2016-N-17941.pdf

PAGES

15A. NAME

AND

ADDRESS

OF

OFFEROR

SEC. PAGE(S) SEC. PAGE(S)

(Date) (Hour)

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amend-ments to the SOLICITATION for offerors and related documents numbered and dated:

(Type or Print)

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

1 65

2. CONTRACT NO.

3. SOLICITATION NO.

2016-N-17941

4. TYPE OF SOLICITATION

SEALED BID (IFB)

X NEGOTIATED (RFP)

5. DATE ISSUED

09/16/2016

6. REQUISITION/PURCHASE

NO.

00HCUBBB-2017-98605

7. ISSUED BY CODE 8219 8. ADDRESS OFFER TO (If other than Item 7)

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2920 Brandywine Road

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in 2920 Brandywine Road, Cologate Bldg. Atlanta, GA 30341 until2:00pm EST local time 10/17/2016

CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Liubov Kriel

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2856

C. E-MAIL ADDRESS

vyh1@cdc.gov.

11. TABLE OF CONTENTS

(x) DESCRIPTION (x) DESCRIPTION

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 31

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 5 X J LIST OF ATTACHMENTS 38

X D PACKAGING AND MARKING 16 PART IV – REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 18 REPRESENTATIONS, CERTIFICATIONS, AND

X F DELIVERIES OR PERFORMANCE 19 X K OTHER STATEMENTS OF OFFERORS 39

X G CONTRACT ADMINISTRATION DATA 20 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 44

X H SPECIAL CONTRACT REQUIREMENTS 24 X M EVALUATION FACTORS FOR AWARD 49

OFFER (Must be fully completed by offeror) NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

AMENDMENT NO. DATE AMENDMENT NO. DATE

CODE FACILITY 16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 8219 25. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2920 Brandywine Road

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE Prescribed by GSA

FAR (48 CFR) 53.214©

K

Section B - Supplies Or Services And Prices/Costs

Base Year Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Bio-Repository and Inventory Management

• T&M/LH CLIN

• CLIN 0001 is a Severable Line Item

Performance Period: 12/29/2016* – 12/28/2017

1 Job $_________ $_________ (NTE)

* Anticipated start date is 12/29/2016 if a transition period is needed; if no transition period is needed the anticipated start date will be 3/29/2017.

Total Base Year Value: $________(NTE)

Option Year 1 Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

1001 Bio-Repository and Inventory Management Op 1

• T&M/LH CLIN

• CLIN 1001 is a Severable Line Item

Performance Period: 12/29/2017 – 12/28/2018

Total Option Year 1 Value: $________(NTE)

Option Year 2 Items:

2001 Bio-Repository and Inventory Management Op 2

• T&M/LH CLIN

• CLIN 2001 is a Severable Line Item Performance Period: 12/29/2018 – 12/28/2019

Total Option Year 2 Value: $________(NTE)

Option Year 3 Items:

3001 Bio-Repository and Inventory Management Op 3

• T&M/LH CLIN

• CLIN 3001 is a Severable Line Item Performance Period: 12/29/2019 – 12/28/2020

1 Job $_________ $_________(NTE)

Total Option Year 3 Value: $________(NTE)

Option Year 4 Items:

4001 Bio-Repository and Inventory Management Op 4

• T&M/LH CLIN

• CLIN 4001 is a Severable Line Item Performance Period: 12/29/2020 – 12/28/2021

1 Job $_________ $_________(NTE)

Total Option Year 4 Value: $________(NTE)

Optional Line Item:

4002 Specimens Transfer to a new location.

• Firm-Fixed Price CLIN

• CLIN 4002 is a Non-severable Line Item

Performance Period: 09/29/2020 – 12/28/2021

1 Job $_________ $_________

Total Optional Line Item 4002 Value: $___________

CONTRACT TOTAL

(Base Year, 4 Options & 1 Optional Line Item): $__________(NTE)

This is a Time-and-materials/ Labor-hour solicitation.

Estimated hours & hourly rates are as follows:

Base Period Items: Performance Period: 12/29/2016 – 12/28/2017

TITLE* ESTIMATED HOURS* HOURLY RATE

* The proposal should be priced by CLIN and should contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Option Period 1 Items: Performance Period: 12/29/2017 – 12/28/2018

* The proposal should be priced by CLIN and should contain vendor’s proposed labor categories, labor hours by

Option Period 2 Items: Performance Period: 12/29/2018 – 12/28/2019

* The proposal should be priced by CLIN and should contain vendor’s proposed labor categories, labor hours by

Option Period 3 Items: Performance Period: 12/29/2019 – 12/28/2020

* The proposal should be priced by CLIN and should contain vendor’s proposed labor categories, labor hours by

Option Period 4 Items: Performance Period: 12/29/2020 – 12/28/2021

* The proposal should be priced by CLIN and should contain vendor’s proposed labor categories, labor hours by

Section C - Description/Specification/Work Statement

PERFORMANCE WORK STATEMENT

TITLE: Biologic Specimen Repository and Inventory Management for the National Center on Birth

Defects and Developmental Disabilities (NCBDDD) Projects

1. Overview/Background:

Overview The National Center on Birth Defects and Developmental Disabilities (NCBDDD) has a requirement for immediate and on-going storage and inventory management of biologic specimens collected under several projects including the National Birth Defects Prevention Study (NBDPS), and the Division of Blood Disorders’ projects for the reduction and prevention of complications due to blood disorders.

Background:

It is estimated that about three percent of babies in the United States (or about 120,000 babies each year) are born with a birth defect. More than 5,000 of these babies die in their first year of life – making birth defects a leading cause of infant mortality in the United States. Birth defects are also a major cause of infant morbidity and a leading cause of potential years of life lost. Many birth defects result in life-long disabilities. A primary mission of the Division of Congenital and Developmental Disorders (DCDD) is to decrease the morbidity and mortality associated with birth defects, stillbirth, and other infant and childhood diseases. A mission of the Division of Blood Disorders is to reduce and prevent the complications of bleeding disorders and blood-borne infections, complications of the use of blood products such as inhibitor development, and conduct surveillance for blood borne pathogens and other conditions of concern to persons with non-malignant blood disorders through routine collection and testing of serum or plasma specimens.

The National Birth Defects Prevention Study (NBDPS) The NBDPS is a population-based, multi-site, case-control study of genetic and environmental risk factors for major birth defects. Data on exposures during pregnancy were collected using a computer-assisted telephone interview at each of the study sites. Data from ten study sites were included. Buccal cells were self-collected from parents and the index child using cytobrushes mailed to each family. DNA was extracted from the buccal cells, human-specific DNA was quantified, and quality was assessed at the NBDPS Central Laboratory. As of August 2016, the NBDPS has collected DNA specimens from approximately 69,500 mothers, fathers, and infants since 1998. DNA specimens were subaliquotted into 2.0ml and 0.5ml cryovials at the NBDPS Central Lab and submitted to the NBDPS Biorepository for storage at -80°C or in the vapor phase of liquid nitrogen. Each aliquot contains a bar-coded label with its 9-digit numeric study ID, 8-digit numeric specimen ID, and an 8-digit alpha-numeric CDC unique ID. As of August 2016, the NBDPS has approximately 552,000 vials in storage.

Investigators with research projects that have been approved by the NBDPS Data Sharing Committee make requests for aliquots of DNA specimens from the NBDPS Biorepository through the collection custodian. Specimens extracted before May 1, 2008 were subaliquotted and the specimen aliquots are available for shipment to investigators. Specimens extracted in the NBDPS Central Laboratory on or after May 1, 2008 are subaliquotted “on demand”. Two aliquots per specimen were initially submitted to the NBDPS Biorepository until an investigator requests an aliquot of the specimen. At that time, the collection custodian will request that one of the two specimen aliquots be shipped to the NBDPS Central Laboratory on dry ice where it will be subaliquotted into five 0.5ml cryovials and returned to the Biorepository. At that time, the specimen aliquots will be available for retrieval.

Aliquots of DNA specimens are retrieved from the NBDPS collection and are shipped overnight on dry ice to the requesting investigator. Several DNA collections are maintained for the NBDPS including the main NBDPS collection of specimens available to study investigators as well as NBDPS inconsistent, failed, quality control (QC), and New Jersey local collections that are not available to study investigators. Records of NBDPS shipped and destroyed specimen aliquots are also maintained in the biorepository inventory management system. The NBDPS will continue to request specimens for approved projects.

There is potential for collection of DNA specimens from sources other than cytobrushes in the future. Some possibilities include saliva collection and use of residual newborn blood spots. Storage procedure modifications are not expected for DNA collected from saliva. However, modifications to storage for newborn blood spot cards include stacking cards between glassene papers and storing them in low-gas permeable bags that include a desiccant pack and a humidity indicator card with a spot for 30% humidity that indicates when the desiccant pack needs to be replaced. The bags would be stored either in a -20°C or -80°C freezer.

Prior to the NBDPS, specimens were collected from participants of the Birth Defects Risk Factor Study (BDRFS).

The biorepository currently stores 4,057 BDRFS specimens in the vapor phase of LN2.

Division of Blood Disorders (DBD) In the 1990s in the wake of the epidemic of HIV infection among persons who received contaminated blood products, the Division of Blood Disorders received a mandate from Congress to reduce and prevent the complications of bleeding disorders. Initially targeted towards hemophilia, DBD programs later expanded to include thalassemia, women with bleeding disorders, Diamond Blackfan Anemia, iron overload and sickle cell disease. Among the complications addressed by these programs are those of blood-borne infections and other complications of the use of blood products such as inhibitor development. The DBD conducts surveillance for blood borne pathogens and other conditions of concern to persons with non-malignant blood disorders through routine collection and testing of serum or plasma specimens for HIV and viral hepatitis from patients attending blood disorders clinics across the United States and its territories. A portion of each specimen is retained for possible future testing as new transmissible threats to the blood supply are discovered. Projects previously conducted include the Universal Data Collection (UDC) which collected specimens on persons with clotting factor deficiencies, and the National Data Collection (NDC) which collected specimens on persons with thalassemia. Currently the Community Counts! project, successor to UDC, collects serum and plasma from persons with bleeding disorders.

Both the conditions being tested for as well as the populations monitored are expected to be expanded in the future;

this may necessitate the collection of other specimens which may require storage conditions different from those of the currently collected specimens.

At this time, Community Counts! collects 5-10mL of blood from each participant at roughly annual intervals. The participating clinics centrifuge the blood to obtain serum or plasma and ship the specimens to the CDC serum bank in Atlanta, GA. The serum bank aliquots the specimens by 0.5mL and distributes a routine number of aliquots to the DBD labs for routine testing; the remainder is stored for future use at -20C or -80C. Aliquots are distributed from the serum bank to the DBD labs or elsewhere at the request of the CDC Principal Investigator or other authorized CDC personnel. Each aliquot bears a bar coded label with a unique 10-digit specimen number assigned by the serum bank. Currently, there are 154,320 aliquots in long-term storage at the CDC contract storage facility in Rockville, MD with approximately 275,466 in short-term storage at the CDC serum bank. Approximately 5,000 specimens are expected to be received annually, contributing about 15,000 aliquots per year. These additional 5,000 specimens/15,000 aliquots received annually are not anticipated to be stored under this contract during the period of performance. The Community Counts! project is expected to continue for the foreseeable future.

II. Objective:

The overall NCBDDD objective is to reduce the morbidity and mortality of birth defects and blood disorders. We require ongoing contractor support services to help accomplish this objective. The objective of this contract is to (1) transfer and store existing biologic specimens to contractor’s facilities, (2) ship selected specimens to a CDC laboratory for subaliquotting and receive and store newly subaliquotted specimens from CDC, (3) ship selected specimens to collaborators for data analysis, (4) routinely perform activities such as vial re-labeling, aliquot destruction, or inventory audits, and (5) maintain an accurate inventory system of all biologic specimens.

III. Transition of Services:

Currently, the specimens are stored in a contractor maintained facility for CDC in Rockville, Maryland. The continuity of the services without interruption or harm to the specimens is critical to the success of the program.

Therefore, the contractor shall be required to provide and execute an approved transition plan that will provide a smooth transition (in the beginning of the contract and at the end of 5 years of the contract) to ensure continuous service and storage of biologic specimens.

IV. Scope of Work:

To provide NCBDDD with state-of-the-art specimen storage that includes sufficient storage capacity for future growth and a high quality inventory management system that allows timely entry and retrieval of specimens and maintains accurate historical records.

The contractor shall review and analyze existing protocols, utilize existing database ID numbers and variables, OMB clearance materials, IRB and Confidentiality requirements and secure any additional IRB, OMB or other approvals necessary to continue work under the project.

Minimum requirements:

A. Facility and equipment

1. -80°C freezers and liquid nitrogen (LN2) containers for specimen aliquots in 0.5 and 2.0ml cryovials. As of August 2016, 173,625 specimen aliquots are in cryovials that cannot be stored in LN2 and shall be stored in -80°C freezers. The remainder and all new specimens received can be stored in the vapor phase of LN2.

2. Current space:

a. Current number of specimen aliquots as of August 2016 is 706,152 comprised of approximately 551,832 for NBDPS/BDRFS and 154,320 for DBD.

b. Ability to obtain -80°C freezers, facility space, and labor to receive and store the additional aliquots received annually. An example of additional storage is that the NCBDDD has 275,466 aliquots in the DBD serum bank which may need storage in an Option Year 2 and this quantity is not included in the Attachment 1 quantities. The contractor shall provide sufficient space to store this quantity of additional aliquots.

c. Estimated number of specimen aliquots received from the NBDPS Central Lab per year: 6,000 – 14,000 specimens returned after subaliquotting “on demand”. Please see Attachment 1 with the estimated quantities.

d. Estimated number of specimen aliquots retrieved and shipped to study sites, CDC, and NIH per year:

20,000. Please see Attachment 1 with the estimated quantities.

3. Handheld scanner and printer for bar-coded labels; software to generate barcodes with the same format and variables that are currently included on labels (8-digit barcoded alphanumeric ID, 9-digit human readable numeric ID, 8-digit human readable numeric ID with additional human readable alphanumeric notations that vary by label); dry ice, freezer boxes, and racks for specimen aliquot receipt, storage, retrieval, and shipment.

4. Facility that meets the minimum size and ventilation requirements for heat production of the equipment.

5. Facility that has smoke detectors, fire suppression systems, and access control.

6. A minimum of 1 empty backup -80C freezer and 1 empty backup LN2 freezer maintained at temperature in the event of power or equipment failure.

7. A Standard Operating Procedure (SOP) for transfer of specimens to alternative freezer space in the event of a widespread power or equipment failure.

8. A minimum of 1 empty freezer maintained at temperature as temporary storage to accommodate large specimen shipments received at short notice.

9. Emergency back-up diesel and/or gas generators.

10. 24/7/365 alarm monitoring with on-call manpower for after hour alarms.

11. 24/7/365 security to limit access to and record access by authorized users.

12. Equipment validated prior to use and monitored 24/7/365.

13. Calibrated freezers to ensure operation within controlled parameters.

14. Annual or biannual maintenance on equipment to keep it operating in accordance with the manufacturer’s recommendations.

15. Tracking of all equipment-related information such as location and relocation, validation and calibration, preventive maintenance and repair, specimen integrity, freeze/thaw events, and storage temperatures.

16. Designated equipment manager to oversee specimen storage and personnel trained in equipment SOP compliance.

17. Experience with long-term storage of large specimen collections.

B. Inventory management

1. Experience with inventory management of large specimen collections.

2. Designated inventory manager to oversee specimen management, inventory, transfers, and personnel trained in specimen SOP compliance.

3. Off-site redundant hard-drive data storage and hard copies archived in fire-retardant storage.

4. Tracking of all specimen movements.

5. Specimen receipt, storage, retrieval, destruction, and shipment as indicated in Tasks to be Performed section.

V. Government Furnished Items:

CDC will provide the following items needed for off-site delivery of services.

1. Access to the various NBDPS and DBD databases, data replication, CDC Secure Access Management Service, CDC specific software, and other NBDPS and DBD project specific documents and tools necessary to accomplish contract requirements;

2. Item list or examples of freezer labels, SATO printer, cytobrushes, and other lab supplies in order for the contractor to purchase for their use.

VI. Place of Performance:

The required tasks shall be performed at the contractor’s facilities.

VII. Tasks to be Performed:

Listed below are descriptions of the tasks to be performed. The NBDPS and DBD projects are established studies and do not experience significant fluctuations in support duties being performed.

Specimen transfer at start-up:

1. Coordinate with current contractor and transfer all specimen aliquots from current Rockville, MD location to contractor location in -80C or LN2 vapor phase temperature storage. Capture of existing data fields in all current NBDPS and DBD collections into contractor’s inventory management system with 100% cross checking of vial labels with manifest. Set up a secure data transfer system between CDC and contractor (e.g., sFTP).

2. Provide detailed transfer summary after each specimen shipment that includes temperature monitoring and specimen receipt report.

Specimen receipt:

3. Import data from manifests into contractor specimen inventory management system and track location from which specimens were received, receipt date, carrier, and condition upon receipt.

4. 100% scan cross check of vial labels with manifest and with freezer location in inventory management system.

5. Storage of aliquots from one specimen in a minimum of two freezer units. There are 60,496 specimens with at least 2 aliquots needing separate storage.

6. Maintenance of specimens at temperature during receipt process.

7. Notify CDC Project Officer and Contracting Officer Representative within 24 hours of discovering any problems or issues and include proposed resolution.

8. Time between specimen receipt and inventory entry not to exceed one week with a specimen receipt report and discrepancy report (if needed) provided to CDC via a secure data transfer system. Following resolution of each discrepancy, a final specimen receipt report provided to CDC within one week of resolving the discrepancy.

Specimen retrieval:

9. Import data for specimen retrieval from Excel spreadsheets into inventory management system to identify specimen locations. Ability to retrieve a minimum of 2,000 specimens in one week if retrieval order is not specified. If retrieval order is specified, ability to retrieve a minimum of 1,000 specimens in one week.

10. Maintenance of specimens at temperature during retrieval process.

11. Accurate retrieval process (100% validation of requested specimens).

12. Notify CDC Project Officer and Contracting Officer Representative within 24 hours of discovering any problems or issues and include proposed resolution.

Shipment of specimens:

13. Maintain shipment history including shipment date, location shipped to, and carrier.

14. Maintain compliance with Department of Transportation regulations.

15. Ship in cryogenic shipping containers with dry ice sufficient for 72 hours.

16. Provide electronic shipment notifications with the carrier tracking numbers the day of the shipment.

17. Provide hard copies and electronic copies of shipping manifests that include for each aliquot: collection name, study site, study ID, specimen ID, CDC unique ID, family member, aliquot number, aliquot type, and vial type. Electronic shipping manifests shall be posted to the secure data transfer site the day of the shipment.

18. Ship specimens via priority overnight.

On request:

19. Destroy specimens by incineration within 2 weeks of receiving specimen list on Excel spreadsheet from CDC. We estimate a maximum of 2-3 requests for destruction per year involving less than 5,000 specimens per year total. Maintain records of specimen aliquots destroyed and provide certificate of destruction within 24 hours of sample incineration.

20. Create or modify specimen inventory fields or tables (e.g., renaming a field from ‘available’ to ‘in inventory’ or separating into different tables records of specimens currently in the inventory from specimens that have been removed from the inventory).

21. Re-label specimens using cryogenic labels appropriate for freezer storage temperatures and data variables currently on labels. Current labels include: 8-digit barcoded alphanumeric ID, 9-digit human readable numeric ID, 8-digit human readable numeric ID with additional human readable alphanumberic notations that vary by label.

22. Complete physical specimen and data record audits.

VIII. Expertise:

In general, contract personnel shall have:

A combination of education and/or 5 years of experience in the fields of biologic specimen storage or laboratory management. Key personnel would be the Task/Project Manager who oversees the scientific and technical activities of the contract. Education requirements for the key personnel include that they shall have a minimum Bachelor degree or background in laboratory management, bioinformatics, database administration, or related field.

More specifically:

A. For all work involving access to confidential information, requirements include:

1. Experience in maintaining privacy and confidentiality of data.

2. Adhering to all federal standards of privacy as described in the NBDPS and/or DBD projects

Certificate(s) of Confidentiality, and CDC and contractor IRB approval.

IX. Deliverables and Reporting Requirements:

The contractor shall furnish to the Contracting Officer Representative (COR) and client representative(s), a monthly progress report with narrative report by the 20th of each month via email in MS Word format.

Reports must be generated from the first calendar day of each month to the last calendar day of each month. (e.g., January 1-31, etc.).

The monthly narrative report shall contain the following:

• Brief summary of accomplishments during the reporting period and significant events.

• Deliverables submitted or progress on deliverable.

• Any current or anticipated problems and possible solutions.

• Number of specimens shipped and received each month.

Deliverables:

1. Each month, provide a month end snapshot of specimen inventory by location by NCBDDD project, and access to real-time web-based inventory. Monthly snapshot should include total number of specimen aliquots stored and for each aliquot: collection name, study site, study ID, specimen ID, CDC unique ID, family member, aliquot number, aliquot type, date received, quantity, unit of measure, vial type, location (e.g., rack, box, row), and availability for requests. Records for main NBDPS collection specimens that are available to study investigators should be maintained separately from other collections (inconsistent, failed, QC, New Jersey local, shipped, and destroyed). Records for shipped specimen aliquots should include additional fields for destination, created date, and shipped date. Records for destroyed specimen aliquots should include date destroyed and reason.

2. Each month, provide a month end report of specimen aliquots received and specimen aliquots shipped that includes overall counts by shipment, dates of shipments made or received, and problems or comments.

3. Each quarter, provide a quarter end equipment report that includes current location, validation and calibration dates, preventive maintenance and repairs, temperature fluctuations, freeze/thaw events, and overall conditions of each piece of equipment.

Description Date of Delivery

Location of Delivery Format

Monthly Progress Reports By the 20th of each month

Email to COR

MS Word format

Monthly snapshot of available and shipped specimen inventory by NCBDDD project

Monthly Real time access or via sFTP with e-mail notification to

COR

Access to contractor’s inventory system or transfer via secure file (csv or other text format)

Summary of specimens shipped and location, received, etc.

Monthly Email to COR if no IDs are included; via sFTP if IDs are included

Microsoft Excel format

List of current freezers, location, recorded temperatures, etc.

Quarterly Email to COR

Microsoft Excel format

X. Administrative Requirements:

Post award meetings: CDC personnel will visit the contractor’s storage facility a minimum of once per year to meet with contractor laboratory personnel and inspect the facilities.

Data disposition: The specimen inventory report and monthly reports shall be maintained by the contractor and retained for a period of one year after the end of the contract. After this time, the contractor should destroy the inventory report and monthly reports and other documents by shredding and incineration. The contractor is not permitted to disclose the contents of the inventory and monthly reports to outside entities without prior written approval from the COR.

XI. Period of Performance:

The period of performance shall consist of a 12-month base period and four (4) twelve (12) month optional years as shown below:

Base Year: 12/29/2016* – 12/28/2017 Option Year 1: 12/29/2017 – 12/28/2018 Option Year 2: 12/29/2018 – 12/28/2019 Option Year 3: 12/29/2019 – 12/28/2020 Option Year 4: 12/29/2020 – 12/28/2021

* Anticipated start date is 12/29/2016 if a transition period is needed; if no transition period is needed the anticipated start date will be 3/29/2017.

XII. Special Clearances:

1. Design of any data collection or evaluation measurement tools or activities should take into account the requirements for exemptions to OMB public survey clearance procedures as specified under PHS Generic

Approval to Conduct Customer Satisfaction Surveys under EO 12862. For any methods requiring OMB or IRB clearance, the contractor shall prepare the appropriate packages for clearance.

2. Data produced hereunder shall become and remain the property of CDC. No release or publication of information under this contract will be authorized without prior written consent of the CDC Contracting Officer.

3. Information Technology Security The Contractor’s performance and resulting deliverables must adhere to all federal, HHS, and/or CDC IT security policies and procedures. Based upon the scope of this contract, adherence to the following IT Security guidance is required whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term “information technology (IT)”, as used in this contract, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), cloud environments, and related resources. This clause does not apply to national security systems as defined in FISMA.

The Contractor is responsible for the following: (1) Protecting Federal information and Federal information systems in order to ensure their—(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; (ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (iii) Availability, which means ensuring timely and reliable access to and use of information.(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS. (3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

All development or implementation of an electronic information system or any electronic data collection effort conducted in the performance of this contract will be required to complete Certification and Accreditation (C&A)/Security Assessment and Authorization (SA&A) prior to operation resulting in an Authority of Operate (ATO) from CDC. The contractor shall be required to complete all security documentation and materials necessary to obtain an ATO. The contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other federal policies and regulations in the performance of the security requirements.

All information systems developed, implemented, or maintained in support of this contract must adhere to the security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) and NIST 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations.

The Contractor must follow the latest guidance available from NIST and other recognized sources, including but not limited to:

• FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf),

• FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

• NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf),

• NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

• NIST publication SP 800-44 Guidelines on Securing Public Web Servers, (http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf)

• NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf),

• NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1- Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf),

• NIST Special Publication 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

• NIST publication SP 800-95 Guide to Secure Web Services, (http://csrc.nist.gov/publications/nistpubs/800- 95/SP800-95.pdf) when applicable.

• Web Application Security Consortium (http://www.webappsec.org)

• Open Web Application Security Project (OWASP) (http://www.owasp.org).

The contractor must follow CDC development standards and use the CDC web template package. All CDC websites, campaign sites, and applications must use the standard CDC web template to ensure a consistent look and feel for CDC websites. The template will be provided as needed. The CDC Secure Web Application Coding Guidelines and CDC Template Package (http://intranet.cdc.gov/ocio/docs/information-systems-security/CDC_Secure_Web_App_Coding_Guidelines.pdf) can be provided by the CDC Project Officer or the Center’s ISSO.

All web content must reside on a CDC.gov domain and must be hosted at CDC or in a CDC-authorized environment. The contractor may not establish a .com, .org, or other type of site to host CDC funded content or web applications.

During any application development or enhancement, the contractor shall work closely with the NCCDPHP Office of Informatics and Information Resources (OIIRM) to ensure all CDC-related technical and security standards, processes and procedures are followed. This working relationship shall continue through full production.

If use of a cloud environment is needed, the provider must be FedRAMP certified. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The cloud environment must also have an Authority to Operate from HHS.

All publicly accessible Federal websites and web services must provide service over a secure connection. The strongest privacy protection currently available for public web connections is Hypertext Transfer Protocol Secure

(HTTPS).

Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

Standard for Encryption Language

• The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS information during storage and transmission.

• The Contractor shall verify that the selected encryption product has been validated under the Cryptographic

Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). If requested, the Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

• The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

• The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

• The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process HHS information.

• The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with these requirements.

HSPD-12 Compliance As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all vendors providing hardware and software to the federal government are required to ensure that these PIV cards will integrate with their software and hardware at the application level. Contractor must be able to implement and support PIV card integration.

Standard for Security Configurations The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of CDC. The following security configuration requirements apply.

• The Contractor shall configure its computers that contain CDC data with the applicable United States Government Configuration Baseline (USGCB) (see http://usgcb.nist.gov/) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. Note: USGCB is applicable to all computing systems, including desktops and laptops—regardless of function—but not including servers.

• The Contractor shall ensure IT applications operated on behalf of CDC are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capability to ensure its products operate correctly with USGCB configurations and do not alter USGCB settings—see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest USGCB major version and subsequent major versions.

• The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

• The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

• The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

• The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with these requirements.

Privacy Act Appropriate security controls and Rules of Behavior should be incorporated to protect the confidentiality of information, proprietary, sensitive, and Personally Identifiable Information (PII) the Contractor may come in contact with during the performance of this contract.

Capital Planning and Investment Control/Project Management The Federal Government mandates the prudent management of IT investments. Capital Planning and Investment Control (CPIC) is a continuous and integrated process for managing the risks and returns of information technology (IT) investments. The CPIC process fully integrates with the CDC’s overall budget, finance, acquisition, strategic planning, enterprise architecture, security, and other relevant processes. CPIC also aligns with DHHS Enterprise Performance Life Cycle (EPLC) framework and is used for all IT related decisions.

The contractor will follow the EPLC framework which will provide a standard structure for planning, managing, and overseeing IT projects over their entire life cycle. The framework consists of ten life cycle phases. Within each phase, activities, responsibilities, reviews and deliverables are defined. Templates for the deliverables are available to the contractor after award. Exit criteria are established for each phase and Stage Gate reviews are conducted through CDC’s IT Governance process to ensure that the project’s management quality, soundness, and technical feasibility remain adequate and the project is ready to move forward to the next phase. All IT projects in support of this task must adhere to the EPLC requirements and pass each State Gate as appropriate. More information about EPLC can be found at http://www.hhs.gov/ocio/eplc/.

Mobile Application Development All mobile applications must comply with CDC-related technical and security standards, processes and procedures as stated in the IT Security section of the RFTOP. In addition, the following considerations should be addressed in the proposal:

• The target platform(s) for the mobile application (e.g. iPhone, iPad, Android, Blackberry)

• Approach to 508 compatibility for the platform of choice

• If the mobile application will be made available in a related platform’s online store (e.g. iTunes, Android

Market), the process for making it available in a desired store will be managed by and through CDC, resulting in a CDC branded mobile application. The contractor will also be responsible for ensuring the mobile application complies with all standards and specifications for the desired store.

Records Retention All data created during the course of this contract must be retained, stored and disposed of in accordance with the appropriate CDC Records Control Schedule.

Data Rights Pursuant to FAR 52.227-14(d)(2), this contract expressly provides additionally as follows: The government has unlimited rights to all documents/material or other products first produced under this contract. All documents, materials or other products, to include the source codes of any software, first produced under this contract shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government. These documents and materials may not be used or sold by the contractor without prior written permission from the Contracting Officer. All materials supplied to the government shall be the sole property of the government and may not be used for any other purpose. This right does not abrogate any other government rights.

Data Collection The contractor should collect or create only that information or data necessary for the proper performance of CDC functions and which has practical utility. Limit the collection or creation of information which identifies individuals to that which is legally required, authorized, and necessary for the proper performance of CDC functions. Data collections should only include the minimum information reasonably necessary to conduct public health activities.

Unless there is a valid public health purpose, personally identifiable data (i.e, name, date of birth, phone number) should not be collected or maintained. Prior to implementing data collections, minimum data elements should be specified and consideration should be given to whether data collections of identifiable data will be necessary to achieve the intended public health goals.

To ensure the issues of confidentiality, proprietary use, and informed consent are correctly addressed, a data management plan must be initiated during the project planning phase as to how the contractor will collect, analyze, distribute, and make available the data collected.

XIII. Quality Assurance Surveillance Plan (QASP)- Attachment 4 in Section J.

The QASP will be used to ensure that systemic quality assurance methods are used in the administration of the Performance Based Service (PBS) standards included in this contract. The contractor is responsible for management and quality control actions necessary to meet the quality standards set forth by this contract. The Performance- Based Matrix below shall be used by the COR in the technical administration of this QASP. The Government will evaluate the contractor’s performance at least annually, if not more frequently, in the Contractor’s Assessment Performance Reporting System (CPARS), www.cpars.gov. Also see Attachment 3 in Section J.

Deliverable or

Services

Required

Measures of

Success

Standards-

Criteria

Acceptable

Quality

Degree of

Deviation

Method of

Surveillance

Incentive/ De-incentive

Monthly Progress Report

Timeliness

Quality

Problem

Resolution

100% compliance with government requirements

No deviations from standard allowed

Government inspection and acceptance

-Incentive – Favorable report in CPARS;

Exercising Option

-De-incentive –

Negative report in

CPARS; Not exercising

Option

Monthly Specimen Inventory Report

Timeliness

Quality

Problem

Resolution

100% compliance with government requirements

No deviations from standard allowed

Government inspection and acceptance

-Incentive – Favorable report in CPARS;

Exercising Option

-De-incentive –

Negative report in

CPARS; Not exercising

Option

Monthly Report of Specimens Shipped

Timeliness

Quality

Problem

Resolution

100% compliance with government requirements

No deviations from standard allowed

Government inspection and acceptance

-Incentive – Favorable report in CPARS;

Exercising Option

-De-incentive –

Negative report in

CPARS; Not exercising

Option

Quarterly Freezer Report

Timeliness

Quality

Problem

Resolution

100% compliance with government requirements;

no damage to specimens

No deviations from standard allowed

Government inspection and acceptance

-Incentive – Favorable report in CPARS;

Exercising Option

-De-incentive –

Negative report in

CPARS; Not exercising

Option

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E - Inspection And Acceptance

E.1 FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with…