ATTACHMENT_7-Domain_7_Sample_RFTOP.docx

ATTACHMENT 7 SAMPLE TASK ORDER 7

DOMAIN 7 RFTOP: 2016-7- Task Order 001 Preventing neonatal healthcare associated infections in low resource settings

ESTIMATED CEILING PRICE:

Base Period: |X| Over $200,000 but less than $350,000 Option Period 1: |X| Over $700,000 but less than $869,000

Proposed Period of Performance: Work shall begin from date of award of the order and shall continue for a period of 12 months for base period activities. The Option period 1 is proposed for 24 months, following the base period.

Page Suggestion: The Contractor shall limit the proposal for this task order to 10 pages single-spaced pages.

DESCRIPTION OF WORK

1. Background and Need Approximately 3.6 million neonatal deaths (occurring in the first 4 weeks of life) occur globally each year, almost all of which occur in low and middle income countries (LMIC). Although reductions in neonatal mortality have been observed in the past decades, reductions have been more modest than observed in other under age 5 groups. Infection is one of the three major causes of death in this group.

While some drivers of infectious deaths in neonates and accompanying prevention efforts are well understood (e.g. neonatal tetanus and maternal immunization), there are significant gaps in understanding the best methods to reduce neonatal deaths due to infection, especially within the healthcare setting. First, many neonatal intensive care units (NICUs) in LMIC do not have surveillance for or systematic data collection of neonatal healthcare associated infections (HAIs) or deaths. Second, although basic infection prevention and control (IPC) practices (e.g. handwashing, environmental cleaning) are often lacking in LMIC NICUs, infrastructure barriers and limited resources (e.g. patient crowding, lack of running water) require innovative solutions to reduce HAIs in NICus. Further, cost and staffing constraints limit the type and number of interventions that can sustainably be implemented in this setting. This project seeks to expand our understanding of how to prevent neonatal HAIs and deaths within NICUs in LMIC through development and evaluation of innovative strategies that balance efficacy, cost and burden to healthcare workers and staff.

2. Scope of Work The project is focused on determining cost-effective, innovative and sustainable interventions to prevent HAIs and improve neonatal survival in NICUs in low income settings in order to inform practices in LMIC NICUs globally.

The goals of this project are to:

1. Identify innovative interventions intended to reduce the incidence of HAIs in NICUs in low resource settings and define a suite of such interventions that will be implemented together as a bundle of HAI reduction interventions.

2. Conduct small pilot studies to assess the feasibility, acceptability and cost of individual interventions identified in order to define the suite of interventions that will be chosen

3. Evaluate the cost and effectiveness of the defined interventions in at least one NICUs, but preferably multiple NICUs, in a low resource country.

3. Tasks Base Period Tasks Goal: To identify relevant interventions, conduct pilot studies and develop a protocol for implementation of interventions, recruit facilities to participate and prepare/submit IRB applications.

Task 1: Start Up Meeting

· The Contractor shall arrange and conduct an initial meeting (by teleconference) with the Contracting Officer’s Representative (COR) and other relevant staff within 2 weeks of the effective date of the task order. The purpose of the meeting will be to discuss critical contract performance milestones, to delineate roles and responsibilities, and to establish communication protocols. Each task and deliverable will be reviewed.

· The Contractor shall submit an agenda for the above meeting within 1 week of the effective date of the task order.

Task 2: Maintain Communication with the COR/Science Officer

· The Contractor shall coordinate with the Contracting Officer’s Representative (COR). The Contractor shall maintain regular communications with the Science Project and CDC staff involved with the project. The chief means of communication will be via conference calls that will be scheduled every month throughout the project period required to complete the project, and in-person meeting. Additional calls will be scheduled as needed. The Contractor shall provide an agenda and meeting minutes for each call. All conference calls shall be scheduled and administered by the Contractor. The Contractor shall respond to all emails and telephone communications from the Science Officer within 2-3 working days.

· The contractor shall coordinate with the Contracting Officer’s Representative (COR) two in-person meetings to deliver presentations on the current project status to the Contracting Officer’s Representative (COR) and other relevant CDC staff. In person meetings may be at the Contractor’s site or at CDC’s Atlanta, GA location.

Task 3: Quarterly Progress Reports

· On the 10th day following the 3 months being reported, the contractor shall prepare and submit a quarterly progress report containing the current status of work and project spending. The report shall contain, at a minimum, the current progress on each of the requirements set forth below, problems encountered during the month, solutions implemented, planned activity for the upcoming month and any other information mutually agreed upon between the contractor and the Contracting Officer’s Representative (COR).

Task 4: Develop a Work Plan and Timeline

· The contractor shall develop a detailed plan and timeline for developing and implementing a study of interventions to reduce HAIs in low resource NICUs. The work plan shall specify the approach to developing a study protocol, recruiting facilities, implementing the activities outlined in the protocol, data collection and management, an analysis of the impact of the intervention, and report of findings. A timeline for the completion of these tasks including the identification of potential factors that may hasten or impede the accomplishment of stated objectives will be presented to CDC

Task 5: Identify Interventions for NICU HAI prevention

· The contractor shall identify, through literature review, innovative interventions to reduce the burden of HAIs in NICU populations in a low resource setting that could be tested via this proposal. Innovative solutions shall include new ways to approach traditional infection prevention and control practices (e.g. environmental cleaning) and interventions that fall outside traditional infection and control practices (e.g. ways to manage patient crowding or introducing trophic feedings). The contractor shall choose no less than 4, and most likely 6 or more for pilot testing.

· The contractor shall also identify the specific HAIs that will be included in the study as the outcome/s measured. Choosing the HAIs shall be based on expected effects of the chosen interventions, burden of the HAI in the NICU population (as demonstrated through previous studies/literature), and ease with which to measure the chosen HAIs. At minimum this shall include healthcare associated bacteremia (including central line associated bacteremia) but may include additional HAIs (e.g. ventilator associated pneumonia) as determined by the contractors.

Task 6: Recruit Facilities for Participation

· The Contractor shall be responsible for identifying, recruiting and maintaining sufficient NICUs in a low resource setting to reach sample sizes that are required to achieve definitive results and generalizability. Facilities participating will include an adequate number of neonatal patients with conditions or illnesses requiring NICU admission and stay, and be willing to abide by human subjects protections and study protocol requirements.

· The Contractor shall develop a plan for how and when implementation will occur within the participating facilities, including how they will obtain IRB approval and all approvals necessary both in country and in the United States.

Task 7: Develop a Protocol for Testing

· The contractor shall develop a protocol for testing the selected interventions and their effect on selected HAIs in the NICU setting. The contractor shall work with the Contracting Officer’s Representative (COR) on the development of the protocol that specifically lays out the study question, hypothesis, methodology, data sources, analytic strategy and related tasks.

· The contractor shall perform standard power calculations to determine study size needed to achieve statistical power to detect a difference due to the interventions implemented, with a primary outcome being incidence of chosen HAIs within chosen facilities. The protocol shall include a research plan that includes a baseline data collection period of 6 months and an intervention period of 12 months.

Task 8: Institutional Review Board (IRB)

· The Contractor will prepare and submit IRB, and oversee all aspects of package development and submission as required prior to collection of any data, including pilot data. The Contractor shall prepare the packages including all forms and attachments for Contracting Officer’s Representative (COR) approval as needed. The Contractor shall submit the IRB package to the relevant IRB(s) and shall ensure that all clinical sites involved in the study apply for and receive IRB approval. Copies of IRB approvals from the Contractor and all clinical sites shall be provided to the Contracting Officer’s Representative (COR).

Task 9: Pilot test select interventions

· The contractor shall conduct pilot testing on a minimum of four of the chosen interventions in order to assess the feasibility and acceptability of implementing the interventions. Based on results from the initial pilot testing and discussion with the Contracting Officer’s Representative (COR), additional interventions shall be pilot tested as needed to come up with data on which interventions shall be implemented in the chosen NICUs.

· The contractor shall use data from pilot testing to define a bundle of interventions to be tested in a larger protocol as to their impact on chosen HAIs in the selected NICUs. The contractor shall discuss the proposed bundle of interventions with the Contracting Officer’s Representative (COR) before a final decision is made on the interventions.

Option Period 1

Goal: to implement a suite of interventions in low resource NICU(s), analyze data and determine impact on select HAIs

Task 1: Maintain Communication with CDC staff

· The Contractor shall coordinate with the Contracting Officer’s Representative (COR). The Contractor shall maintain regular communications with the Science Officer and CDC staff involved with the project. The chief means of communication will be via conference calls that will be scheduled every month throughout the project period required to complete the project. Additional calls will be scheduled as needed. The Contractor shall provide an agenda and meeting minutes for each call. All conference calls shall be scheduled and administered by the Contractor. The Contractor shall respond to all emails and telephone communications from the Science Officer within 2-3 working days.

Task 2: Quarterly Progress Reports

· On the 10th day following the 3 months being reported, the contractor shall prepare and submit a quarterly progress report containing the current status of work and a invoice status report. The report shall contain, at a minimum, the current progress on each of the requirements set forth below, the status of invoices for the project, problems encountered during the month, solutions implemented, planned activity for the upcoming quarter by month and any other information mutually agreed upon between the contractor and the Contracting Officer’s Representative (COR).

Task 3: Develop a work plan and time line

· The contractor shall revise the detailed plan first outlined in the base period to present a timeline for implementing a pre/post study assessing the impact of a suite of interventions on select HAIs in a low resource NICU(s). A timeline for the completion of these tasks including the identification of potential factors that may hasten or impede the accomplishment of stated objectives will be presented to CDC.

· The work plan shall specify the approach to developing data collection and management, an analysis of the data collected (both baseline and intervention) and report of findings.

Task 4: Collect baseline data

· During this period the contractor shall perform an assessment of the current incidence of chosen HAIs in the study facilities as well as data on any baseline IPC practices as needed to measure the impact of the intervention during the intervention period.

· The contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site (may be 1 or more sites depending on the protocol and project plan).

· The contractor shall have primary responsibility for collecting and managing baseline data. Data elements, as defined in the protocol developed in the base period, and architecture shall be described and submitted for review by the Contracting Officer’s Representative (COR).

· The contractor shall collect baseline data for a period of 6 months in the participating facilities. Data collection shall be completed before the implementation of interventions and collection of data during the intervention period. The protocol shall have a clear plan for the collection of data elements which include:

· Measurement of HAI occurrences, at least but not limited to healthcare-associated bacteremia events, but may include other HAI events.

· Measurement of appropriate denominator data in order to calculate incidence

· Measurement of compliance with any relevant IPC practices needed to contextualize the later intervention period data (e.g. if one of the interventions is a novel method to improve hand hygiene compliance, data on hand hygiene compliance in the baseline period shall be collected)

Task 5: Collect Intervention Data

· Interventions must be implemented as planned in protocol.

· During this period the contractor shall perform an assessment of compliance with the interventions implemented as well as the incidence of chosen HAIs in the study facilities.

· If multiple sites are included, the contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site.

· The contractor shall have primary responsibility for collecting and managing baseline data. Data elements, as defined in the protocol developed in the base period, and architecture shall be described and submitted for review by the Contracting Officer’s Representative (COR).

· The contractor shall collect intervention data for a period of 12 months in the participating facilities. The protocol shall have a clear plan for the collection of data elements which include:

· Measurement of HAI occurrences, at least but not limited to central-line associated bacteremia events, but may include other HAI events.

· Measurement of appropriate denominator data in order to calculate incidence

· Measurement of compliance with interventions implemented to assure the uptake and compliance

Task 6: Data Management

· The Contractor shall have primary responsibility to collect and manage baseline and outcome data. Data elements, defined in the protocol and developed in the base period, and data architecture shall be defined, described and submitted for review by the Contracting Officer’s Representative (COR). In addition, the Contractor will have primary responsibility to validate data elements from the protocol on a selection of charts.

· The Contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site (may be 1 or more sites depending on the protocol and project plan).

Task 7: Data Analysis

· The Contractor shall prepare and submit to the Contracting Officer’s Representative (COR) analytical and summary reports throughout project to ensure that there are adequate numbers of events to detect the impact of the intervention. Potential issues and solutions to data collection and management shall be reported in a timely manner, no later than 2 weeks after onset.

· The contractor shall review the data to evaluate the effect of the interventions implemented on selected HAI rates in the selected NICU facilities. Additionally compliance with the interventions shall be reviewed to assess uptake of and compliance with the interventions.

· The contractor shall submit a draft of their analysis according to the description given in the protocol (as defined in the base period) for review by the Contracting Officer’s Representative (COR) and all analysis shall be approved prior to inclusion in the final report.

· Results of the final data analysis shall be included in the draft and Final Project Reports submitted to Contracting Officer’s Representative (COR).

Task 8: Final Report

· The Contractor shall present a draft report of the project to the Contracting Officer’s Representative (COR) for review. After receiving comments and recommendations on the draft report, the Contractor shall submit the final report, incorporating CDC’s comments and recommendations within 1 month of receiving CDC feedback. Both reports shall include with it all materials that were developed.

· Writing manuscripts for publication will be the shared responsibility of CDC team and contractor, and authorship will be granted based on scientific contribution in accordance with CDC authorship policy (http://www.cdc.gov/maso/Policy/Authorship.pdf).

Deliverables Summary Table: Base Period

Frequency Due Date

Base Period

In-country approvals 1 Final

1 Final 3 months after award

3 months after award

1 Final 4 months after award

5 months after award

IRB Packets

IRB approvals 6 months after award

8 months

Deliverable Summary Table for Option Period 1:

Frequency Due Date

Option Period 1

Data dictionary and Data architecture plan submitted and approved by Contracting Officer’s Representative (COR)

First report

Second report

Third report

Fourth report Completed 9 months after award

Completed 12 months after award

Completed 15 months after award

Completed 18 months after award

1 Final Analytical Report 19 months after award

20 months after award

Electronic and paper copy final report, along with data collection tools, relevant data dictionaries, and summary data.

1 Draft Project Report

1 Final Project Report 22 months after award

23 months after award

3. General Information

A. Place of Performance: The work to be performed under this task order will be performed at the Contractor’s facility and associated/ collaborating academic, healthcare or research facilities, which may be international, as required.

B. Type of Contract: The government will award a firm-fixed price task order for this requirement.

C. Contractor Travel: Contractor will be required to travel during the performance of this contract for data collection. Travel is anticipated in order to plan and implement the study in a low resource country as well as travel to meet with CDC. Travel shall be in accordance with the Federal Travel Regulation (FTR).

D. Data Rights: 52.227-14 Rights in Data-General, Alternate IV (Dec 2007). As prescribed in 27.409(b) (5), substitute the following paragraph (c)(1) for paragraph (c)(1) of the basic clause: (c) Copyright—(1) Data first produced in the performance of the contract. Except as otherwise specifically provided in this contract, the Contractor may assert copyright in any data first produced in the performance of this contract. When asserting copyright, the Contractor shall affix the applicable copyright notice of 17 U.S.C. 401 or 402, and an acknowledgment of Government sponsorship (including contract number), to the data when such data are delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. For data other than computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. For computer software, the Contractor grants to the Government and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public), by or on behalf of the Government.

E. Confidentiality of Information: Work on this project may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The user agency will identify and provide direction and guidance for safeguarding all information subject to the Privacy Act. Reports and case files containing individual personal information are confidential. The CDC is not authorized to release individual case reports, and access to individual case data is strictly controlled. The contractor personnel are required to work with case records as well as databases. It is a requirement that the data remain in a controlled access environment.

F. Section 508: Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services. Regardless of format, all Web content or communications materials produced for publication on or delivery via CDC Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors1) or consultants responsible for preparing or posting content intended for use on an CDC-funded or CDC-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material. Checklists for various file formats are available at http://www.hhs.gov/web/508/index.html.

The following Section 508 provisions apply to the content or communications material identified in this SOW or PWS: 36 CFR 1194.21 (for software and programmatic elements in websites), 36 CFR 1194.22 (for documents and websites), and 36 CFR 1194.24 (for video and multimedia content) References: HHS Policy for Section 508 Electronic and Information Technology (E&IT) (January 2005): http://www.hhs.gov/od/Final_Section_508_Policy.html HHS Section 508 Web site: http://508.hhs.gov/ HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm 1 Prime contractors may enter into subcontracts in the performance of a Federal contract, but the prime remains obligated to deliver what is called for under the contract.

4. Government Furnished Property, Equipment, and Services Not applicable

5. Payment Terms

Payment will be made quarterly and subject to receipt of deliverables in accordance with the payment schedule established herein and in accordance with FAR 52.232-25. Prompt Payment, which states that the due date for making invoice payments shall be the 30th day after the designated billing office (see block 21 of the order) has received a proper invoice from the vendor or the 30th day after Government acceptance of the services provided by the vendor, whichever is later.

Schedule of Milestones for Performance-Based Payments

In accordance with FAR 52.232-32, PERFORMANCE BASED PAYMENTS (April 2012), upon successful completion of an event, the contractor may request performance based payments. The determination of eligibility for receipt of payment will be made by the Contracting Officer upon written certification from the Contracting Officer’s Representative (COR) that the performance milestone has been met. It is anticipated that each milestone payment will approximate the estimated timeline listed below but variation is anticipated and eligibility for payment could occur sooner or later depending upon the time of completion of the designated milestone. Milestone payments are subject to the terms of FAR 52.232-32 incorporated in this contract.

The COR receiving and acceptance of monthly performance based payments is based on verification that work on the contract was satisfactorily performed during the month and that, at a minimum, the following activities were satisfactorily performed.

Performance Base Payment Schedule [POP: 12 months]

Provide work plan and timeline

Month 1 10% of award, to be divided into 12 equal installments

Status summary of project tasks, accomplishments, plans for next reporting period including status for the protocol

Development of draft protocol

Final protocol (pending IRB approval) End of Month 4

End of Month 5

15% of award

Pilot test data and list of final interventions

End of Month 11

20% of award

Performance Option Period 1 Payment Schedule [POP: 24 months]

15% of award, to be divided into 24 equal installments

Status summary of project tasks, accomplishments, plans for next reporting period including status for the protocol

Development of data dictionary and data architecture plan

End of Month 7

20% of award

Summary reports for each site during the intervention

First Report Second Report Third Report Fourth Report

End of Month 9 End of Month 12 End of Month 15 End of Month 18 15% of award

Data management plan

End of Month 9 15% of award

Analytic report with summary data

Draft I Draft II

End of Month 19 End of Month 20

15% of award

Electronic Report

Electronic and paper copy final report, along with data collection tools, relevant data dictionaries, and summary data End of Month 22

End of Month 23 10% of award

Performance of Work Requirements Summary

1. The purpose of this section is to:

A. List the contract requirements considered most critical to acceptable contract performance.

B. Show, where applicable, the maximum allowable degree of deviation from perfect performance for each requirement that shall be allowed by the Government before contract performance is considered unsatisfactory.

C. Define the procedure the Government shall use in reducing the Contractor's payment if satisfactory performance is not rendered.

2. The Government's quality assurance procedures are based on actual performance of the contract and all areas will be reviewed periodically, (e.g. weekly, quarterly).

3. The criteria for acceptable and unacceptable performance are as follows:

A. Contract requirements. The criteria for requirements are the level of performance deemed acceptable to the Government.

B. If the quality of work does not comply with the contract requirements the Contracting Officer Representative (COR) will initiate and the Contractor shall be required to complete a Contract Discrepancy Report (CDR).

C. The CDR will require the Contractor to explain in writing why performance was unacceptable, how performance will be returned to an acceptable level, and how recurrence of the problem will be prevented in the future. The Contractor will not be paid for services not rendered in accordance with the standards set forth in this contract.

D. If the level of performance is deemed unacceptable to the Government concurrent with two unsatisfactory ratings, monthly payment will be reduced for unsatisfactory performance by the percentage as shown in the chart below:

BASE PERIOD

and Acceptability Quality Level

Disincentive

Method of Performance Assessment

Review submitted reports.

Review progress reports and submitted documents.

Protocol must be sound, complete and delivered to CDC Science Officer in 9 months

Review progress reports and submitted documents.

Review progress reports and submitted documents.

Review progress reports and submitted documents.

OPTION PERIOD 1

and Acceptability Quality Level

Disincentive

Method of Performance Assessment

Review submitted reports.

Review progress reports and submitted documents.

Review progress reports and submitted documents.

6. Special Clearances:

|_| OMB

HHSAR 352.270-4b Protection of Human Subjects (December 18, 2015)

(a) The Contractor agrees that the rights and welfare of human subjects involved in research under this contract shall be protected in accordance with 45 CFR part 46 and with the Contractor’s current Federal-wide Assurance (FWA) on file with the Office for Human Research Protections (OHRP), Department of Health and Human Services. The Contractor further agrees to provide certification at least annually that the Institutional Review Board has reviewed and approved the procedures, which involve human subjects in accordance with 45 CFR part 46 and the Assurance of Compliance.

(b) The Contractor shall bear full responsibility for the performance of all work and services involving the use of human subjects under this contract and shall ensure that work is conducted in a proper manner and as safely as is feasible. The parties hereto agree that the Contractor retains the right to control and direct the performance of all work under this contract. Nothing in this contract shall create an agency or employee relationship between the Government and the Contractor, or any subcontractor, agent or employee of the Contractor, or any other person, organization, institution, or group of any kind whatsoever. The Contractor agrees that it has entered into this contract and will discharge its obligations, duties, and undertakings and the work pursuant thereto, whether requiring professional judgment or otherwise, as an independent Contractor without creating liability on the part of the Government for the acts of the Contractor or its employees.

(c) Contractors involving other agencies or institutions in activities considered to be engaged in research involving human subjects must ensure that such other agencies or institutions obtain their own FWA if they are routinely engaged in research involving human subjects or ensure that such agencies or institutions are covered by the Contractors’ FWA via designation as agents of the institution or via individual investigator agreements (see OHRP website at: http://www.hhs.gov/ohrp/policy/guidanceonalternativetofwa.pdf).

(d) If at any time during the performance of this contract the Contractor is not in compliance with any of the requirements and or standards stated in paragraphs (a) and (b) above, the Contracting Officer may immediately suspend, in whole or in part, work and further payments under this contract until the Contractor corrects the noncompliance. The Contracting Officer may communicate the notice of suspension by telephone with confirmation in writing. If the Contractor fails to complete corrective action within the period of time designated in the Contracting Officer’s written notice of suspension, the Contracting Officer may, after consultation with OHRP, terminate this contract in whole or in part.

(End of clause)

HHSAR 352.270-12 Needle Exchange (December 18, 2015) The Contractor shall not use any funds obligated under this contract to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

(End of Clause)

The below information complies with HHSA Security compliance requirements for E-Government Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA 2014) Security Compliance If the contractor will host or create an information system on behalf of the CDC, provide IT services to the CDC, or provide IT products to the CDC, then the contractor must comply with the applicable IT security references below. We provide the following information to assist in the preparation of documents necessary for the Security Assessment and Authorization (SA&A) of an Information System. The FISMA 2014, (Federal Information Security Modernization Act of 2014) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (https://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123 The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/drivers/documents/FISMA-final.pdf ) and the Federal Information Security Modernization Act of 2014 (P.L. 113-283) (FISMA 2014) (https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

1. FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

1. FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf),

1. NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf),

1. NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf),

1. NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

1. NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf),

1. NIST Special Publication 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the FISMA 2014 and NIST Special Publication 800-18, 800-37 and will include selected mandatory controls required by NIST Special Publication 800-53, Volume I & II. The successful contractor in conjunction with the NCEZID Information System Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer (CISO). The successful completion of the SA&A documents will result in an award of an Authority To Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCEZID ISSO and confirmed by the CDC Certifying Authority as part of the SA&A process.

The successful contractor is responsible for providing pertinent security information to the NCEZID ISSO and Security Staff and assisting in completing the below CDC SA&A documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCEZID Security Staff. Completed documents will be sent by the NCEZID Security Staff to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

1. Baseline System Information (BSI)

1. Privacy Impact Assessment (PIA)

1. System Security Plan (SSP)

1. Business Continuity Plan (BCP)

1. Risk Assessment Report (RAR)

The Contractor shall respond to the following seven security–associated requirements in the application:

(1) Position Sensitivity Designations CDC requires a Public Trust Level 5 for the following The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-contractor staff) working under the contract that will have the ability to access NCEZID sensitive information from the system. .

Non-Disclosure Agreements The Contractor and any sub-Contractors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1. Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

1. Personnel without necessary background investigations will not have access to sensitive project data.

1. Violation of these conditions may lead to termination of the contract.

It is the Contractor's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact Assessment (PIA) as defined by Section 208 of the FISMA 2014. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and contractor, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Contractor’s Official Responsible for Information Security The contractor shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the contractor be selected for an award.

(4) Rules of Behavior The contractor’s employees and subcontractors shall comply with the HHS Information Technology General Rules of Behavior.

(5) Information Security Training HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful contractor shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Contractor's expense and would be the Contractor's responsibility to plan and arrange.

The successful contractor shall maintain a listing of all individuals who have completed this training and shall submit this listing to the Science Officer.

(6) HSPD-12 Compliance Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all vendors providing hardware and software to the federal government are now required to ensure that these PIV cards will integrate with their software and hardware at the application level. Contractor must be able to implement and support PIV card integration.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices,…