SoL_No._2016-N-17993_Essence_OM.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

2016-N-17993

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

6. REQUISITION/PURCHASE NO.

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2920 Brandywine Road

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and electronic copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in See Instructions for submission of Offers in Sect. L until 2:00p local time 09/15/2016 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Dinah McGruder

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(404) 498-6057

C. E-MAIL ADDRESS

Hsz5@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2920 Brandywine Road

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies or Services and Prices/Costs

As an independent unit, and not as an entity of the US Government, the contractor shall provide all material, labor and Other Direct Costs (ODCs) necessary to perform the tasks indicated in the Statement of Work that follows in Section C below.

1 Job

1 Job

NOTES:

1.0 Price

Prices will be set up at a Time and Materials (T&M) ceiling amount, which, if the contractor exceeds, it would be at its own risk. The above prices include the total level of effort estimated by the contractor to perform this contract.

2.0 Payment

Payment will be made on a monthly the basis of in accordance with FAR Clause 52.237-7, Payment under Time-and-Materials and Labor-Hour Contracts. In accordance with this clause, the contractor will be required to show clearly the level of effort provided per month, i.e., number of labor hours, number of days and labor categories employed.

3.0 Travel

Some travel is anticipated for the performance of some tasks. Travel is considered “Material” (see FAR Clause 52.237-7, Payment under T&M.) and is to be performed in accordance with Federal Travel Regulations and/or the Joint Travel Regulation. The contractor may be required to submit evidence supporting any claim for travel related expenses. All requests for federally reimbursable travel shall be pre-approved by the Contracting Officer Representative and reimbursed to the extent that it is reasonable and supported. The FTR can be located at: http://www.gsa.gov/portal/content/104790?utm_source=OGP&utm_medium=print-radio&utm_term=ftr&utm_campaign=shortcuts

4.0 Period of Performance: 10/03/2016 – 10/02/2017

Section C - Description/Specification/Work Statement Title of Project: Electronic Surveillance System for the Early Notification of Community-based Epidemics (ESSENCE) Operations and Maintenance Support for the CDC National Syndromic Surveillance Program (NSSP)

PART I – Description of Work C.1 Background and Need

The Centers for Disease Control and Prevention’s (CDC), Division of Health Informatics and Surveillance (DHIS), Information Systems Branch (ISB) is seeking contractor support to provide operations and maintenance support for the Electronic Surveillance System for the Early Notification of Community-based Epidemics (ESSENCE) in support of the National Syndromic Surveillance Program (NSSP). The NSSP promotes and advances development of a syndromic surveillance system for the timely exchange of syndromic data. These data are used to improve nationwide situational awareness and enhance responsiveness to hazardous events and disease outbreaks to protect America’s health, safety, and security. NSSP functions through collaboration among individuals and organizations at local, state, and federal levels of public health; federal agencies including the Department of Defense (DOD) and the Department of Veterans Affairs (VA); public health partner organizations; and hospitals and health professionals.

The NSSP includes two components: 1) a Community of Practice in which participants collaborate to advance the science and practice of syndromic surveillance; and 2) the cloud-based BioSense Platform, a secure integrated electronic health information system with standardized analytic tools and processes. These tools enable users to rapidly collect, evaluate, share, and store syndromic surveillance data. By using the BioSense Platform, health officials can analyze syndromic data to improve their common awareness of health threats over time and across regional boundaries. The BioSense Platform provides health departments a common electronic platform for collecting, storing, and sharing syndromic surveillance data.

Understanding and addressing the needs of the public health community who contribute data to the BioSense Platform is critical to NSSP’s success. Feedback from users has pointed to limited functionality and capability as issues in the current BioSense 2.0 web application available on the BioSense Platform. User surveys conducted by stakeholder groups in 2012 and 2013 found that users need a more comprehensive syndromic surveillance system with additional analytical tools than what is currently provided in the BioSense 2.0 web application. Based upon the user survey results, CDC business requirements, and a 2015 user pilot study and evaluation of available systems and analytic tools, ESSENCE was identified as the primary syndromic surveillance system to replace the current BioSense 2.0 web application on the BioSense Platform.

ESSENCE is a web-based syndromic surveillance system designed for the early detection of disease outbreaks, suspicious patterns of illness, and public health emergencies. ESSENCE collects, processes, and analyzes non-traditional data sources (i.e. chief complaints from hospital emergency departments, poison control center calls, over-the-counter pharmaceutical sales, etc.) to identify anomalous disease activity in a community. The data can be queried, analyzed, and visualized both temporally and spatially by the end user.

The ESSENCE integration, including alpha and beta testing, into the BioSense Platform will be completed May 2016. Beginning June 2016, CDC expects to transition nine jurisdictions per month from BioSense 2.0 into ESSENCE. CDC’s goal is to fully transition all fifty-four (54) NSSP participating jurisdictions into ESSENCE and discontinue the use of the BioSense 2.0 web application by the end of December 2016. This transition will meet users’ needs and will help CDC to improve data quality, efficiency, and usefulness of the data collected as part of the NSSP.

In support of this transition, CDC has identified a need to procure ongoing contractor maintenance support of ESSENCE that will be available on the BioSense Platform.

C.2 Project Objective:

The purpose of this project is to provide maintenance and support for ESSENCE, enhance ESSENCE to ingest, analyze, and visualize LabCorp data and other potential data sources, update training courses and update end-user documentation tools to ensure that jurisdictions can use the system effectively when they transition from the BioSense 2.0 web application to the ESSENCE application in the BioSense Platform by the end of December, 2016.

C.3 Scope of Work Independent and not as an agent of the Government, the Contractor shall provide operational and maintenance support to CDC.

The Contractor shall enhance ESSENCE to ingest, analyze, and visualize LabCorp data and other potential data sources.

The Contractor must be capable of developing and delivering the following:

· Updated end-user documentation materials within the ESSENCE software and available to users as downloadable (pdf) files

· Updated online training

· Operational and maintenance support

· Processes for ESSENCE to ingest, analyze, and visualize LabCorp data and other potential data sources.

C.4 Technical Requirements Work Breakdown Structure (WBS)

None of these tasks will involve direct technical support to end users of BioSense.

C.4.1 Task Area 01: Operations and Maintenance C.4.1.1 The Contractor shall provide technical assistance, consultation, advice, and programming assistance to CDC as needed to keep ESSENCE running.

C.4.2 Task Area 02: ESSENCE Enhancements C.4.1.2 The Contractor shall:

a. Ingest, analyze, and visualize LabCorp data source.

b. Ingest, analyze, and visualize other data sources.

c. Develop/implement enhancements to the ESSENCE system based on the priorities from the COR and CDC staff - There will be weekly calls were specific enhancements will be discussed.

d. Determine potential solutions and assist the COR and CDC staff to determine implementation strategies. These may include consultation with the COR and CDC staff during development.

C.4.3 Task Area 03: Admin Consultation and Documentation C.4.1.3 The Contractor shall coordinate with the COR and CDC staff to:

a. Provide System Consultation to CDC staff.

b. Train system administrators.

c. Develop any needed documentation to support the running of ESSENCE in the BioSense environment.

NOTE: This will include back-end aspects such as data ingestion processes and well as front-end aspects such as user administration.

C.4.4 Task Area 04: Updated End-user Documentation

C.4.1.4 The Contractor shall:

a. Update the end-user documentation such as the user guide, navigation panes and help screens within the ESSENCE software application.

b. Provide updated downloadable (pdf) end-user documentation tools such as Frequently Asked Questions (FAQs), user guide, and quick reference guide.

c. Update the tools in accordance with web usability best practices such as the use of clear concise language, step-by-step procedures, examples, illustrations and screenshots.

d. Coordinate with the COR and CDC staff to post the downloadable documents on the designated CDC server(s) and CDC website(s) (e.g. syndromicsurveillance.org, CDC TRAIN).

C.4.5 Task Area 05: Updated Online Training Course

C.4.1.5 The Contractor shall:

a. Update the course content and learning objectives for a self-paced online ESSENCE training course that provides instruction on using the ESSENCE application functions available on the BioSense Platform such as logging on, queries, saving work, time series, reports, importing from files, permissions, adding users, access controls, sharing data, and other content as required by CDC.

b. Provide the updated ESSENCE training course content in accordance with e-learning best practices such as those on the CDC Learning Connection (http://www.cdc.gov/learning/quality/elearning-design.html).

c. Coordinate with the COR and CDC staff to post the downloadable documents on the designated CDC server(s) and CDC website(s) (e.g. syndromicsurveillance.org, CDC TRAIN).

C.5 Disposition and Use of Data All materials developed or information of whatever nature resulting from work being performed under this contract shall not be submitted for publication or dissemination without the prior review and written approval of the COR

C.6 Deliverables Table

The contractor shall deliver, within the time frames specified, the identified deliverables to the COR and to the Contracting Specialist. The documents shall be provided in an electronic format to the Government for ease of storage, retrieval and management repository. All documentation deliverables shall have a cover sheet with a version block and signature block to the government specification. The response shall include all requested deliverables and the proposed schedule for the proposed deliverables within the anticipated Period of Performance.

The contractor shall submit their deliverables to the Contracting Officer Representative (COR) for acceptance. If the deliverable is rejected, the COR will provide comments to the contractor to correct the deliverable.

Deliverable Schedule

Milestone Chart for Tasks

* Due dates are based on an October 3, 2016 contract start date.

Quality Assurance Surveillance Plan (QASP) An ISB/NSSP Management Team, including but not limited to Contracting Officer’s Representative (COR), NSSP Program Manager, DHIS Associate Director for Science, DHIS Senior Advisor for Partnerships and other staff as identified by CDC, will be responsible for technical direction of this project. Note that this list will be confirmed and detailed by the kick-off meeting. The vendor will deliver interim and final work products to the CDC Management Team and COR within the time frame agreed upon when the proposed project schedule is accepted by the government. The individual work products must be deemed to be acceptable to the government before being consolidated into the final deliverable.

Since this is a Performance Based Services contract, CDC must effectively validate in a timely manner the performance of the Contractor in meeting the services required. This QASP provides a systematic surveillance method for the services and describes the methodology by which the contractor’s performance will be monitored.

The contractor is responsible for management and quality control actions necessary to meet the quality standards set forth by this contract. The below listed Performance Standards and Surveillance Methods shall be used by the COR in the technical administration of this QASP. The Government will evaluate the contractor’s performance at least annually, if not more frequently, in the Contractor’s Assessment Performance Reporting System (CPARS), www.cpars.gov.

Task 1. Operations and Maintenance

Task 2. Enhancements

a. Specific enhancements will be discussed during weekly calls.

a. These may include JHUAPL development or just consultation with CDC during development.

Task 3. Admin Consultation and Documentation

a. Provide system consultation

b. Train system administrators

c. Develop any needed documentation to support the running of ESSENCE in the BioSense environment.

Task 4. End User Documentation

Task 5. Online Training Course

PART III: INSTRUCTIONS TO CONTRACTORS:

C.9 Specific Requirements

a. Contract Management and Control - the Contractor shall provide the planning, coordination, technical direction, and surveillance of the activities necessary to assure disciplined work performance to accomplish all work under the contract. The Contractor shall be responsible for maintaining communication with the Contracting Officer (CO) and Contracting Officer’s Representative (COR), and to immediately notify both the CO and the COR of any problems that would prevent timely performance of work issued under this contract.

The Contractor shall prepare and submit badge ID, cardkey request forms, etc. for all Contractor staff on-boarding and/or changing locations. Any update information should be provided in the monthly reports or in the monthly meetings with management and the COR.

The Contractor shall establish, implement, and maintain technical management and oversight of all work performed under this SOW. the Contractor shall assure the technical excellence, cost effectiveness, and timeliness of all required work and deliverable products.

b. Contractor Training – except for certain Government required training, the contractor at his own expense shall provide training as necessary for the contractor’s personnel.

c. Contract Closeout - The contractor shall submit a final invoice within forty-five (45) calendar days after the end of the Performance of Period. After the final invoice has been paid the contractor shall furnish a completed and signed Release of Claims to the Contracting Officer. This release of claims is due within fifteen (15) calendar days of final payment.

d. Continuity of Support - Personal services shall not be performed under this contract. Although the Government may provide sporadic or occasional instructions within the scope of the contract, the Contractor is responsible for control and supervision of its employees. If the Contractor (including its employees) believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

e. The contractor shall comply with, and ensure their employees and subcontractors comply with, CDC Policy titled “Identification of Contractors' Employees and Safeguarding Government Information.” No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. . The contractor is limited to performing the services identified in the contract statement of work and shall not interpret any communication with anyone as a permissible change in contract scope or as authorization to perform work not described in the contract. All contract changes will be incorporated by a modification signed by the Contracting Officer.

f. The Contractor shall ensure that all of its employees and subcontractor employees working on this contract are informed of the substance of this clause. The Contractor agrees that this is a non-personal services contract; and that for all the purposes of the contract, the Contractor is not, nor shall it hold itself out to be an agent or partner of, or joint venture with, the Government. The Contractor shall notify its employees that they shall neither supervise nor accept supervision from Government employees. The substance of this clause shall be included in all subcontracts at any tier.

g. Nothing in this clause shall limit the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept or reject the services performed under this contract.

C.10 Safety Issues The work described herein is primarily sedentary, performed in an office setting. Some walking will be required throughout the workplace facilities and at work sites. The work environment involves everyday risks or discomforts that require normal safety precautions typical of such places as conference rooms or office spaces.

PART IV – CLEARANCES

The Paperwork Reduction Act of 1995 (PRA) Contractor employees should be advised that any activities involving information collection (i.e., posing similar questions or requirements via surveys, questionnaires, telephonic requests, focus groups, etc.) from 10 or more non-Federal entities/persons, including States, are subject to PRA requirements and may require CDC to coordinate an Office of Management and Budget (OMB) Information Collection Request clearance prior to the start of information collection activities. This would also include information sent to or obtained by CDC via forms, applications, reports, information systems, and any other means for requesting information from 10 or more persons; asking or requiring 10 or more entities/persons to keep or retain records; or asking or requiring 10 or more entities/persons to disclose information to a third-party or the general public.

Security Compliance

This Statement of Work (SOW) requires the successful offeror to have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government. IMPORTANT NOTE TO OFFERORS: The following information shall be addressed in a separate section of the Technical Proposal entitled, “Information Security.” Information Security is applicable to this solicitation because all information systems developed, operated, or used by or on behalf of the Federal Government must comply with Federal Information Security laws, policies and standards. We provide the following information to assist in the preparation of proposals in order to assure that the existing data system, which would be licensed for use by CDC grantees and CDC employees, meet the security standards described below.

The EGovernment Act of 2002, (Federal Information Management Act) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123 The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/policies/FISMA-final.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, offeror (including sub-offeror), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

· FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

· FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)

· NIST Special Publication 800-18, Guide to Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf)

· NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf).

· NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final-errata.pdf).

· NIST Special Publication 800-63, Electronic Authentication Guideline (http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf) The successful Offeror is responsible for providing pertinent security information to the CSELS ISSO and Security Staff and assisting in completing the below CDC Certification and Accreditation documents. Appropriate security templates will be provided to the successful Offeror by the CSELS Security Staff. Completed documents will be sent to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority to Operate (ATO)

· Baseline System Information (BSI)

· Privacy Impact Assessment (PIA)

· System Security Plan (SSP)

· Business Continuity Plan (BCP)

· Risk Assessment Report (RAR)

The Offeror shall respond to the following seven security–associated requirements in the application:

1) Position Sensitivity Designations

CDC requires a Public Trust Level 5 for the following

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-offeror staff) working under the contract that will have the ability to access sensitive CSELS information from the system. The roster shall be submitted to the Project Officer/technical monitor, with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer shall notify the licensor of the appropriate level of suitability investigations to be performed, but Licensor employees and subcontractors who have met investigative requirements within the last five years may only require an updated or upgraded investigation. An electronic template, “Roster of Employees Requiring Suitability Investigations,” is available for offeror use at: http://ais.nci.nih.gov/forms/Suitability-roster.xls. Upon receipt of the Government’s notification of applicable suitability investigations required, the Licensor shall complete and submit the required forms within 30 days of the notification.

Non-Disclosure Agreements The Offeror and any sub-Offerors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this contract that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Offeror's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and offeror, to determine if a major change to the system has occurred, and if a PIA update is needed. Contractor must adhere to the Privacy Act clause and other clauses that address non-public information protection, as applicable. While the Privacy Act is not applicable, the appropriate security controls and Rules of Behavior should be incorporated to protect the confidentiality of information, proprietary, sensitive, and Personally Identifiable Information (PII) the Contractor may come in contact with during the performance of this contract.

3) Offeror’s Official Responsible for Information Security

The offeror shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the offeror be selected for an award.

4) Rules of Behavior

The offeror’s employees and subcontractors shall comply with the HHS Information Technology General Rules of Behavior.

5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful offeror shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Offeror's expense and would be the Offeror's responsibility to plan and arrange.

The successful offeror shall maintain a listing of all individuals who have completed this training and shall submit this listing to the project officer.

6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain sensitive CDC- data shall be encrypted using FIPS 140-2 compliant algorithms.

Section 508 of the Rehabilitation Act (29 USC 794d)

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Provisions (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit:

1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility provisions. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access- board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this solicitation are 36 CFR 1194.21, .22, .24, .31, and .41. In order to facilitate the Government’s evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific Section 508 standard. Instructions for preparing the HHS Section 508 Product Assessment Template may be found at http://508.hhs.gov.

Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards in its completed HHS Section 508 Product Assessment Template, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility in the Product Assessment Template, remediation of the products and/or services to the level of conformance specified in the vendor’s Product Assessment Template will be the responsibility of the Contractor at its expense.

IT Capital Planning Clearance (EITPO IT)

Capital Planning and Investment Control (CPIC) is an integral part of the Agency’s strategic planning initiative. In accordance with the CPIC process and Clinger-Cohen Act, Contractor shall follow the HHS EPLC framework and provide complete, reliable, consistent, and timely life-cycle information, to include development and cost information; and systematic measurement of performance.

· Contractor must furnish data to ensure that any new system developed as part of this contract is added to the Enterprise Systems Catalog (ESC), and any IT costs associated with those systems are captured in the Enterprise Systems Catalog as part of the Capital Planning process.

· CDC Enterprise Architecture (EA) Requirements -- General

The Contractor shall ensure that new Information Technology (IT) products and services are aligned with the vision and guidance of the CDC’s Enterprise Target Architecture. IT projects must produce, maintain and make available a standard set of documentation that describes the IT Systems and their respective information flows at a sufficient level of detail. A minimum set of documentation guidelines may be found from the CDC Enterprise Architecture online site.

Section D - Packaging and Marking There are no clauses/provisions included in this section.

Section E - Inspection and Acceptance E.1

FAR 52.246-1

Contractor Inspection Requirements (Apr 1984) The Contractor is responsible for performing or having performed all inspections and tests necessary to substantiate that the supplies or services furnished under this contract conform to contract requirements, including any applicable technical requirements for specified manufacturers’ parts. This clause takes precedence over any Government inspection and testing required in the contract’s specifications, except for specialized inspections or tests specified to be performed solely by the Government.

E.2 Inspection and Acceptance

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer or his duly authorized representative (who for the purposes of this contract shall be the Contracting Officer Representative) at the destination of the articles, services or documentation.

(End of Clause)

E.3 FAR 52.246-6

Inspection -- Time-and-Material and Labor-Hour (May 2001) (a) Definitions. As used in this clause--

“Contractor’s managerial personnel” means any of the Contractor’s directors, officers, managers, superintendents, or equivalent representatives who have supervision or direction of --

(1) All or substantially all of the Contractor’s business;

(2) All or substantially all of the Contractor’s operation at any one plant or separate location where the contract is being performed; or

(3) A separate and complete major industrial operation connected with the performance of this contract.

“Materials” includes data when the contract does not include the Warranty of Data clause.

(b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the material, fabricating methods, work, and services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires.

(c) The Government has the right to inspect and test all materials furnished and services performed under this contract, to the extent practicable at all places and times, including the period of performance, and in any event before acceptance. The Government may also inspect the plant or plants of the Contractor or any subcontractor engaged in contract performance. The Government shall perform inspections and tests in a manner that will not unduly delay the work.

(d) If the Government performs inspection or test on the premises of the Contractor or a subcontractor, the Contractor shall furnish and shall require subcontractors to furnish all reasonable facilities and assistance for the safe and convenient performance of these duties.

(e) Unless otherwise specified in the contract, the Government shall accept or reject services and materials at the place of delivery as promptly as practicable after delivery, and they shall be presumed accepted 60 days after the date of delivery, unless accepted earlier.

(f) At any time during contract performance, but not later than 6 months (or such other time as may be specified in the contract) after acceptance of the services or materials last delivered under this contract, the Government may require the Contractor to replace or correct services or materials that at time of delivery failed to meet contract requirements. Except as otherwise specified in paragraph (h) of this clause, the cost of replacement or correction shall be determined under the Payments Under Time-and-Materials and Labor-Hour Contracts clause, but the “hourly rate” for labor hours incurred in the replacement or correction shall be reduced to exclude that portion of the rate attributable to profit. The Contractor shall not tender for acceptance materials and services required to be replaced or corrected without disclosing the former requirement for replacement or correction, and, when required, shall disclose the corrective action taken.

(g)

(1) If the Contractor fails to proceed with reasonable promptness to perform required replacement or correction, and if the replacement or correction can be performed within the ceiling price (or the ceiling price as increased by the Government), the Government may --

(i) By contract or otherwise, perform the replacement or correction, charge to the Contractor any increased cost, or deduct such increased cost from any amounts paid or due under this contract; or

(ii) Terminate this contract for default.

(2) Failure to agree to the amount of increased cost to be charged to the Contractor shall be a dispute.

(h) Notwithstanding paragraphs (f) and (g) above, the Government may at any time require the Contractor to remedy by correction or replacement, without cost to the Government, any failure by the Contractor to comply with the requirements of this contract, if the failure is due to --

(1) Fraud, lack of good faith, or willful misconduct on the part of the Contractor’s managerial personnel; or

(2) The conduct of one or more of the Contractor’s employees selected or retained by the Contractor after any of the Contractor’s managerial personnel has reasonable grounds to believe that the employee is habitually careless or unqualified.

(i) This clause applies in the same manner and to the same extent to corrected or replacement materials or services as to materials and services originally delivered under this contract.

(j) The Contractor has no obligation or liability under this contract to correct or replace materials and services that at time of delivery do not meet contract requirements, except as provided in this clause or as may be otherwise specified in the contract.

(k) Unless otherwise specified in the contract, the Contractor’s obligation to correct or replace Government-furnished property shall be governed by the clause pertaining to Government property.

(End of Clause) Section F - Deliveries or Performance F.1

FAR 52.242-15

Stop-Work Order (Aug. 1989) (a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either --

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period…