Solicitation_2017-N-18107_Amend0002_25January2018.pdf

PAGES

15A. NAME

AND

ADDRESS

OF

OFFEROR

SEC. PAGE(S) SEC. PAGE(S)

(Date) (Hour)

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amend-ments to the SOLICITATION for offerors and related documents numbered and dated:

(Type or Print)

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

1 92

2. CONTRACT NO.

3. SOLICITATION NO.

2017-N-18107

AMENDMENT 0002

4. TYPE OF SOLICITATION

SEALED BID (IFB)

X NEGOTIATED (RFP)

5. DATE ISSUED

Amendment 0002

1/25/2018

6. REQUISITION/PURCHASE

NO.

000HJAAM-2018-06670

7. ISSUED BY CODE 2543 8. ADDRESS OFFER TO (If other than Item 7)

Centers for Disease Control and Prevention

Office of Acquisition Services (OAS)

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 6 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in Section L, L.9 until 2:00pm local time 02/09/2018

CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Sherrie A. Blackmon

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770)488-2925

C. E-MAIL ADDRESS

kuj1@cdc.gov

11. TABLE OF CONTENTS

(x) DESCRIPTION (x) DESCRIPTION

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 54

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 5 X J LIST OF ATTACHMENTS 62

X D PACKAGING AND MARKING 17 PART IV – REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 18 REPRESENTATIONS, CERTIFICATIONS, AND

X F DELIVERIES OR PERFORMANCE 19 X K OTHER STATEMENTS OF OFFERORS 63

X G CONTRACT ADMINISTRATION DATA 20 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 71

X H SPECIAL CONTRACT REQUIREMENTS 27 X M EVALUATION FACTORS FOR AWARD 84

OFFER (Must be fully completed by offeror) NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (120 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

AMENDMENT NO. DATE AMENDMENT NO. DATE

CODE FACILITY 16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 2543 25. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention

Office of Acquisition Services (OAS)

2920 Brandywine Rd, RM 3000

Atlanta, GA 30341-5539

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE Prescribed by GSA

FAR (48 CFR) 53.214©

K

2017-N-18107 Amendment 0002

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ITEM SUPPLIES / SERVICES QTY /

UNIT

UNIT

PRICE

EXTENDED

PRICE

0001 Professional Technical Assistance Support Services for the project entitled, “Public Health Support Services for ATSDR Public Health Assessment Activities” as outlined in the Performance Work Statement (PWS) and specifically ordered through individual task orders.

Estimated Period of Performance:

06/11/2018-06/10/2023

1 Job Not Separately

Priced

(NSP)

NSP

The Ceiling price for this contract is $20,000,000.00.

B.1 Purpose The purpose of this contract is to provide services that fall within the scope of the work specified in Section C for the project entitled, “Public Health Support Services for the Agency for Toxic

Substances and Disease Registry (ATSDR) Public Health Assessment Activities.” The Contracting Officer (CO) will request the work through the issuance of task orders during the ordering period as specified in Section F of the contract.

B.2 Contract Type and Services This is a ‘Full and Open’ competitive procurement. This acquisition is being competed in accordance with FAR Part 15 - Contracting by Negotiation. The NAICS Code is 541990, All Other Professional, Scientific and Technical Services, with a business size standard of $15.0 million.

This is an Indefinite- Delivery Indefinite- Quantity contract (IDIQ) utilizing individual task orders to provide technical assistance services. The Government will issue task orders that are Fixed-Price (FP) or Time-and-Materials/Labor Hours (T&M/LH).

Obligation of funds will be done by the issuance of individual task orders by the Contracting Officer in accordance with the clause titled “Award of Task Orders” in Section H and FAR clause 52.216-18 titled “Ordering” in Section I. The Contractor shall not exceed the amount negotiated for each individual task order without prior written approval of the Contracting Officer.

In addition, the Contractor shall not commence work until a task order or other written notification for a specific assignment is issued by the Contracting Officer. Only a CDC Contracting Officer is authorized to issue a task order request to the Contractor or issue finalized task orders under this contract. The Government is not obligated to reimburse the Contractor for any costs that it incurs before issuance of a task order or other written notification by the Contracting Officer.

The intent is to issue one task order (see Attachments J6 and Section L herein) upon award of this IDIQ. The task order will be issued with a specific performance period.

B.3 Performance-Based Preference Pursuant to FAR 37.102(a) (1), the Contracting Officer will use performance-based acquisition methods to the maximum extent practicable. The government anticipates multiple awards.

B.4 Minimum and Maximum Ordering Amounts Minimum Single Order Amount: $5,000.00

Maximum Single Order Amount: $4,000,000.00

Combination Order Amount: $10,000,000.00

The ceiling price for this contract (i.e. cumulative value of all task orders) is $20,000,000.

B.5 Minimum Guarantee This contract guarantees that task order(s) amounting to a minimum of five thousand dollars ($5,000) will be issued during the first 12 months of the contract period of performance. In the event the contractor receives obligations of less than this minimum, during the first 12 months, the Government will fund the difference between the actual obligation and the guaranteed minimum. Once a task order is issued for $5,000 or more in the first 12 months of the period of performance, the government has satisfied its minimum guarantee.

B.6 Maximum Contract Value The aggregate maximum value of all combined awards made under this solicitation shall not exceed $20,000,000.00. If the Government's requirements for services set forth in the solicitation do not result in orders in the amounts described as “maximum," the event shall not constitute the basis for an equitable price adjustment under this contract.

B.7 Task Order Pricing Task orders issued under this contract may be Fixed-Price, or Time-and-Materials/Labor Hours.

B.7.1 Firm Fixed Price (FFP) Pursuant to FAR 15.4, Pricing, and FAR 16.2, Fixed-Price Contracts, the Firm-Fixed Price for each task order will be negotiated based on the price to complete the work.

After acceptance of a fixed price task order by the Contractor, the task order price will only be adjusted to reflect changes in scope or conditions.

B.7.2 Time and Materials/Labor-Hour (T&M/LH) The basic contract shall provide loaded hourly labor rates for T&M and LH type orders.

When labor-hour or T&M type task orders are used, the fair and reasonable pricing will be determined in accordance with FAR 15.4, Pricing, and FAR 16.601, Time and Materials Contracts.

B.8 Travel Pricing Travel will be reimbursed at actual cost in accordance with the limitations set forth in FAR 31.205-46. Profit shall not be applied to travel costs. Contractors may apply G&A to travel in accordance with the Contractor’s usual accounting practices consistent with FAR 31.2. Travel expenses may be identified under a separate CLIN which will be a cost reimbursable CLIN on the specific task order.

B.9 Place of Work and Government-Furnished Equipment Work under the contract may be performed on-site at CDC locations in Atlanta, Georgia OR may be conducted off-site at Contractor locations. On-site meetings with CDC staff may be required.

Each task order will specify the location requirements.

If the work is to be performed primarily on-site at a CDC location, due to the nature of the work, CDC will provide IT equipment (i.e., desktop computer), telephone, and other office equipment and supplies as needed for the Contractor to perform required tasks.

If the work is to be performed primarily off-site at the Contractor’s locations, where the Contractor needs to access CDC’s network, the CDC will not provide IT equipment. The computers used by Contractor personnel shall meet CDC’s standard software and security configuration before logging onto CDC’s network.

B.10 Non-Personal Services Contract Statement This is a non-personal services contract as defined in Federal Acquisition Regulation (FAR)

37.101. The Government will evaluate the quality of support services provided but the Contractor retains control over its employees or agents. The Contractor is solely responsible and liable for and expressly agrees to indemnify the Government with respect to any liability producing acts or omissions by it or by its employees.

B.11 Service Contract Act The Public Health Assessment contract labor categories are considered professional labor and is generally exempt from the Service Contract Act. However, each task order will be reviewed for applicability.

B.12. Contract Structure The basic contract will establish the general scope and ordering period for task orders to be issued against this contract. The term of this IDIQ contract is 60 months. It is anticipated that multiple task orders will be issued to the contractors to work on areas identified in the Scope of Work. Each task order shall have a discrete period of performance independent of the basic contract and no task order shall extend more than twelve (12) months beyond the expiration date of the basic contract.

Individual task orders exceeding $3,500 will be competed in accordance with the fair opportunity process described in FAR 16.505(b)(1) unless an exception to fair opportunity is documented in accordance with FAR 16.505(b)(2). All tasks orders will be solicited by email. Contractors will have a minimum of 14 days to respond.

SECTION C – DESCRIPTION/SPECIFICATION/WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Title of Project: Public Health Support Services for ATSDR Public Health Assessment Activities

C.1 Background and Need

This procurement is entitled "Public Health Support Services for ATSDR Public Health Assessment Activities". The Agency for Toxic Substances and Disease Registry (ATSDR) was created under Sections 104, 107, and 120 of the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) as amended by Section 110 (P.L. 99-499) of the Superfund Amendments and Reauthorization Act of 1986 (SARA). ATSDR was created to implement the health-related sections of CERCLA as amended by SARA.

The mission of ATSDR requires a broad spectrum of public health evaluations including environmental assessment, surveillance, and epidemiologic activities related to preventing or mitigating adverse health outcomes related to hazardous waste and industrial release exposure. As part of its mission, ATSDR is authorized to conduct public health assessment activities such as, but not limited to, public health studies, public health assessments and consultations, technical assistance, quick response evaluations, exposure investigations, biomonitoring activities, environmental and biological modeling, sampling, and monitoring, exposure dose modeling, historic dose reconstruction, emergency response, and related outreach and education activities.

Sites/projects for such assessments, consultations, and/or other public health activities are usually, but not always, facilities on the National Priorities List (NPL) established by EPA, Congressional requests, sites/projects where the ATSDR has been petitioned as a result of a hazardous/industrial substance release, site/projects at which activities have been requested by Tribal Nations and/or other federal, state and local government agencies, and/or other types of hazardous waste or industrial release sites or projects. The mission of ATSDR requires engagement in most, and at times all, of these activities to some extent every year.

The scientific, technical, expert public health assessment activities of ATSDR are often far-reaching, long-term, and require resources outside the capacity of ATSDR employees.

To supplement ATSDR’s capacities in specific areas of function and/or expertise, ATSDR will procure contract services to support its mission and goals.

C.2 Project Objective

The purpose of this indefinite delivery, indefinite quantity (IDIQ)contract is to facilitate the procurement of regularly and repeatedly scientific, technical, expert, and logistical services

(e.g. outreach and education services) for ATSDR in support of its public health mission with regards to public health assessment activities such as, but not limited to, public health assessments, public health consultations, exposure investigations, biomonitoring activities, health studies, training, and related outreach, education, and evaluation activities.

C.3 Scope of Work

The unique nature, scope, and complexity of the scientific, technical, expert, operational, and logistical services needed to support ATSDR’s public health assessment activities will vary from site to site and project to project. Some public health assessment activities may be completed within 12 months whereas other public health assessment activities may require several years to complete. Project/site support may include, but not be limited to, the following activities: data gathering, evaluation, analysis, interpretation, and dissemination, environmental and biological sampling and monitoring and evaluation, data quality control and assurance, analysis, consultation, report preparation, training, and general and public logistical coordination.

Areas of expertise needed to supplement existing agency efforts are classified in the "Statement of Work" as "Expert and Scientific Assistance,” "Technical Assistance" and “Training” and may include, but not be limited to, such diverse skills and expertise in the following areas: demographics, computer programming for public health assessment purposes, instructional design/technology, graphic design/artistry, statistics, mathematics, environmental and biological modeling, geographic information systems technology, medicine, physiology, engineering (chemical, environmental, industrial, process, mechanical), ecology, geology, hydro-geology, chemistry, health physics, biology, epidemiology, toxicology, environmental science, laboratory science, veterinary science, environmental and biological sampling/monitoring, biomonitoring, meteorology, economics, nutrition, soil science, health education, health risk communication, training, research, program evaluation and decision making, public relations, writing and editing, case study development, distance learning applications, web-delivered health assessment training, conference planning, and administration and clerical.

C.4 Technical Requirements

Independently, and not as an agent of the Government, the Contractor shall furnish all qualified and acceptable personnel to perform the tasks identified in the Performance Work Statement (PWS).

All activities, work products, reports, and deliverables developed/performed/conducted by the Contractor on behalf of ATSDR shall be subject to review and approval by ATSDR.

Any communication on be-half of ATSDR by the Contractor with non-ATSDR individuals, organizations, groups, companies, or agencies must have prior approval by ATSDR.

Within the three general areas of support, the Contractor may be required to perform the types of tasks listed below. Performance of all areas of support and tasks may be required concurrently on multiple projects, sites, and tasks. Contractor personnel may be required to travel to accomplish project/site activities. Although the successful Contractor will be expected to provide all services listed in the SOW, it is not expected that the successful Contractor(s) will have the capabilities to perform all of the required services included in the scope of work for this acquisition. Therefore, the Government anticipates that subcontracting for some limited services (e.g. laboratory services, expert panel members, highly specialized expertise) may be necessary.

Task Area 1: Expert and Scientific Assistance

The following are the core components that may be requested by the Government for the Contractor to undertake in performance of scientific and expert assistance:

1. Analyze, interpret, and evaluate environmental, biological, chemical, radiological, and health data, selecting and using the best science, techniques, and standards most appropriate to the problem at hand.

2. Assist ATSDR in development of standard operating procedures and guidance materials.

3. Assist ATSDR in the development of public health assessments, public health consultations, exposure investigations, outreach and education products, technical assists, technical/scientific reports, environmental/biological/biomonitoring modeling and public health assessment activities, and all other ATSDR public health assessment activities.

4. Generate estimates of the number of individuals in the populations at risk of exposure, as well as actually being exposed to site-related contaminants.

5. Design and evaluate sampling/monitoring plans, protocols, manuals, and conduct environmental and biological sampling for contaminants of concern (exposure investigations and biomonitoring activities).

6. Evaluate and interpret toxicological information and literature to assess adverse health outcomes resulting from exposure to toxic substances. Follow current analytical or interpretive methods, as described by ATSDR’s Public Health Assessment Guidance Manual while using the Public Health Assessment Site Tool (PHAST), or as directed by ATSDR.

7. Provide epidemiologic support for analysis of health outcome data (cancer registries, etc). Consult with and advise ATSDR on design and analysis of studies and investigations to determine potential associations between toxic exposures and adverse health outcomes (planning through execution and evaluation).

8. Design, execute, and evaluate outreach and education activities in communities that will inform all appropriate parties about the health risks from exposure to hazardous/industrial release substances and provide preventive actions.

9. Provide expert statistical, modeling, evaluation, and interpretation support for evaluation of data and methodology.

10. Provide national and international experts versed in tasks listed in this statement of work.

11. Assist in organizing and hosting expert panel discussions on specific topics and compile results of discussions.

Task Area 2: Technical Assistance

Contractor-required technical assistance may be in the form of select data gathering, analyzing, evaluating, interpreting, reporting, disseminating, and processing in accordance with ATSDR's requirements.

More specifically, within the area of "technical assistance" the Contractor may be required to:

1. Obtain site-specific data and information (preferably electronic media format) on relevant sites. Identify appropriate sources of environmental health data for specific projects such as, sources of environmental data maintained by State and Federal agencies; and identify means of acquiring these data. Assist ATSDR staff in using, evaluating, analyzing, summarizing, reporting, disseminating, and presenting these data in agency draft and final reports.

Assist ATSDR in report, document, and briefing development.

2. Conduct environmental and/or biologic sampling, monitoring, biomonitoring, and exposure investigations for sites and projects. Provide technical assistance, advice, and expertise on sites/projects that may present unusual and/or unique sampling and/or monitoring challenges. Assist ATSDR in protocol design, development, and method selection. Assist ATSDR in conducting, collecting, staffing, using, evaluating, analyzing, reporting, and presenting information in agency draft, final, and other reports. Provide equipment and supplies, maintenance, storage, housing, and back-up capacities needed to support these activities.

3. Provide environmental, biologic, and biomonitoring laboratory services.

Assist ATSDR staff in collecting, using, evaluating, interpreting, analyzing, reporting, and presenting these data in agency draft and final reports. Provide analyses, equipment and supplies, and expertise needed to support these activities.

4. Design, develop, implement, maintain, and evaluate environmental, administrative, and/or health databases for specific projects in terms of data quality, time frames, environmental, administrative, and/or public health factors using established guidelines.

5. Conduct surveys (e.g., fish consumption, well locations and use, health education needs and understanding).

6. Design, develop, and produce data collection forms, including abstract forms, survey instruments, and questionnaires, needed for surveillance and epidemiologic and other public health assessment activities.

7 Coordinate and facilitate the preparation of documents for quality professional presentation including, review, editing, desktop publishing, and preparation of camera ready originals.

8. Develop curricula and other materials for health professional education and public health education and outreach.

9. Develop and disseminate general and site/project-specific fact sheets and informational material for communities surrounding hazardous waste and/or industrial release sites.

10. Conduct impact assessments, needs assessments, program evaluations, and other instruments for program enhancement and evaluation purposes.

11. Maintain, develop, and evaluate databases of products, services, cost recovery data, Sequoia data, environmental data, training data, and other data for time studies, cost effectiveness and program/research evaluation purposes, quality review efforts, and training review efforts.

12. Provide national and international experts versed in tasks listed in this section.

Assist in organizing and hosting expert panel discussions on specific topics and compile results of discussions.

Task Area 3: Training

1. Develop and assist with on-site and distance learning and training materials and programs.

2. Conduct public health and technical training.

3. Develop and deliver web-based training applications and other distance learning applications

C.5 Reporting Schedule

In addition to specific reporting requirements defined in each Task Order issued, the Contractor shall furnish monthly progress reports detailing current status of each Task Order under the IDIQ. The report shall be narrative in form and shall include summary of progress towards completion of each Task Order and any problems encountered to date, including the Contractor’s assessment of the specific impact of such problems on scheduled date of completion of milestones.

C.6 Special Requirements

Contractor Travel

The Contractor may be required to travel to accomplish project/site activities. All work projects, tasks and requests and associated costs that involve travel by Contractor personnel, including subcontractors and consultants, must be approved by the ATSDR COR before travel begins.

The Contractor shall comply with FAR 31.205-46 Travel Costs. Accordingly, travel costs shall not exceed the maximum per diem rates set forth in the Federal Travel Regulation (FTR) unless written approval is obtained from the Contracting Officer before incurring travel costs in accordance with FAR 31.205-46 procedures. The FTR per diem rates and regulations are available at the following web site:

http://www.gsa.gov/portal/category/100120

Unless the task order stipulates otherwise, travel will be included in a separate CLIN and will be cost reimbursable. Accordingly, the contractor shall submit receipts for airfare, lodging, car rentals, and other incidental expenses as applicable when submitting invoices which include travel costs.

IT Security

Standard for Security Configurations

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. Note: FDCC is applicable to all computing systems using Windows XPTM and Windows 7TM, including desktops and laptops—regardless of function—but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings—see http://nvd.nist.gov/validation.cfm. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Standard for Encryption Language

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered “sensitive” in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Security Requirements for Federal Information Technology Resources

(a) Applicability. This clause applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term “information technology (IT)”, as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their—

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)—due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107- 347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)—due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)—due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)—due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems—see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT- SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid.

Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in “HHS-Controlled Facilities and Information Systems Security” requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COTR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that—

(1) Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

(i) Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

(j) Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

(k) Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

Electronic and Information Technology Accessibility Notice

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.21, .22, .24, .31, and .41. The applicable standards may change per Task Order.

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

C.7 Government Furnished Property

Task Order Specific. The Government may at times provide for office space and use of Government property, software, and/or equipment, etc. as stipulated in specific Task Orders. The Contractor shall comply with CDC/ATSDR’s polices and guidelines that govern the relation between Government and Contract staff.

C.8 References

General: ATSDR webpage. https://www.atsdr.cdc.gov/ Task Orders will specify pertinent references.

C.9 Deliverables

Deliverables will vary with each Task Order and will usually include the reporting requirements listed in the reporting section.

C.10 Ownership Rights

All records, files, analyses, models, and documents developed under this contract shall be the property of the CDC.

C.11 Deliverables

Specific deliverables will be determined at the task order level. They will usually include a monthly progress report and final report describing the implementation and results of the task.

C.12 Quality Assurance Surveillance Plan (QASP)

The QASP will be used to ensure that systematic quality assurance methods are used in the administration of the Performance-Based Service Contract (PBSC) standards included in this contract. The QASP will be defined at the task order level.

The contractor is responsible for management and quality control actions necessary to meet the quality standards set forth in the task order. The Performance Standards and Surveillance Activity Checks defined in the QASP at the task order level shall be used by the COR in the technical administration of the QASP.

SECTION D - PACKAGING AND MARKING

Not Applicable

SECTION E - INSPECTION AND ACCEPTANCE

E.1 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the address below:

http://farsite.hill.af.mil/

(End of Clause)

FAR SOURCE TITLE AND DATE

52.246-1 Contractor Inspection Requirements (Apr 1984)

52.246-4 Inspection of Services - Fixed-Price (Aug 1996)

52.246-6 Time and Materials/Labor Hour (May 2001)

E.2 Inspection and Acceptance (Jul 1999)

Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Contracting Officer’s Representative) at the destination of the articles, services or documentation.

SECTION F - DELIVERIES OR PERFORMANCE

F.1 52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at the address below:

http://farsite.hill.af.mil/

FAR SOURCE TITLE AND DATE

52.242-15 Stop-Work Order (Aug 1989)

52.242.17 Government Delay of Work (Apr 1984)

F.2 Deliverable(s) Schedule (Jul 1999)

The Contractor shall deliver to the Contracting Officer's Representative (COR), Contract Specialist and the Contracting Officer any reports or deliverables as may be specified in the individual task orders within the time frames specified.

F.3 Period of Performance (Contract and Task Orders) (Jul 1999)

(a) Contract: The period of performance shall be sixty (60) months from the effective date of the contract. The anticipated period of performance is 06/11/2018 – 06/10/2023.

(b) Task Orders: Task orders may include options to be exercised at the discretion of the Government. The time for completion for each task order shall be determined under each individual task order through the mutual agreement of the parties involved. Task orders under this contract may be awarded by the Contracting Officer at any time within the contract period.

(End of Clause)

F.4 Place(s) of Performance (Jul 1999)

The Contractor shall perform all work under this contract as determined by individual task orders in accordance with the Performance Work Statement.

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

G.2 Contracting Officer’s Representative (COR) (Sep 2009)

Performance of the work hereunder shall be subject to the technical directions of the designated Contracting Officer Representative (COR) for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein.

These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof. In the event that the Contractor feels that full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer in a letter separate of any required report(s) within two (2) weeks of the date of receipt of the technical direction and no action shall be taken pursuant to the direction.