AviationData-Statement_2017-N-18118_3.7.17.docx

Statement of Work

Solicitation #: 200-2017-18118

Title: Global Aviation Data and Analytical Tools for Public Health Risk Assessment, Surveillance, Preparedness, and Emergency Response

Period of Performance: • April 1, 2017 – March 31, 2018 • Plus two options

SECTION 1 – BACKGROUND

Project(s), Programs or Activities Supported:

The Secretary of the Department of Health and Human Services (DHHS) has statutory responsibility for preventing the introduction, transmission, and spread of communicable diseases into the United States (42 U.S. Code § 264). The authority for carrying out these functions has been delegated to CDC's Division of Global Migration and Quarantine (DGMQ).

The increased speed and capacity of global aviation networks combined with increasing numbers of globally mobile populations, present greater potential for health risks to travelers and the communities to which they travel and return. Airline passengers have been shown to both spread communicable diseases and to be at risk of exposure to communicable diseases.

To reduce morbidity and mortality among immigrants, refugees, travelers, expatriates, and other globally mobile populations and to fulfill its responsibility to prevent and mitigate the spread of communicable diseases of public health concern, DGMQ must enhance its capacity to analyze and report global aviation patterns; this requires access to advanced global aviation intelligence data and analytical tools.

The need is immediate and ongoing for a single, secure, and web-based global aviation database and analytical application to support analysis of aviation global capacity and domestic and international passenger traffic (historical and future).

The aviation data will be used to support risk assessment, surveillance, preparedness, emergency response, and other public health activities. The data will be accessed in multiple ways to accomplish these goals. First, DGMQ staff will directly access aviation data via an online application supplied by the Contractor. Second, Contractor-supplied data will be used to support CDC geospatial analysis and visualization applications. These applications, which sit behind the CDC firewall or on US Government servers, are used by CDC staff to conduct geospatial analyses and data visualizations related to migration and public health. Some of these applications contain a travel module which will use the Contractor-supplied data in the form of a flat file.

In summary, the product shall include:

· Detailed worldwide airline schedule data with date range that extends at least from the prior five years prior to the next 12 months in an online query application that is accessible 24/7 and provided via flat files. Regular updates should be made available on a weekly basis for the online module and every six months for the flat files.

· Detailed worldwide historic air passenger data with a date range that extends at least from the prior five years and is updated monthly. The data should be available in an online query application that is accessible 24/7 and provided via flat files. Regular updates should be made available on a monthly basis for the online module and monthly for the flat files.

· Detailed US Department of Transportation, Origin and Destination (O&D; DB1B) and Onboard Data (T100) that is made available in an online query application that is accessible 24/7 and provided via flat files. Regular updates should be made available on a monthly or quarterly basis dependent on the dataset for the online query application as well as the flat files.

· Customer support – training, technical, DGMQ-dedicated customer service representative.

SECTION 2 – PURPOSE

DGMQ will use these data and tools to provide reports to US and international public health partners to support risk assessment, surveillance, preparedness, emergency response, and other public health activities. The information will be used to support the development of relevant research and may be included in presentations, posters and publications, including peer-reviewed journals. Specifically, the data will be used for (i) assisting governmental or nongovernmental organizations to prepare for and respond to future infectious disease outbreaks or pandemics; (ii) generating reports and presentations for project funders on global population mobility and its relationship to public health; (iii) generating presentations and articles for publication in academic journals, and (iv) developing DGMQ GIS applications and tools.

DGMQ will not publish sensitive airline industry data, such as revenue and market share information.

SECTION 3 – SCOPE OF WORK

The Contractor shall supply DGMQ with the product of global aviation data.

i. Data shall be provided via two formats:

· 6 concurrent-use licenses to have 24/7 access to data via a web-based analytical and visualization application.

· Regularly scheduled transfers of flat files. These shall be provided within 30 days of start date and updated dependent on the type of dataset.

SECTION 4 – TASKS TO BE PERFORMED

The Contractor shall ensure the regular, reliable and efficient production and delivery of global aviation data.

There are three primary tasks to be completed:

1. Aviation Schedules Data, Online Query Tool and Flat File

ii. Contractor will provide access to an online query application that has worldwide airline schedule data that is updated weekly and features access to schedules for the next 12 months and historic schedules dating back at least 5 years. Scheduled travel data should include : date, month, quarter, year, operating airline information, marketing airline, origin information, destination information, through points, equipment information, departure time and terminal, arrival time and terminal, service type, number of flights, seats, seats per flight, duration in block minutes, and total distance (miles). The application should also feature information about cargo flights and details about train and bus schedules when they are part of the scheduled routes.

iii. Contractor will provide a flat file of worldwide airline schedule data that is updated every 6 months with an option to receive weekly or monthly files in the event of an emergency. CDC would notify awardee of the start of the emergency and the need for more frequent data updates. Flat file features include access to schedules for the next 12 months and historic schedules dating back to the previous 12 months. Scheduled travel data should include: date, month, quarter, year, operating airline information, marketing airline, origin information, destination information, through points, equipment information, departure time and terminal, arrival time and terminal, service type, number of flights, seats, seats per flight, ASMs, duration in block minutes, and total distance (miles).

iv. Contractor will provide look up tables and data dictionaries for variables such as: airline codes, names, and alliance members; airline equipment types and seat counts; airport codes, names, and locations.

v. The contractor shall also supply customer support, which will include training, technical, DGMQ-dedicated customer service representative. DGMQ inquiries shall be responded to (full and satisfactory resolution or a specific plan for resolution with timelines included) within 24 hours via email or phone.

2. Aviation Historic Passenger Data, Online Query Tool and Flat File

i. Contractor will provide access to an online query application that has worldwide historic passenger data that is updated monthly and spans at least 5 years and contains no more than a 4 month delay from the time travel occurred. This shall include historical reports or estimates of the number of passengers from an origin to destination, including trip stops. Estimates may be based on statistical modelling or other methodology. Variables should include travel month, quarter, and year as well as operating airline information, marketing airline information. Additionally, trip origin information such as airline code, name, city, country, trip destination information, and trip stops should be included as well as the ability to see total passenger estimates, average fare, revenue, yield, RPMs, and distance.

ii. Contractor will provide a flat file of worldwide historic passenger data for the 5 years prior to award that is updated monthly. This shall include historical reports or estimates of the number of passengers from an origin to destination, including trip stops. Estimates may be based on statistical modelling or other methodology. Variables should include travel month, quarter, and year as well as operating airline information, marketing airline information. Additionally, trip origin information such as airline code, name, city, country, trip destination information, and trip stops should be included as well as the ability to see total passenger estimates, average fare, revenue, yield, RPMs, and distance.

iii. Contractor will provide look up tables and data dictionaries for variables such as: airline codes, names, and alliance members; airline equipment types and seat counts; airport codes, names, and locations.

iv. The contractor will provide a written description of the data, modeling and validation methods to help users interpret the strengths and limitations of the data and any conclusions based on the data.

· This description will be used to evaluate the quality of the data when selecting a contractor. The offeror shall include in this description the global coverage of the data. That is, what percentages of 1) all global scheduled flights and 2) all passenger itineraries are represented in the dataset? For each of these, what percent are reported verses modeled?

· Additionally, this description may also be shared or published with the data in the course of (i) assisting governmental or nongovernmental organizations to prepare for and respond to future infectious disease outbreaks or pandemics; (ii) generating reports and presentations for project funders on global population mobility and its relationship to public health; (iii) generating presentations and articles for publication in academic journals, and (iv) developing DGMQ mapping tools and applications.

v. The contractor shall also supply customer support, which will include training, technical, DGMQ-dedicated customer service representative. DGMQ inquiries shall be responded to (full and satisfactory resolution or a specific plan for resolution with timelines included) within 24 hours via email or phone.

3. US Department of Transportation, Origin and Destination Data (DB1B) and Onboard Data (T100), Online Query Tool and Flat Files

i. Contractor will provide access to an online query application that has US Department of Transportation (DOT) Origin and Destination (O&D) Data (DB1B) that is updated quarterly and US DOT Onboard Data (T100) that is updated monthly. Variables should include travel month or quarter, year as well as operating airline information, marketing airline information. Additionally, trip origin information such as airline code, name, city, country, trip destination information, and trip stops should be included as well as the ability to see total passenger estimates, average fare, revenue, yield, RPMs, and distance.

ii. Contractor will provide flat files of US Department of Transportation (DOT) Origin and Destination (O&D) Data (DB1B) that is updated quarterly and US DOT Onboard Data (T100) that is updated monthly.

· The US Department of Transportation O&D and T100 data should be provided in separate flat files.

iii. Contractor will provide look up tables and data dictionaries for variables such as: airline codes, names, and alliance members; airline equipment types and seat counts; airport codes, names, and locations.

iv. The Contractor will provide a written description of the data, modeling and validation methods to help users interpret the strengths and limitations of the data and any conclusions based on the data.

· Additionally, this description may also be shared or published with the data in the course of (i) assisting governmental or nongovernmental organizations to prepare for and respond to future infectious disease outbreaks or pandemics; (ii) generating reports and presentations for project funders on global population mobility and its relationship to public health; (iii) generating presentations and articles for publication in academic journals, and (iv) developing DGMQ mapping tools and applications.

v. The contractor shall also supply customer support, which will include training, technical, DGMQ-dedicated customer service representative. DGMQ inquiries shall be responded to (full and satisfactory resolution or a specific plan for resolution with timelines included) within 24 hours via email or phone.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

None associated with this procurement.

SECTION 6 – PERIOD OF PERFORMANCE

SECTION 7 – PLACE OF PERFORMANCE

Offsite.

SECTION 8 – DELIVERABLES/REPORTING SCHEDULE: Deliverables apply to all three tasks.

Milestones All required services must be achieved within agreed-upon schedule as specified in this task order and/or as agreed in the operations and managements plans.

Deliverables produced must contain complete and accurate information in the specified format and template. Briefings, meetings, and reviews must be performed according to the agreed upon schedule.

1. Performance Matrix

Observation and Analysis of delivered support services and deliverables.

Monthly status report.

Favorable or Unfavorable Performance Evaluation

Exercise of the option

As applicable, stage gate reviews, OAs, weekly and monthly project reviews must include an inventory of project documents and report deliverables.

The inventory must be reviewed, tallied, and compared with EPLC deliverable requirements, the Project Process Agreement specific to each project. Review of a project’s baseline versus the actual results must occur at the conclusion of a project. Random review of documents and deliverables for accuracy and completeness Favorable or Unfavorable Performance Evaluation

Exercise of the option

2. Severable or Non-Severable Contract [Identify if Contract requirements are Severable or Non-Severable]

a. This is a Severable Type Contract : [ X ]

b. This Is a Non-Severable Type Contract : [ ]

SECTION 9 – TRAVEL

There is no travel associated with this procurement.

SECTION 10 – SPECIAL REQUIREMENTS

10. 1 Homeland Security Presidential Directive (HPSD-12) Requirements

(a) To perform the work specified herein, contractor personnel are expected to have routine 1) physical access to an HHS-controlled facility; 2) logical access to an HHS controlled information systems; or 3) access to sensitive HHS data or information, whether in an HHS controlled information system or in hard copy. This contract/order will entail the following position sensitivity level(s): non-sensitive.

(b) To gain routine physical access to an HHS facility, logical access to an HHS controlled information system, and or access to sensitive data or information, the contractor and its employees shall comply with Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-05-24); Federal Information Processing Standards Publication Number 201; and with the personal identity verification and investigation procedures contained in the following documents:

(1) HHS Information Security Program Policy

(2) HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook, dated February 1, 2005

(3) CDC Policy: “ISSUANCE AND UTILIZATION OF PIV CREDENTIALS”

(4) CDC Policy: "IN- AND OUT-PROCESSING OF CDC FTEs, PSCs, CONTRACTORS, AND OTHER NON-FTEs"

(5) CDC Policy: "PHYSICAL ACCESS TO CDC FACILITIES"

(6) CDC Policy: “NATIONAL AGENCY CHECK AND INQUIRY PROCEDURES”

(c) The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (with fingerprinting). More restricted positions, above non-sensitive, require more extensive documentation and investigation. The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

(d) Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays--see FAR 52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

(e) Multiple investigations for the same position may, at the Contracting Officer’s discretion, justify reduction(s) in the contract price of no more than the cost of the extra investigation(s).

(f) Language similar to this Security section shall be included in any subcontracts which require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; or (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; access to an information system, access to sensitive data, regular or prolonged access to an HHS-controlled facility.

(g) Inquiries on matters that affect contract compliance or terms and conditions should be directed to the Contracting Officer or designee.

(h) Within seven (7) calendar days after final acceptance of the work specified herein, the contractor shall return all identification badges in accordance with CDC's Policy titled "In- And Out-Processing of CDC FTEs, PSCs, Contractors, and Other Non-FTEs Policy". Contractor employees who separate from service under the contract prior to final acceptance shall be out processed in accordance with that same policy.

10.2 Non-Disclosure Agreement for Contractor and Contractor Employees

1. The contractor shall prepare and submit a Non-Disclosure Agreement (NDA) to the Contracting Officer prior to access of government information or the commencement of work at CDC.

1. The NDA made part of this clause, Exhibit I and II , is required in service contracts where positions and/or functions proposed to be filled by contractor’s employees will have access to non-public and procurement-sensitive information. The NDA also requires contractor’s employees properly identify themselves as employees of a contractor when communicating or interacting with CDC employees, employees of other governmental entities (when communication or interaction relates to the contractor’s work with the CDC), and members of the public. The Federal Acquisition Regulation (FAR) 37.114 (c), states “All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public or Congress that they are Government officials, unless, in the judgment of the agency, no harm can come from failing to identify themselves. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.”

1. The Contractor shall inform employees of the identification requirements by which they must abide and monitor employee compliance with the identification requirements.

1. During the contract performance period, the Contractor is responsible to ensure that all additional or replacement contractors’ employees sign a NDA and it is submitted to the Contracting Officer prior to commencement of their work with the CDC.

1. Contractor employees in designated positions or functions that have not signed the appropriate NDA shall not have access to any non-public, procurement sensitive information or participate in government meeting where sensitive information may be discussed.

1. The Contractor shall prepare and maintain a current list of employees working under NDAs and submit to the Contracting Officer upon request during the contract period of performance. The list should at a minimum include: contract number, employee’s name, position, date of hire and NDA requirement.

EXHIBIT I

Centers for Disease Control and Prevention (CDC) Contractor Non-Disclosure Agreement

I. Non-public Information

[Name of contractor] understands that in order to fulfill the responsibilities pursuant to [Contract name and number] between the Centers for Disease Control and Prevention and [Name of CDC contractor] dated [date], employees of [contractor] will have access to non-public information, including confidential and privileged information contained in government-owned information technology systems. For purposes of this agreement, confidential information means government information that is not or will not be generally available to the public. Privileged information means information which cannot be disclosed without the prior written consent of the CDC.

In order to properly safeguard non-public information, [contractor] agrees to ensure that prior to being granted access to government information or the commencement of work for the CDC, whichever is applicable, all employees will sign a Non-Disclosure Agreement (NDA) provided by the CDC prior to beginning work for the CDC. Contractor agrees to submit to the contracting official the original signed copies of NDAs signed by the contractor’s employees in accordance with the instructions provided by the contracting official. Failure to provide signed NDAs in accordance with this agreement and instructions provided by the contracting official could delay or prevent the employee from commencing or continuing work at the CDC until such agreement is signed and returned to the contracting official.

Contractor further agrees that it will not cause or encourage any employee to disclose, publish, divulge, release, or make known in any manner or to any extent, to any individual other than an authorized Government employee any non-public information that the employee may obtain in connection with the performance of the employee’s responsibilities to the CDC.

II. Procurement-Sensitive Information

Contractor further agrees that it will not cause or encourage any employee to disclose, publish, divulge, release, or make known in any manner or to any extent, to any individual, other than an authorized Government employee, any procurement-sensitive information gained while in connection with fulfilling the employee’s responsibilities at the CDC. For purposes of this agreement, procurement-sensitive information includes, but is not limited to, all information in Statements of Work (SOW), Requests for Contract (RFC), and Requests for Proposal (RFP); Responses to RFPs, including questions from potential offerors; non-public information regarding procurements; all documents, conversations, discussions, data, correspondence, electronic mail (e-mail), presentations, or any other written or verbal communications relating to, concerning, or affecting proposed or pending solicitations or awards; procurement data; contract information plans; strategies; source selection information and documentation; offerors’ identities; technical and cost data; the identity of government personal involved in the solicitation; the schedule of key technical and procurement events in the award determination process; and any other information that may provide an unfair competitive advantage to a contractor or potential contractor if improperly disclosed to them, or any of their employees.

Contractor understands and agrees that employee access to any procurement-sensitive information may create a conflict of interest which will preclude contractor from becoming a competitor for any acquisition(s) resulting from this information. Therefore, if an employee participates in any discussions relating to procurement-sensitive information, assists in developing any procurement-sensitive information, or otherwise obtains any procurement-sensitive information during the course of performing duties at the CDC, contractor understands and agrees that contractor are be excluded from competing for any acquisition(s) resulting from this information.

III. Identification of Non-Government Employees

Contractor understands that its employees are not agents of the Government. Therefore, unless otherwise directed in writing by the CDC, contractor agrees to assist and monitor employee compliance with the following identification procedures:

A. At the beginning of interactions with CDC employees, employees of other governmental entities, members of the public, or the media (when such communication or interaction relates to the contractor’s work with the CDC), contractors’ employees will identify themselves as an employee of a contractor.

B. Contractors’ employees will include the following disclosures in all written communications, including outgoing electronic mail (e-mail) messages, in connection with contractual duties to the CDC:

Employee’s name Name of contractor Center or office affiliation Centers for Disease Control and Prevention C. At the beginning of telephone conversations or conference calls, contractors’ employees will identify themselves as an employee of a contractor.

D. Contractors should not wear any CDC logo on clothing, except for a CDC issued security badge while carrying out work for CDC or on CDC premises. The only other exception is when a CDC management official has granted permission to use the CDC logo.

E. Contractors’ employees will program CDC voice mail message to identify themselves as an employee of a contractor.

I understand that federal laws including, 18 U.S.C. 641 and 18 U.S.C. 2071, provide criminal penalties for, among other things, unlawfully removing, destroying or converting to personal use, or use of another, any public records. Contractor acknowledges that contractor has read and fully understands this agreement.

Name of contractor: ___________________________________

Signature of Authorized Representative of Contractor:_________________________________

Date:________________

Copies retained by: contracting official and contractor

EXHIBIT II

Centers for Disease Control and Prevention (CDC) Contractors’ Employee Non-Disclosure Agreement I. Non-Public Information

I understand that in order to fulfill my responsibilities as an employee of [Name of CDC contractor], I will have access to non-public information, including confidential and privileged information contained in government-owned information technology systems. For purposes of this agreement, confidential information means government information that is not or will not be generally available to the public. Privileged information means information which cannot be disclosed without the prior written consent of the CDC.

I [Name of Employee], agree to use non-public information only in performance of my responsibilities to the CDC. I agree further that I will not disclose, publish, divulge, release, or make known in any manner or to any extent, to any individual other than an authorized Government employee, any non-public information that I may obtain in connection with the performance of my responsibilities to the CDC.

II. Procurement-Sensitive Information

I further agree that unless I have prior written permission from the CDC, I will not disclose, publish, divulge, release, or make known in any manner or to any extent, to any individual other than an authorized Government employee, any procurement-sensitive information gained in connection with the performance of my responsibilities to the CDC. I specifically agree not to disclose any non-public, procurement-sensitive information to employees of my company or any other organization unless so authorized in writing by the CDC. For purposes of this agreement, procurement-sensitive information includes, but is not limited to, all information in Statements of Work (SOW), Requests for Contract (RFC), and Requests for Proposal (RFP); Responses to RFPs, including questions from potential offerors; non-public information regarding procurements; all documents, conversations, discussions, data, correspondence, electronic mail (e-mail), presentations, or any other written or verbal communications relating to, concerning, or affecting proposed or pending solicitations or awards; procurement data; contract information plans; strategies; source selection information and documentation; offerors’ identities; technical and cost data; the identity of government personal involved in the acquisition; the schedule of key technical and procurement events in the award determination process; and any other information that may provide an unfair competitive advantage to a contractor or potential contractor if improperly disclosed to them, or any of their employees.

I understand and agree that my access to any procurement-sensitive information may create a conflict of interest which will preclude me, my current employer, or a future employer from becoming a competitor for any resulting government acquisition derived from this information. Therefore, if I participate in any discussions relating to procurement-sensitive information, assist in developing any procurement-sensitive information, or otherwise obtain any procurement-sensitive information during the course of performing my duties at the CDC, I understand and agree that I, my current employer, and any future employer(s) are excluded from competing for any resulting acquisitions.

III. Special Non-Disclosure Clause for Contractors with Access to CDC Grants Management and Procurement-Related Information Technology Systems

In addition to complying with the non-disclosure requirements and safeguards stated above, I understand that my authorization to use CDC’s grants management and procurement systems is strictly limited to the access and functions necessary for the performance of my responsibilities to the CDC and which have been approved in advance by the CDC. I understand that I am not authorized to enter procurement requests for any requirements pertaining to contracts or subcontracts held by me or my employer.

IV. Identification as a Non-Government Employee

I understand that as an employee of a government contractor, I represent an independent organization and I am not an agent of the Government. Therefore, I agree that unless I have prior written authorization from the CDC, I will, at the beginning of interactions with CDC employees, employees of other governmental entities, members of the public, or the media (when such communication or interaction relates to the contractor’s work with the CDC), identify myself as an employee of a contractor. I further agree to use the following identification procedures in connection with my work at the CDC:

A. I will include the following disclosures in all written communications, including outgoing electronic mail (e-mail) messages:

Employee’s name Name of contractor Center or office Affiliation Centers for Disease Control and Prevention

B. I will identify myself as an employee of a contractor at the beginning of telephone conversations or conference calls;

C. I will not wear any CDC logo on clothing, except for a CDC issued security badge while carrying out work for CDC or on CDC premises; the only other exception is when a CDC management official has granted permission to use the CDC logo.

D. I will program my CDC voice mail message to identify myself as a contractors’ employee.

I understand that federal laws including, 18 U.S.C. 641 and 18 U.S.C. 2071, provide criminal penalties for, among other things, unlawfully removing, destroying or converting to personal use, or use of another, any public records. I acknowledge that I have read and fully understand this agreement.

Name of contractor: ___________________________________ Name of Employee:___________________________ Signature of Employee:_________________________________ Date:________________ Copies retained by: contracting official, contractor, and Employee (End of Clause)

10.3 Analysis of Security or Privacy Issues

The Contractor shall immediately or as soon as practical, report any security event to the appropriate CDC COR or CDC Information Systems Security Office (ISSO) officer or other CDC official. Security events as used herein include unauthorized access, disclosure, removal, destruction, and alteration of any CDC asset including data, information, hardware, software, or system. Security events include actions that compromise the security, integrity, or vulnerability of CDC assets or place them at a higher risk through electronic, physical, or personnel actions. All Sensitive But Unclassified (SBU) documentation, data, and associated information shall be safeguarded and destroyed in accordance with applicable security procedures and protocols as determined by the Government. Contractor performance and resulting deliverables must adhere to all federal, HHS, and/or CDC IT security policies and procedures. Contractor must adhere to all Privacy Act, confidentiality, and non-disclosure requirements and clauses in the base contract.

The Privacy Act may be applicable under SORN 09-90-0018, Personnel Records in Operating Offices, to protect personally identifiable information, policies and practices for storing, retrieving, accessing, retaining, and disposing of any records of any U.S. citizens that the contractor will have access to during the administration of the study. The Privacy Act may be applicable under GSA/GOVT-4, to protect any personally Identifiable information collected related to government-sponsored travel activities. The Contractor must protect the confidentiality of proprietary, sensitive, and Personally Identifiable Information (PII) they will have access to during the administration of the task order.

IRB-- Depending on the requirements of the task created under this RFTOP, the contractor may be required to submit privacy clearances, IRB clearances, and identify system of record numbers for studies and data systems created or maintained.

10.4 Standard for Security Configurations

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. (Note: FDCC is applicable to all computing systems using Windows XP™ and Windows Vista™, including desktops and laptops—regardless of function—but not including servers.)

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Typical CDC requirements.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings – see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause. (End of clause)

10.5 Standard for Encryption Language

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-(PDF) compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered “sensitive” in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer’s Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer’s Representative of personnel authorized to decrypt and recover all encrypted information.

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

(e) The Contractor shall ensure that this standard is incorporated into the Contractor’s property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause. (End of clause)

10.6 Security Requirements for Federal Information Technology Resources

(a) Applicability. This clause applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS’ mission. The term “information technology (IT)”, as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting federal information and federal information systems in order to ensure their—

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer’s (OCIO) website.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP) – due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor’s bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor’s IT-SP shall comply with applicable federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (PDF) (Title III of the E-Government Act of 2002, Public Law 107-347), and the following federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18 (PDF), Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor’s final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA) – due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor’s final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment) – due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor’s final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A) – due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems – see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer’s Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor’s final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of (A) annual testing of the system contingency plan and (B) the performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer’s Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions.