream Infection Prevention

5. Assess the feasibility and acceptability of the Core Interventions among providers and staff working in dialysis facilities

6. Demonstrate improvements in infection prevention practices, reductions in bloodstream infections, access-related bloodstream infections, and antibiotic starts in dialysis patients.

To achieve the goals of the project, the contractor shall include their dialysis facilities at which overall bloodstream infections and prevention process measure audit data can be assessed using CDC’s National Healthcare Safety Network at the facility level. The contractor shall identify opportunities for improvement in compliance with Core Interventions for Dialysis Bloodstream Infection Prevention. Throughout implementation the contractor shall identify opportunities for improving implementation of CDC Core Interventions for Dialysis Bloodstream Infection Prevention. Based on identified opportunities for improvement, the contractor shall implement recommended interventions across selected facilities and educate staff and patients on CDC recommendations and accepted infection prevention practices and principles. The CDC Core Interventions for Dialysis Bloodstream Infection Prevention shall be implemented in a manner which would sustain processes and outcomes even after project completion. Partnering with local and state health departments and ESRD Networks may strengthen collaboration and increase access to data.

The contractor shall assess the effectiveness of the interventions by comparing pre- and post-intervention bloodstream and access-related bloodstream infection rates at the facility level. Additionally, the contractor shall track audit data using existing CDC audit tools (e.g., hand hygiene, catheter connection and disconnection).

If necessary, the contractor will coordinate with the COR/CDC Science Officer and other staff to develop any necessary IRB protocols, as well as obtaining and maintaining all necessary local IRB approvals to fulfill the project objectives. The contractor will be responsible for data analyses of primary and secondary outcomes and for preparation of a draft of peer-reviewed manuscript.

3. Contractor Furnished Property The contractor shall provide all labor, expertise, materials, and supplies and perform all services required to carry out the work under this contract.

Base Period Task 1: Arrange and Attend Start Up Meeting

· Within 2 weeks of the effective date of the task order, the contractor shall attend a teleconference with the COR/CDC Science Officer and other relevant staff identified at time of award.

· The contractor shall schedule the teleconference and provide an agenda within one week of the effective date of the task order.

· The purpose of this meeting will be to discuss critical contract performance milestones, to delineate roles and responsibilities, and to establish communication protocols.

· The contractor shall provide meeting minutes no later than 1 week after the teleconference.

Task 2: Maintain Communication with COR/CDC Science Officer and Contracting Officer’s Representative (COR)

· The contractor shall arrange monthly conference calls between the contractor and CDC project staff during the duration of the project.

· The contractor shall provide an agenda 2 business days prior to call and meeting minutes within 2 business days for all monthly conference calls.

· The contractor shall maintain regular communication with the CDC Science Officer, COR and communicate whenever a problem/change arises in the project.

· The contractor shall respond to all e-mail and telephone communications from the COR/

CDC Science Officer or designee within 3 business days.

Task 3: Develop protocol(s) for baseline data collection and program interventions

· The contractor shall develop a protocol, in coordination with the COR/CDC Science Officer, to be submitted for Institutional Review Board (IRB) approval or exemption. The COR/CDC Science Officer shall approve the protocol prior to submission to the IRB.

· The protocol shall include:

· Data collection forms, audit forms, and consent forms for the project.

· Basic analytic plan for monitoring baseline measures (e.g., BSI rates).

Task 4: Obtain and maintain IRB approval/exemption for baseline data collection and program interventions

· The contractor shall obtain all needed local IRB approvals. Any modifications to the protocol required by IRB shall be approved by COR/CDC Science Officer and the contractor.

· The contractor shall provide the COR/CDC Science Officer with all documentation of IRB approvals.

· The contractor shall renew IRB approval as required by IRB.

· The contractor shall prepare and submit any needed protocol modifications or addendums for IRB approval.

Task 5: Submit Quarterly Progress Reports

· The contractor shall produce quarterly progress reports that shall be submitted to the COR/CDC Science Officer on the 10th day following the three months being reported.

· The reports shall include, at minimum, the current status of all tasks, problems encountered during the previous quarter, proposed or implemented solutions, planned activity for the upcoming quarter, and interim data analysis.

· The contractor shall provide an invoice status report.

Task 6: Develop a plan with contractor-owned facilities to implement the Core Interventions for Dialysis Bloodstream Infection Prevention The contractor shall have direct access to a mixture of dialysis facilities of varying sizes in different geographic areas (rural, urban, etc.) and choose a minimum of 30-50 facilities to include in the project representing a variety of sizes and geographic areas.

· Facilities shall be identified in coordination with the COR/CDC Science Officer.

· Each included dialysis facility shall have access to an infection prevention champion to assist with education and implementation of interventions.

· The contractor shall provide to the COR/CDC Science Officer the characteristics of included facilities, including

· Ownership (not for profit vs for profit)

· Member of corporate chain of dialysis centers

· Large dialysis organization

· Dialysis services offered (in-center hemodialysis, peritoneal dialysis, home hemodialysis)

· Population served (adult or pediatric)

· Hospital affiliation (hospital affiliated or not hospital affiliated)

· Region (Midwest, Northeast, South, West)

· Number of in-center hemodialysis stations

· Patient census

· Proportion of patients with CVC

· Number of months reported pre-intervention and post-intervention Task 7: Assess which of the basic elements of the Core Interventions for Dialysis Bloodstream Infection Prevention are in place at desired facilities.

The contractor will provide to the COR/CDC Science Officer a brief report stating the capabilities of selected facilities in terms of the ability to implement the Core Interventions for Dialysis Bloodstream Infection Prevention; this will set the framework for the full implementation of the Core Interventions for Dialysis Bloodstream Infection Prevention. Baseline assessment include:

· Dialysis event surveillance using NHSN

· At least 12 months of retrospective NHSN data, prior to the baseline period, which can be shared with and aggregated by the contractor.

· During the baseline period, NHSN data will continue to be collected, entered into NHSN, and evaluated/analyzed as part of the baseline pre-intervention data.

· Data from most recent Outpatient Dialysis Center practices survey within NHSN

· Which elements of the Core Interventions for Dialysis Bloodstream Infection Prevention are currently practiced, any gaps identified and results of at least the last 3 months of observations/audits (if applicable)

· Hand hygiene observations

· Catheter/vascular access care observations

· Staff education and competency

· Patient education/engagement

· Catheter reduction

· Chlorhexidine for skin antisepsis

· Catheter hub disinfection

· Antimicrobial ointment Task 8: Arrange and attend facility visits

· The contractor shall arrange and attend facility visits at participating facilities during the baseline period.

Option Period 1 Task 1: Arrange and Attend Start Up Meeting

· Within 2 weeks of the effective date of the task order, the contractor shall attend a teleconference with the CDC Science Officer and other relevant staff identified at time of award.

· The contractor shall schedule the teleconference and provide an agenda within one week of the effective date of the task order.

· The purpose of this meeting will be to discuss critical contract performance milestones, to delineate roles and responsibilities, and to establish communication protocols.

· Each task and deliverable will be reviewed during this meeting.

· The contractor shall provide meeting minutes no later than 1 week after the teleconference.

Task 2: Maintain Communication with COR/Science Officer

· The contractor shall arrange monthly conference calls between the contractor and CDC project staff during the duration of the project.

· The contractor shall provide an agenda 2 business days prior to call and meeting minutes within 2 business days for all monthly conference calls.

· The contractor shall maintain regular communication with the COR/CDC Science Officer and communicate whenever a problem/change arises in the project.

· The contractor shall respond to all e-mail and telephone communications from the COR/CDC Science Officer or designee within 3 business days.

Task 3: Develop protocol(s) for continued data collection and program interventions.

· The contractor shall develop a protocol, in coordination with the COR/CDC Science Officer, to be submitted for Institutional Review Board (IRB) approval or exemption. The COR/CDC Science Officer shall approve the protocol prior to submission to the IRB.

· The protocol shall include:

· Data collection forms and consent forms for the project.

· Basic analytic plan for monitoring outcomes of interventions.

Task 4: Maintain IRB approval/exemption for continued data collection and program interventions

· The contractor shall maintain all needed local IRB approvals. Any modifications to the protocol required by IRB shall be approved by COR/CDC Science Officer and the contractor.

· The contractor shall provide the COR/CDC Science Officer with all documentation of IRB approvals.

· The contractor shall renew IRB approval as required by IRB.

· The contractor shall prepare and submit any needed protocol modifications or addendums for IRB approval.

Task 5: Submit Quarterly Progress Reports

· The contractor shall produce quarterly progress reports that shall be submitted to the CDC Science Officer on the 10th day following the three months being reported.

· The reports shall include, at minimum, the current status of all tasks, problems encountered during the previous quarter, proposed or implemented solutions, planned activity for the upcoming quarter, and interim data analysis.

· The reports shall include progress report and invoicing updates.

Task 6: Attend a joint meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD vendors

· The contractor shall attend a meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD contracts in which contractors will share lessons learned and interim results.

· The purpose of this meeting will be to encourage cross-cutting collaboration between antibiotic stewardship activities across the spectrum of healthcare and to update funders on progress made to date.

· Meeting is being planned for fall 2017.

Task 7: Distribute prevention packages for participating dialysis facilities.

Prevention materials are available on the CDC website to aid in implementation, minimally including:

· CDC’s core Interventions for Dialysis BSI Prevention

· Dialysis Observation Tools

· Dialysis Checklist Tools

· Scrub-the-Hub Protocol for Hemodialysis Catheters

· Hand Hygiene and Glove Use Observations Protocol

· CDC’s Continuing Education Course for Dialysis Nurses and Technicians

Task 8: Implement prevention package at each participating facility.

The contractor shall work with individual facilities to improve implementation from baseline by improving elements already in place and adding 4 or more components (ideally all components) of the core interventions package (see below).

· Surveillance and feedback using NHSN

· Hand hygiene observations

· Catheter/vascular access care observations

· Staff education and competency

· Patient education/engagement

· Catheter reduction

· Chlorhexidine for skin antisepsis

· Catheter hub disinfection

· Antimicrobial ointment The contractor may enlist an experienced infection prevention consultant who has worked with CDC in the past on the BSI Prevention Collaborative and is familiar with the prevention package. In addition, the contractor is encouraged to work with local and state public health partners and the ESRD Networks to enhance implementation.

Task 9: Arrange and attend facility visits

· The contractor shall arrange and attend facility visits at participating facilities during the implementation period.

Task 10: Track and evaluate prevention progress.

The contractor will discuss audit data and NHSN Dialysis Event data with the CDC Project Manager to obtain guidance on areas for improvement. The contractor will provide feedback to participating facilities based on audit data, NHSN Dialysis Event data, and input from the CDC Project Manager. Utilization of data collected from audits and NHSN will identify facilities that need additional assistance in implementation of infection prevention practices. Information collected through audits and NHSN shall be shared directly with staff at participating facilities on a regular basis.

Task 11: Assess progress toward primary and secondary outcomes of program for at least one year after implementation

Primary outcomes:

1. Percent reduction in overall bloodstream infections.

2. Percent reduction in access-related bloodstream infections.

Secondary outcomes

1. Percent reduction in antibiotic starts among dialysis patients

2. Intervention-level outcomes

a. Acceptability in dialysis setting among providers

b. Feasibility and sustainability of interventions

· The contractor shall conduct interim analyses of primary outcomes and patient-level secondary outcomes every 6 months and include results of these interim analyses in quarterly progress reports.

· The contractor shall monitor primary and secondary outcomes for one year after implementation of interventions.

· The contractor shall report results of all outcomes in the final report.

Task 12: Analyze final data and present findings

· The contractor shall finalize the analytic plan to be reviewed and approved by CDC Science Officer.

· The contractor shall analyze data to determine effectiveness of activities by comparing baseline and program activity periods for primary and secondary outcomes.

· The contractor shall present analyses to CDC Science Officer and staff.

Task 13: Final reports

· The contractor shall produce final written reports of program activities and evaluation of Core Interventions for Dialysis Bloodstream Infection Prevention. These reports shall include draft and final reports. The final report shall be ready within 6 weeks of submission of a draft final report and within 4 weeks after receiving comments and recommendations on the report by CDC staff.

· Reports shall include the effectiveness of programs by comparing baseline and activity periods for primary and secondary outcomes.

· Reports shall include lessons learned and recommendations for future efforts to implement the Core Interventions for Dialysis Bloodstream Infection Prevention.

· Additionally, the contractor shall lead a peer-reviewed manuscript to be written in collaboration with CDC staff.

Deliverables Summary Table

The following deliverables shall be provided to the COR/Science Officer no later than the dates specified below:

Base Period

Frequency Due Date

1 Arrange and Attend Start Up Meeting

Within one week of the effective date of the task order

2 Maintain communication with COR/ Science Officer

Minutes – 2 days after each scheduled call

3 Develop protocols for baseline data collection and program interventions/activities

4 Obtain and maintain IRB approval/exemption for baseline data collection and program interventions/activities

IRB approvals/exemptions provided to COR/CDC Science Officer All

As needed/updated 5 months after effective date of task order

Within 24 hours of IRB approval/exemption

5 Submit quarterly progress reports

6 Develop a plan with contractor-owned facilities to implement the Core Interventions for Dialysis Bloodstream Infection Prevention

7 Assess which of the basic elements of the Core Interventions for Dialysis Bloodstream Infection Prevention are in place at desired facilities

Option Period 1

Frequency Due Date

1 Arrange and Attend Start Up Meeting

Within one week of the effective date of the task order

2 Maintain communication with CDC staff

Minutes – 2 days after each scheduled call

3 Develop protocols for continued data collection and program interventions/activities

4 Maintain IRB approval/exemption for continued data collection and program interventions/activities

IRB approvals/exemptions provided to CDC Science Officer All

As needed/updated 5 months after effective date of task order

Within 24 hours of IRB approval/exemption

5 Submit quarterly progress reports

6 Attend a joint meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD vendors

8 Implement prevention package at each participating facility

9 Arrange and attend facility visits

10 Track and evaluate prevention progress

11 Assess progress toward primary and secondary outcomes of program for at least one year after implementation

12 Analyze final data and present findings

13 Final reports

4. General Information

A. Place of Performance: The work to be performed under this contract will be performed at the Contractor’s facility and associated academic, healthcare or research facilities as required.

B. Type of Contract: The government will award a firm-fixed price contract.

C. Contractor Travel: Contractor will be required to travel during the performance of this contract for data collection. The contractor shall have project personnel visit each participating facility during the base period and the option period. The purpose of these visits will be to assist with assessment, implementation and data collection. The contractor shall attend a meeting at CDC for all Office of Antibiotic Stewardship SHEPheRD vendors in which vendors will share lessons learned and interim results. The purpose of this meeting will be to encourage cross-cutting collaboration between antibiotic stewardship activities across the spectrum of healthcare. Travel shall be in accordance with the Federal Travel Regulation (FTR) and the limitation of funds specified in this contract.

D. Data Rights 52.227-14 Rights in Data-General, Alternate IV (Dec 2007). As prescribed in 27.409(b)(5), substitute the following paragraph (c)(1) for paragraph (c)(1) of the basic clause: (c) Copyright—(1) Data first produced in the performance of the contract. Except as otherwise specifically provided in this contract, the Contractor may assert copyright in any data first produced in the performance of this contract. When asserting copyright, the Contractor shall affix the applicable copyright notice of 17 U.S.C. 401 or 402, and an acknowledgment of Government sponsorship (including contract number), to the data when such data are delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. For data other than computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. For computer software, the Contractor grants to the Government and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public), by or on behalf of the Government.

E. Confidentiality of Information: Work on this project may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The user agency will identify and provide direction and guidance for safeguarding all information subject to the Privacy Act. Reports and case files containing individual personal information are confidential. The CDC is not authorized to release individual case reports, and access to individual case data is strictly controlled. The contractor personnel are required to work with case records as well as databases. It is a requirement that the data remain in a controlled access environment.

F. Section 508: Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services. Regardless of format, all Web content or communications materials produced for publication on or delivery via CDC Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors1) or consultants responsible for preparing or posting content intended for use on an CDC-funded or CDC-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material. Checklists for various file formats are available at http://www.hhs.gov/web/508/index.html.

The following Section 508 provisions apply to the content or communications material identified in this SOW or PWS: 36 CFR 1194.21 (for software and programmatic elements in websites), 36 CFR 1194.22 (for documents and websites), and 36 CFR 1194.24 (for video and multimedia content) References: HHS Policy for Section 508 Electronic and Information Technology (E&IT) (January 2005): http://www.hhs.gov/od/Final_Section_508_Policy.html HHS Section 508 Web site: http://508.hhs.gov/ HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm 1 Prime contractors may enter into subcontracts in the performance of a Federal contract, but the prime remains obligated to deliver what is called for under the contract.

5. Government Furnished Property, Equipment, and Services Contractor will provide all necessary equipment, property and services to complete this task order. No government furnished property, equipment and services shall be used.

6. Payment Terms

Payment will be made quarterly and subject to receipt of deliverables in accordance with the payment schedule established herein and in accordance with FAR 52.232-25. Prompt Payment, which states that the due date for making invoice payments shall be the 30th day after the designated billing office (see block 21 of the order) has received a proper invoice from the vendor or the 30th day after Government acceptance of the services provided by the vendor, whichever is later.

Schedule of Milestones for Performance-Based Payments In accordance with FAR 52.232-32, PERFORMANCE BASED PAYMENTS (April 2012), upon successful completion of an event, the contractor may request performance based payments. The determination of eligibility for receipt of payment will be made by the Contracting Officer upon written certification from the Contracting Officer’s Representative (COR) that the performance milestone has been met. It is anticipated that each milestone payment will approximate the estimated timeline listed below but variation is anticipated and eligibility for payment could occur sooner or later depending upon the time of completion of the designated milestone. Milestone payments are subject to the terms of FAR 52.232-32 incorporated in this contract.

The COR receiving and acceptance of monthly performance based payments is based on verification that work on the contract was satisfactorily performed during the month and that, at a minimum, the following activities were satisfactorily performed.

Base Period

Month 6: Provide list of facilities to CDC Approximately 15% of award

Option Period 1

Month 21 – analyze final primary and secondary outcome Approximately 10% of award

Month 21 – analyze and present final findings and outcomes Approximately 10% of award

Month 24 – Publish Approximately 20% of award

Performance of Work Requirements Summary

1. The purpose of this section is to:

A. List the contract requirements considered most critical to acceptable contract performance.

B. Show, where applicable, the maximum allowable degree of deviation from perfect performance for each requirement that shall be allowed by the Government before contract performance is considered unsatisfactory.

C. Define the procedure the Government shall use in reducing the Contractor's payment if satisfactory performance is not rendered.

2. The Government's quality assurance procedures are based on actual performance of the contract and all areas will be reviewed periodically, (e.g. weekly, quarterly).

3. The criteria for acceptable and unacceptable performance are as follows:

A. Contract requirements. The criteria for requirements are the level of performance deemed acceptable to the Government.

B. If the quality of work does not comply with the contract requirements the Contracting Officer Representative (COR) will initiate and the Contractor shall be required to complete a Contract Discrepancy Report (CDR).

C. The CDR will require the Contractor to explain in writing why performance was unacceptable, how performance will be returned to an acceptable level, and how recurrence of the problem will be prevented in the future. The Contractor will not be paid for services not rendered in accordance with the standards set forth in this contract.

D. If the level of performance is deemed unacceptable to the Government concurrent with two unsatisfactory ratings, monthly payment will be reduced for unsatisfactory performance by the percentage as shown in the chart below:

and Acceptability Quality Level

Disincentive

Method of performance assessment

Review progress reports.

Review written protocol.

Special Clearances:

7. Security Compliance:

The below information complies with HHSA Security compliance requirements for E-Government Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA 2014)

Security Compliance

The contractor must have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government. We provide the following information to assist in the preparation of documents necessary for the Security Assessment and Authorization (SA&A) of an Information System. The FISMA 2014, (Federal Information Security Modernization Act of 2014) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (https://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/drivers/documents/FISMA-final.pdf ) and the Federal Information Security Modernization Act of 2014 (P.L. 113-283) (FISMA 2014) (https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

· FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

· FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf),

· NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf),

· NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf),

· NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

· NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf),

· NIST Special Publication 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the FISMA 2014 and NIST Special Publication 800-18, 800-37 and will include selected mandatory controls required by NIST Special Publication 800-53, Volume I & II. The successful contractor in conjunction with the NCEZID Information System Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer (CISO). The successful completion of the SA&A documents will result in an award of an Authority To Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCEZID ISSO and confirmed by the CDC Certifying Authority as part of the SA&A process.

The successful contractor is responsible for providing pertinent security information to the NCEZID ISSO and Security Staff and assisting in completing the below CDC SA&A documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCEZID Security Staff. Completed documents will be sent by the NCEZID Security Staff to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

· Baseline System Information (BSI)

· Privacy Impact Assessment (PIA)

· System Security Plan (SSP)

· Business Continuity Plan (BCP)

· Risk Assessment Report (RAR)