2017-N-18051_Communications_IDIQ_3-23-2017--OC_Final_Review.pdf

PAGES

15A. NAME

AND

ADDRESS

OF

OFFEROR

SEC. PAGE(S) SEC. PAGE(S)

(Date) (Hour)

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amend-ments to the SOLICITATION for offerors and related documents numbered and dated:

(Type or Print)

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

1 83

2. CONTRACT NO.

3. SOLICITATION NO.

2017-N-18051

4. TYPE OF SOLICITATION

SEALED BID (IFB)

X NEGOTIATED (RFP)

5. DATE ISSUED

6. REQUISITION/PURCHASE

NO.

00HCUG12-2017-97186

7. ISSUED BY CODE 2543 8. ADDRESS OFFER TO (If other than Item 7)

Centers for Disease Control and Prevention

Office of Acquisition Services (OAS)

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 5 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in Section L until 2:00PM local time May 15, 2017

CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation. This is a 100% SMALL BUSINESS SET-ASIDE

10. FOR INFORMATION

CALL:

A. NAME

Betty Vannoy

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2891

C. E-MAIL ADDRESS

Bbv9@cdc.gov

11. TABLE OF CONTENTS

(x) DESCRIPTION (x) DESCRIPTION

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 47

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 5 X J LIST OF S 53

X D PACKAGING AND MARKING 17 PART IV – REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 18 REPRESENTATIONS, CERTIFICATIONS, AND

X F DELIVERIES OR PERFORMANCE 19 X K OTHER STATEMENTS OF OFFERORS 54

X G CONTRACT ADMINISTRATION DATA 21 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 62

X H SPECIAL CONTRACT REQUIREMENTS 27 X M EVALUATION FACTORS FOR AWARD 83

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

AMENDMENT NO. DATE AMENDMENT NO. DATE

CODE FACILITY 16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 2543 25. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention

Office of Acquisition Services (OAS)

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE Prescribed by GSA

FAR (48 CFR) 53.214©

K

Section B - Supplies Or Services And Prices/Costs

CLIN Supplies/Services Qty/Unit Unit Price Extended Price

0001 Professional Technical Assistance

Support Services for the project entitled, “Rapid Communications

Services and Support for Sudden and Ongoing Environmental

Health Urgent and Emerging

Issues Technical Assistance

Support” as outlined in the

Performance Work Statement

(PWS) and specifically ordered through individual task orders.

Period of Performance: July 1, 2017 through June 30, 2022

1 Job Not Separately

Priced (NSP)

NSP

B.1 PURPOSE

The purpose of this contract is to provide services that fall within the scope of the work specified in

Section C for the project entitled, “Rapid Communications Services and Support for Sudden and

Ongoing Environmental Health Urgent and Emerging Issues Technical Assistance Support.” The

Contracting Officer (CO) will request the work through the issuance of task orders during the ordering period as specified in Section F of the contract.

B.2 CONTRACT TYPE AND SERVICES

This is a competitive 100% SMALL BUSINESS SET-ASIDE procurement. This acquisition is being competed in accordance with FAR Part 15 - Contracting by Negotiation. The NAICS

Code is 541810, Advertising Agencies, with an average annual receipt of $15 million dollars size standard.

This is an Indefinite Delivery Indefinite Quantity contract (IDIQ) utilizing individual task orders to provide technical assistance services. As defined in FAR Part 16, Type of Contracts, the

Government will issue task orders or contract line item numbers (CLIN) that are either Firm-

Fixed-Price (FFP), Time-and-Materials (T&M), or Labor-Hour (LH).

Obligation of funds will be done by the issuance of individual task orders by the Contracting

Officer in accordance with the clause titled “Award of Task Orders” in Section H and FAR

Clause 52.216-18 titled “Ordering” in Section I. The Contractor shall not exceed the amount negotiated for each individual task order without prior written approval of the Contracting

Officer.

In addition, the Contractor shall not commence work until a task order or other written notification for a specific assignment is issued by the Contracting Officer. Only a CDC

Contracting Officer is authorized to issue a task request to the Contractor or issue finalized task orders under this contract.

The Government is not obligated to reimburse the Contractor for costs incurred before issuance of a task order or other written notification by the Contracting Officer.

This is not a multiyear contract as defined in FAR Part 17.1. Task Orders will be issued with specific performance periods.

The intent is to issue two task orders (see Attachments J6 and J7 and Section L herein) upon award of this IDIQ. Task orders will be issued with specific performance periods.

B.3 PERFORMANCE BASED PREFERENCE

Pursuant to FAR 37.102(a) (2), the CO will use performance-based acquisition methods to the maximum extent practicable. The Government anticipates multiple awards.

B.4 MINIMUM OBLIGATED AMOUNT

The basic contract includes an initial obligation of funds in the amount of $10,000.00 to cover the one-time minimum order guarantee. CDC/ONDIEH/NCEH is required to order and the

Contractor is required to furnish the minimum order amount of services. Following this initial obligation, individual task orders will obligate funds to cover the work required under each task order.

[Note: The initial obligation is expected to be applied towards the first task order issued by

CDC/ONDIEH/NCEH.]

B.5 MAXIMUM CONTRACT CEILING

The ceiling price for this IDIQ contract (i.e. cumulative value of all task orders) is

$10,000,000.00. The maximum aggregate dollar value of the task orders awarded cannot exceed this contract ceiling.

B.6 TASK ORDER PRICING (ALL ORDER TYPES)

Cost or price fair and reasonableness will be based on the following:

B.6.1 Fixed Price Pursuant to FAR 15.4, Pricing, and FAR 16.2, Fixed-Price Contracts, the Firm-Fixed Price for each task order will be negotiated based on the price to complete the work. After acceptance of a fixed price task order by the Contractor, the task order price will only be adjusted to reflect changes in scope or conditions.

B.6.2 Time and Materials and Labor-Hour

The basic contract shall provide loaded hourly labor rates for T&M and LH type orders. The

Basic Contract does not provide Loaded Hourly Labor Rates for T&M and L-H type Orders extending beyond the period of performance of the Basic Agreement. The fair and reasonable pricing for all T&M and L-H Orders will be determined in accordance with FAR 15.4, Pricing, and FAR 16.601, Time and Materials Contracts.

“Loaded Hourly Labor Rate” is defined as hourly rates that include Wages, Overhead, G&A

Expenses, and Profit.

B.7 TRAVEL PRICING (ALL ORDERING TYPES)

Travel will be reimbursed at actual cost in accordance with the limitations set forth in FAR

31.205-46. Profit shall not be applied to travel costs. Contractors may apply G&A to travel in accordance with the Contractor’s usual accounting practices consistent with FAR 31.2. Travel expenses will be identified under a separate CLIN on the specific task order.

B.8 PLACE OF WORK AND GOVERNMENT FURNISHED EQUIPMENT

Work under the contract may be performed on-site at CDC locations OR may be conducted off-site at contractor locations and on-site meetings with CDC staff, as may be required. Each task order will specify the location requirements. If the work is to be performed primarily on-site at a

CDC location, due to the nature of the work, CDC will provide IT equipment (i.e., desktop computer), telephone, and other office equipment and supplies as needed for the Contractor to perform required tasks.

If the work is to be performed primarily off-site at the contractor’s locations, where the contractor needs to access CDC’s network, the CDC will not provide IT equipment and the computers used by contractor personnel shall meet CDC’s standard software and security configuration before logging onto CDC’s network.

B.9 NON-PERSONAL SERVICES CONTRACT STATEMENT

This is a non-personal services contract as defined in Federal Acquisition Regulation (FAR)

37.101. The government will evaluate the quality of support services provided but the

Contractor retains control over its employees or agents. The Contractor is solely responsible for and liable for and expressly agrees to indemnify the Government with respect to any liability producing acts or omissions by it or by its employees.

Section C - Description/Specification/Work Statement

Title of Project: Rapid Communications Services and Support for Sudden and Ongoing

Environmental Health Urgent and Emerging Issues Technical Assistance Support

C.1 BACKGROUND AND NEED

The Center for Disease Control & Prevention (CDC), National Center for Environmental Health

(NCEH), Agency for Toxic Substances and Disease Registry (ATSDR), Office of

Communication (CDC NCEH/ATSDR OC) conducts communication activities in communities throughout the nation. The NCEH/ATSDR OC assists the Center’s scientists, investigators, and other division staff in communicating specific health and other site-related information to communities affected by hazardous substances. The OC uses a wide range of strategies and communication tools to reach community members, leaders, policy makers, and the news media with important messages.

ATSDR/NCEH specifically conducts health studies, assessments, and investigations at hazardous waste sites in communities. These sites include Superfund and federal facility sites and other hazardous or potentially hazardous locations. Issues at such sites often arise suddenly in response to emerging science, news events, or new information presented. As a result, ATSDR/NCEH has an urgent need to already have in place response mechanisms to address public concerns arising from the events at ATSDR and events associated with NCEH issues.

The NCEH/ATSDR OC seeks a contractor to rapidly develop and execute integrated marketing services to meet its environmental health communication goals. Specialized communication expertise and experience in environmental health communication and risk communication are required. The contractor shall have the capacity to apply innovative and proven outreach techniques to reach diverse populations with environmental health information.

C.2 PROJECT OBJECTIVE

To procure additional health communications capacity to rapidly respond to both ongoing and sudden or emerging issues in environmental health. The contractor shall develop strategies and products to reach targeted and disperse populations in short time frames.

C.3 SCOPE OF WORK

The scope of work for this project covers the following major task areas:

Task 1: Communications Planning

Task 2: Communication Support

Task 3: Evaluation Research and Monitoring

Task 4: Social Media and Digital Communication Support

Task 5: Responding to Urgent and Emerging Issues

C.4 TECHNICAL REQUIREMENTS

The contractor shall provide all necessary personnel, labor, facilities, equipment, materials, supplies, supervision, and other incidentals to provide the required expertise to enhance the capacity of the NCEH/ATSDR to provide integrated marketing services, communication support, and produce and distribute communication materials on selected NCEH/ATSDR topics and issues. However, it is not limited solely to NCEH/ATSDR support. At the discretion of the COR, on a case by case basis, other CIO’s and Offices within CDC may also request support using this

Environmental Health IDIQ contract.

Task 1: Communications Planning

Materials Review. The contractor shall review existing materials and information on

ATSDR/NCEH issues.

Communications Plans. The contractor shall develop plans (as required) detailing the strategy and tactics recommended for outreach to targeted populations. The plans shall cover strategic marketing, distribution of information, and evaluation based on an assessment of audience information-seeking behavior. All products and methods of distribution should maximize cost-free solutions. The plans shall be presented in written form. The NCEH/ATSDR COR will review and accept all plans, protocols, and products before production.

Task 2: Communication Support

Key Messages and Questions & Answers (Q&A). For example, contractor shall develop key messages for asbestos-related communication, reworking/tailoring core messages developed by NCEH/ATSDR health scientists.

Letters, e-mails to target populations.

Fact Sheets or Backgrounders based on content to be provided by NCEH/ATSDR

COR.

Cognitive testing of messages and products.

News Releases or other Media Materials – The contractor shall assist with developing materials such as drafting press releases and media alerts, Q and A’s, and fact sheets for review and acceptance by COR. The contractor shall submit additional press materials as needed for clearance by times needed according to protocol.

Media Distribution Planning and Media List. Consistent with communications priorities, the contractor shall provide either simple media lists or detailed media distribution plans that include the rationale for targeted outreach. The contractor must have the ability to reach specific, diverse audiences with news information.

Matte News Releases and Distribution.

Audio News Releases and Distribution.

Specialized Outreach Products. As the contractor develops communication plans, innovative outreach products or strategies should be considered and developed to reach diverse populations. When the contractor identifies mechanisms to be used to select segments of the population for the outreach program, the process must be reviewed to identify if the Privacy Act applies. Adequate administrative, operational, and technical security controls must be implemented to prevent unauthorized access to or disclosure of any personally identifiable information (PII) that will be accessed by the contractor. Electronic transfers of PII via Internet or portable media must utilize FIPS

140-2 compliant encryption.

Press Events Logistics. The contractor shall provide logistical and technical support for press events and briefings (including teleconferences links for the media).

Graphics, layout, and design. The contractor shall provide support for advertising materials specified by the COR (as required).

Communications Training. The contractor shall deliver communication training sessions. Primary topics will include spokesperson training, risk communication training, clear writing training, and other key training identified by the COR.

Web Design and Development. The contractor shall follow a standard development process to include creating an outline (e.g., wireframe) for an informational, interactive website; content for the website as specified; and potentially including such tools as a patient self-assessment instrument for the website and an e-card or similar outreach tool that can be accessed and easily used from the website. The contractor shall produce broadcast-quality and Internet-compatible products from various sites in collaboration with CDC. Should a task include the development of an IT system, such as a web application that will be hosted in the CDC domain, then security language must be embedded in the task description. Standard language from the HHS Acquisition

Regulations (HHSAR) shall be inserted into the task definition.

Specialized Marketing Services. The contractor shall provide marketing and communications training and team coaching to NCEH/ATSDR team members. The contractor shall provide logistical support for up to two off-site meetings each year.

Communication Surveys: The contractor may be responsible for obtaining

IRB/OMB/PRA clearance for survey(s). This may take up to six months for the clearances. The activities may consist of pre-site and post-site activities; and data survey analyses.

Task 3: Evaluation Research and Monitoring

The contractor shall collect and analyze a range of evaluation data across channels as needed

(mass media, Web, organizational channels, etc.) For example, to measure reach and frequency of placement of public health news, the contractor shall undertake environmental scanning, conduct media analysis, provide monitoring, or hire a specialized monitoring service to track placements and coverage. The contractor shall provide a final report that shall include a summary of media monitoring activities, recommendations with comments/creative ideas for further outreach, and marketing/outreach data. Other tasks could include distributing news products to selected local media contacts for review and feedback, with feedback provided to

CDC through a written summary of each media contact. Another example of evaluation would be to analyze Web traffic or referrals from different websites to NCEH/ATSDR on-line information.

Task 4: Social Media and Digital Communication Support

The contractor shall provide comprehensive support for social and digital media activities in both

English and Spanish, including management of social media profiles, social media strategy, and development of digital health communication content and campaigns. CDC maintains agency presences on multiple social media channels, including but not limited to Facebook, Twitter, Instagram, Pinterest, YouTube, LinkedIn, and similar applications/channels. The profiles and digital campaigns are often highly visible and include supporting social media profiles.

Contractors must have experience managing and creating sensitive, health-related communication content and products.

All work shall adhere to established social media policies, including clearance polices, security polices, and CDC social media standards and Standard Operating Procedures (SOPs).

This may consist of:

o Provide specialization in the areas of social media strategy and tactics, digital technology, tools, platforms, and content for social media and digital products.

o Curate, coordinate, disseminate, manage, and share social media content from across

CDC and partners on CDC social media channels.

o Create health content for dissemination on social media and other digital channels.

Creative content shall be developed with health communication principles, plain language principles, and social media best practices.

o Create robust social and digital media health campaigns and manage the full implementation including development of graphics and visuals, scheduling, clearance, etc.

o Identify and evaluate the suitability of existing and emerging social media channels and tools.

o Evaluate, monitor, and gather metrics for CDC’s social media activities.

o Provide access to social media tools or services. Tools or services may include social media analytics, online ads (such as Google Ads), and engagement and monitoring tools such as Simply Measured and HootSuite.

o Identify top needs for CDC’s social media audiences, identifying and leveraging key influencers, using social media and news media monitoring systems to monitor social media conversations for engagement.

Task 5: Responding to Urgent and Emerging Issues

The contractor shall be capable of responding to urgent and emergent issues that may require an immediate response in effort/resources. For the purpose of this IDIQ, “emergency” is defined as an unusual or atypical event requiring immediate contractor response and may require additional personnel and resources until the urgent or emergent issue is successfully resolved. Historically, urgent or emerging issues requiring an immediate effort occur approximately two (2) times per year, but may be more or less than the historical number for any given year.

Only activities within the scope of this statement of work are authorized. Accordingly, the contractor shall resolve any questions pertaining to “scope” with the contracting officer for a determination.

Emergent support would include, but is not limited to:

Developing communications and outreach plans

Conducting cognitive testing

Selecting media and channels for communication

Message and material development

Spokesperson training

Coordinating with local communities and providing assistance

Identifying and recruiting partners

Facilitating health care networks and coalitions that address federal priorities

Providing a summary report

Other tasks as appropriate.

C.5 REPORTING SCHEDULE

In addition to specific reporting requirements defined in each Task Order issued, the Contractor shall furnish monthly progress reports detailing current status of each Task Order awarded under the IDIQ. The report shall be narrative in form and shall include a summary of progress toward completion of each Task Order and any problems encountered to date, including the Contractor’s assessment of the specific impact of such problems on scheduled date of completion of milestones.

(1) Meeting Summary Report --

The contractor shall meet with the COR within 21 days of task order contract award to discuss task order execution and specifics. Additional meetings may be scheduled at the discretion of the

COR to discuss contract requirements. Meeting Summary Reports’ contents, quantity, and format will be determined by the COR. The meeting summary report is due no later than five days after the meeting(s).

(2) Monthly Progress Report –

The contractor will be required to provide a monthly progress report which will present a listing of deliverables, approved time lines and milestones, problems anticipated or experienced key events of the month and those projected for the coming month including profile reports and coordination of peer review schedules with that contractor, reports and peer review schedules and a narrative of performance in literature review and staff utilization. It must focus on project highlights and present anticipated progress in all facets of the Performance Work Statement.

Required reports shall be submitted to the COR and CO.

(3) Quality Control Plan –

The contractor shall provide and maintain a Quality Control Plan (QCP) that contains, as a minimum, criteria outlined in Section C.7 to the COR and Contracting Officer for acceptance not later than ten (10) calendar days after award. The COR will notify the contractor of acceptance or required modifications to the plan. The contractor shall make appropriate modifications and obtain acceptance of the plan within thirty (30) calendar days from the date of award.

(4) Work Plan –

The contractor shall develop and furnish a milestone schedule for completion of all tasks and deliver a copy to the COR and CO 30 days after award.

(5) Notification of 75% Completion Report (Time-and-Material and LH Task Orders)

In a separate report, Contractor shall provide written notification to COR, and Contracting

Officer when project work has reached 75% completion.

(6) Financial Reports

Financial Reports detailing current status of each project/site under the contract shall be provided by the Contactor. Financial reports should demonstrate actual costs to budgeted costs as a whole.

The contractor shall send one copy of the Financial Report to the COR and the Contracting

Officer. Monthly financial reports will be submitted by the Contractor for Time and Material

Task Orders. Financial reports for all task orders will be required when the Contractor invoices the Government.

C.6 SPECIAL CONSIDERATIONS

Tasks may be either severable or non-severable, as specified in separate IDIQs (Task Orders).

All records, files, analyses, models, and documents developed under this contract shall be the property of the CDC

Information Technology (IT) Security

SOCIAL MEDIA AND OTHER THIRD-PARTY WEBSITE USAGE

Use of any and all third-party[1] / social media[2] sites must be approved in advance, and comply with HHS and CDC policies, procedures and best practices (including security and privacy) such as those found at:

http://www.hhs.gov/web/socialmedia/ and http://www.cdc.gov/SocialMedia/Tools/guidelines/. Contractor will submit necessary documentation, in cooperation with the Project Officer, to obtain approval through designated CDC Social Media governance, as well as Information Security and Privacy Officers.

INFORMATION TECHNOLOGY (IT) SECURITY

The below information complies with HHSA Security compliance requirements for E-Government

Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA

2014)

Security Compliance

If the contractor will host or create an information system on behalf of the CDC, provide IT services to the CDC, or provide IT products to the CDC, then the contractor must comply with the applicable IT security references below.

The FISMA 2014, (Federal Information Security Modernization Act of 2014) dictates the framework for assuring information security for data systems operated by or on behalf of the Federal government.

OMB Circular A-130 (https://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in

Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS

AISSP) with OMB Circular No. A-123 The Federal Information Security Management Act of 2002 (P.L.

107-347) (FISMA) (http://csrc.nist.gov/drivers/documents/FISMA-final.pdf ) and the Federal Information

Security Modernization Act of 2014 (P.L. 113-283) (FISMA 2014)

(https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

[1] Third-party websites are Internet-based commercial and other non-CDC information services that offer information gathering, storage and processing services, without the usual contracting mechanisms. Examples include SurveyMonkey, DiscoveryCast and Google collaboration sites.

[2] "Social media are various activities that integrate technology, social interaction, and content creation. Social media uses many technologies and forms, such as blogs, wikis, photo and video sharing, podcasts, social networking, mash-ups, and virtual worlds." U.S. General Administration (GSA) http://www.hhs.gov/web/socialmedia/ http://www.cdc.gov/SocialMedia/Tools/guidelines/ https://www.whitehouse.gov/omb/Circulars_a130_a130trans4/ http://csrc.nist.gov/drivers/documents/FISMA-final.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf http://www.gsa.gov/graphics/staffoffices/socialmediapolicy.pdf

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

FIPS Publication 200, Minimum Security Requirements for Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf), FIPS Publication 199, Standards for Security Categorization of Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf), NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information

Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf), NIST Special Publication 800-60, Guide for Mapping Types of Information and Information

Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf), NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to

Federal Information Systems: A Security Life Cycle Approach

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf), NIST Special Publication 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53r4.pdf), NIST Special Publication 800-63, Electronic Authentication Guideline

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the FISMA 2014 and NIST Special Publication 800-18, 800-37 and will include selected mandatory controls required by NIST Special Publication 800-53, Volume I & II. The successful contractor in conjunction with the NCEH/ATSDR Information System Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer (CISO). The successful completion of the SA&A documents will result in an award of an Authority to Operate (ATO). Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCEH/ATSDR ISSO and confirmed by the CDC Certifying Authority as part of the SA&A process.

The successful contractor is responsible for providing pertinent security information to the

NCEH/ATSDR ISSO and Security Staff and assisting in completing the below CDC SA&A documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCEH/ATSDR Security Staff. Completed documents will be sent by the

NCEH/ATSDR Security Staff to the CDC Chief Information Security Officer (CISO) for review, approval and subsequent issuance of an Authority to Operate (ATO)

Baseline System Information (BSI)

Privacy Impact Assessment (PIA)

System Security Plan (SSP)

Business Continuity Plan (BCP)

Risk Assessment Report (RAR) http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf

Deliverable Table Systems external to CDC Systems internal and hosted on

CDC Network Infrastructure

BSI, PIA, SSP, BCP, RAR

(SA&A)

Completed Documents due to

NCEH/ATSDR ISSO 60 days prior to System Production date

Completed Documents Due to

CDC Chief Information Security

Office 45 days prior to production date

Recertification (required every 3 years or when significant change occurs)

Completed Documents due to

NCEH/ATSDR ISSO 60 days prior to System Production date

Completed Documents Due to

CDC Chief Information Security

Office 45 days prior to production date

Annual Assessment/Business

Continuity Plan (BCP)

Completed Documents due to

NCEH/ATSDR ISSO 60 days prior to last system annual assessment completion date

Completed Documents Due to

CDC Chief Information Security

Office 45 days prior to last annual assessment completion date

Non-Significant Change

Requests (OS or application version change, change in data variables)

Completed documentation due to

NCEH/ATSDR ISSO for signature prior to change implementation

Completed documentation due to

OCISO for approval prior to change implementation

The Contractor shall respond to the following seven security–associated requirements in the application:

(1) Position Sensitivity Designations

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI).

Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum

Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-contractor staff) working under the contract that will have the ability to access NCEH/ATSDR sensitive information from the system. .

Non-Disclosure Agreements

The Contractor and any sub-Contractors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Contractor's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact

Assessment (PIA) as defined by Section 208 of the FISMA 2014. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and contractor, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Contractor’s Official Responsible for Information Security

The contractor shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the contractor be selected for an award.

(4) Rules of Behavior

The contractor’s employees and subcontractors shall comply with the HHS Information Technology

General Rules of Behavior.

(5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful contractor shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the

Contractor's expense and would be the Contractor's responsibility to plan and arrange. The successful contractor shall maintain a listing of all individuals who have completed this training and shall submit this listing to the project officer.

(6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential

Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all vendors providing hardware and software to the federal government are now required to ensure that these PIV cards will integrate with their software and hardware at the application level.

Contractor must be able to implement and support PIV card integration.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transferred data files that contain CDC- data shall have full-disk encryption using FIPS 140-2 compliant algorithms.

SECTION 508 OF THE REHABILITATION ACT (29 USC 794d)

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce

Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board

Electronic and Information (EIT) Accessibility Provisions (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit:

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility provisions. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of

Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this solicitation are identified in the Statement of

Work/Specification/Performance Work Statement. In order to facilitate the Government’s evaluation to determine whether EIT products and services proposed meet applicable Section

508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment

Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific Section 508 standard.

Instructions for preparing the HHS Section 508 Product Assessment Template may be found at http://508.hhs.gov.

Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to

Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards in its completed HHS Section 508 Product Assessment Template, and it is later determined by the

Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility in the Product Assessment Template, remediation of the products and/or services to the level of conformance specified in the vendor’s Product

Assessment Template will be the responsibility of the contractor at its expense.

The applicable provisions of this solicitation are: 1194.21, .22, .24, .31, and .41.

C.7 GOVERNMENT FURNISHED PROPERTY

In task orders where the place of performance will be at the Government’s facility, the government will provide the required workspace and equipment. Any additional government property to be furnished will be specified in each task order.

C.8 REFERENCES

References, if applicable, will be provided at the task order level

C.9 CONTRACTOR QUALITY CONTROL

The Contractor, not the Government, is responsible for management and quality control actions to meet the terms as specified in the Task Order. The role of the Government is quality assurance to ensure the task order standards are met.

a. Quality Control Plan. The contractor shall establish and maintain a complete Quality Control

Plan to ensure the requirements as specified in the task order. Records of quality inspections shall be kept and made available to the Government throughout the performance period and for the period after task order completion until final settlement of any claims under the contract.

A description of the quality control inspection plan shall be provided as a part of the

Offeror’s task order technical proposal. The plan shall meet the following objectives: (1) control procedures for security of Government-provided items; (2) location of the inspection documents; (3) high quality personnel that meet CDC’s need for long term technical support;

(4) low turnover of long term technical support personnel; (5) corrective or preventive actions that will be taken to meet quality standards; and (6) a customer comments feedback system. The plan must be included as part of the contractor's proposal, and shall include, but is not limited to the following: type of QC inspections to be performed; areas to be inspected;

and the methods to be used to identify deficiencies in the quality of services performed before the level of performance becomes unsatisfactory. An updated QC plan if needed must be provided to the Contracting Officer on the task order start date and as changes occur.

The CDC will develop any specific performance measures related to individual task orders.

b. Government Review. The Government will review the Contractor Quality Control Plan to determine if it is adequate. If the plan is adequate, the Government will accept the plan. If the plan is not adequate as submitted, the deficiencies will be identified to the contractor in writing. The contractor shall correct all identified deficiencies and submit a corrected

Contractor Quality Control Plan within ten working days or task order start date, whichever is sooner.

Section D - Packaging And Marking

D.1 Packaging, Packing, Marking, and Shipping

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

Section E - Inspection And Acceptance

E.1 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the address below:

http://farsite.hill.af.mil/

(End of Clause)

FAR SOURCE TITLE AND DATE

52.246-1 Contractor Inspection Requirements (Apr 1984)

52.246-2 Inspection of Supplies - Fixed-Price (Aug 1996)

52.246-4 Inspection of Services - Fixed-Price (Aug 1996)

52.246-6 Time and Materials/Labor Hour (May 2001)

E.2 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Contracting Officer’s Representative) at the destination of the articles, services or documentation.

E.3 Quality Assurance Surveillance Plan (QASP)

The QASP will be used to ensure that systematic quality assurance methods are used in the administration of the Performance-Based Service Contract (PBSC) standards included in this contract. The QASP will be defined at the task order level.

The contractor is responsible for management and quality control actions necessary to meet the quality standards set forth in the task order. The Performance Standards and Surveillance

Activity Checks defined in the QASP at the task order level shall be used by the COR in the technical administration of the QASP.

Section F - Deliveries Or Performance

F.1 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the address below:

http://farsite.hill.af.mil/

FAR SOURCE TITLE AND DATE

52.242-15 Stop-Work Order (Aug 1989)

52.242.17 Government Delay of Work (Apr 1984)

52.247-34 F.O.B. Destination (Nov 1991)

F.2 Deliverable(s) Schedule (Jul 1999)

The Contractor shall deliver to the Contracting Officer's Representative (COR), Contract Specialist and the Contracting Officer any reports or deliverables as may be specified in the individual task orders within the time frames specified.

F.3 Period of Performance (Contract and Task Orders) (Jul 1999)

(a) Contract: This is an Indefinite Delivery Indefinite Quantity (IDIQ) contract for a period of five (5) years. This contract includes services which will be ordered as the requirements arise subject to the availability of funds. Performance of this contract shall begin on July 1, 2017 and shall not extend beyond the estimated completion date of June 30, 2022.

(b) Task Orders: Task orders may include options to be exercised at the discretion of the Government.

The time for completion for each task order shall be determined under each individual task order through the mutual agreement of the parties involved. Task orders under this contract may be awarded by the

Contracting Officer at any time within the contract period. The actual performance of the work may extend beyond the contract period.

F.4 Place(s) of Performance (Jul 1999)

The Contractor shall perform all work under this contract as determined by individual task orders in accordance with the Performance Work Statement.

F.5 Performance Standards

a) Evaluation of the Contractor's performance in accordance with the performance requirements set forth in task orders will be conducted annually and jointly by the COR and the Contracting

Officer, and shall form the basis of the Contractor's permanent performance record with regard to each task order.

b) Electronic Access to Contractor Performance Evaluations Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov

Section G - Contract Administration Data

G.1 Contracting Officer Representative

Performance of the work hereunder shall be subject to the technical directions of the designated

Contr…