Sample_Task_Order_Attachment_A.pdf

REQUEST FOR QUOTATIONS

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE.

PAGE OF PAGES

1 10

1. REQUEST NO.

2017-N-18133

2. DATE ISSUED

3. REQUISITION/PURCHASE REQUEST NO.

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY

Centers for Disease Control and Prevention (PGO)

Acquisition and Assistance Branch 1

2920 Brandywine Road, MS E-15

Atlanta GA 303415539

6. DELIVERY BY (Date)

5b. FOR INFORMATION CALL (No collect calls)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

Germaine Mullins (770) 488-1938 x

8. TO: 9. DESTINATION

a. NAME b. COMPANY a. NAME OF CONSIGNEE

c. STREET ADDRESS b. STREET ADDRESS

c. CITY

d. CITY e. STATE f. ZIP CODE d. STATE e. ZIP CODE

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

SAMPLE TASK ORDER

ATTACHMENT A

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS

b. 20 CALENDAR DAYS

c. 30 CALENDAR DAYS

d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER 14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF

QUOTATION

a. NAME OF QUOTER

b. STREET ADDRESS 16. SIGNER

a. NAME (Type or print) b. TELEPHONE

c. COUNTY AREA CODE

d. CITY e. STATE f. ZIP CODE c. TITLE (Type or print) NUMBER

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (REV. 6-95)

Previous edition not usable Prescribed by GSA FAR (48 CFR) 53.215-1(a)

7. DELIVERY

FOB

DESTINATION

OTHER

(See Schedule)

Line Items

Base Period Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED

PRICE

0001 National Healthcare Safety Network (NHSN)

Integrations of Antimicrobial Resistance Reporting

12 Months

The Government anticipates a Firm Fixed Price Type task order.

SAMPLE TASK ORDER

Integrations of Antimicrobial Resistance Reporting to the National Healthcare Safety Network and

Electronic Laboratory Reporting to State and Local health Departments

Background

The National Healthcare Safety Network (NHSN) is a web-based information system used by CDC and its partners in healthcare and public health for surveillance of healthcare-associated infections (HAIs), antimicrobial use (AU), antimicrobial resistance (AR), and other healthcare outcomes and processes. The primary goals of NHSN are to provide data needed to prevent infections and to measure and improve healthcare quality. The enormous public health burden of HAIs and the closely linked public health threat posed by AR have prompted intensifying efforts to track and respond to both problems. These efforts include state laws or policies that require healthcare facilities in the state’s jurisdiction to participate in

NHSN, CDC’s expansion of NHSN’s coverage to include additional HAIs and more comprehensive AR surveillance, and increasing use of electronic laboratory reporting (ELR) by state and local health departments for surveillance of AR and communicable diseases. In concept, this simultaneous growth of

NHSN and increasing use of ELR to track AR has the potential to strengthen AR surveillance at all geographic levels by providing complementary systems for monitoring and responding to AR problems.

However, careful analysis, thoroughgoing coordination, and targeted support are needed to assure that

NHSN AR surveillance and ELR are integrated to the fullest extent possible in terms of their public health functions, technical requirements, and system operations.

Purpose

The purpose of this Task Order is to support efforts underway at CDC’s Division of Healthcare Quality

Promotion (DHQP) and other CDC programs to analyze, coordinate, and support integration of AR reporting to NHSN and ELR to state and local health departments. Additional informatics expertise, beyond DHQP’s current staff, is needed to achieve DHQP’s programmatic goals. High priorities for integration of AR surveillance via NHSN and ELR are maximizing use of shared technical infrastructures for outbound reporting of microbiology results from the sending systems to CDC and to state and local health departments and, wherever possible, harmonizing data-level specifications for conveying those results electronically.

Further, as NHSN’s technical infrastructure is modernized, it is imperative that NHSN develop and support shared services that achieve the widest possible benefits for surveillance of AR and other public health problems. In functional terms, integration of systems also calls for a common understanding and clear communication of the respective roles and responsibilities of CDC and state and local health departments in

AR surveillance. This Task Order addresses the need to integrate systems at the local, state, and national levels by bringing informatics expertise to bear on a set of important challenges and opportunities at the intersection of informatics, surveillance, and public health practice.

Scope of Work

1. Task Force

The contractor shall provide informatics subject matter expertise to the AR Surveillance Task (or successor group) formed by CDC and the Council of State and Territorial Epidemiologists (CSTE). This work shall include participation in all Task Force (or successor group) meetings, leading or contributing to Task Force

Work Groups, analyzing technical issues, preparing summary documents, and presenting findings and recommendations to stakeholder groups. This work calls for expertise in methods of collecting, analyzing, and reporting microbiology results data and using those data for AR surveillance and response activities.

2. NHSN AUR Module

The contractor shall provide informatics subject matter expertise and technical support to information technology vendors and NHSN users for purposes of extending use of the NHSN antimicrobial use and resistance module (AUR). This work shall include consultative support for dual use of electronic messaging infrastructure in healthcare facilities for reporting AR data to NHSN and ELR data to local and state health departments. As such, the contractor shall liaise with other CDC programs and state and local health department staff on projects that enable electronic reporting of microbiology results data to the

NHSN AUR module and to state and local ELR systems.

3. State Cooperative Agreements

The contractor shall provide informatics expertise and technical support to staff in state health departments-

-in those states funded via CDC cooperative agreements--who are working to enhance state capacities for

AR surveillance, ELR surveillance, and AR response. The contractor’s work shall include assistance with developing and delivering informatics training for the public health work force responsible for strengthening AR surveillance via NHSN and expanding the scope of ELR coverage.

4. NHSN Upgrades

The contractor shall provide informatics expertise to the NHSN information technology team for planned upgrades of NHSN that include leveraging cloud computing and shared services for surveillance purposes.

The scope of this work shall draw on expertise in public health messaging solutions and shared services that aid in transport, validation, translation and routing of electronic data.

Technical Requirements

The Contractor shall provide the following tasks:

Task 1 Task Force

Participate in all regularly scheduled meetings of the CDC-CSTE Task Force on Strengthening AR

Surveillance and lead or contribute to Task Force projects or work products that call for technical expertise in electronic reporting of microbiology results for purposes of AR or ELR surveillance or subject matter expertise in the roles and responsibilities of local, state, and federal public health agencies in AR surveillance and response.

Task 2 NHSN AUR Module

Provide subject matter expertise and technical support in the form of written and verbal guidance and as-needed consultations for information technology vendors and NHSN users in healthcare facilities who are responsible for developing and maintaining capacity to report to NHSN’s AUR Module. Guidance and consultation will include technical materials that support dual use of microbiology results data for NHSN

AR surveillance and state and local ELR surveillance.

Task 3 State Cooperative Agreements

Provide subject matter expertise and technical assistance on quarterly conference calls and via as-needed, ad hoc communications with staff in state health departments that receive CDC cooperative agreement support for increasing healthcare facility participation in NHSN’s AUR Module and extending the scope of

ELR surveillance to those healthcare facilities not currently submitting ELR data. This Task includes assistance with the design, development, and use of training materials that support dual purpose use of technical infrastructure for NHSN AR surveillance and ELR surveillance.

Task 4 NHSN Upgrades

Provide informatics expertise to the NHSN information technology development team in regularly scheduled meetings and in ad-hoc consultations or communications that inform design decisions about planned upgrades to NHSN’s technical infrastructure. This Task includes contributions to technical reviews, discussions, and decision-making about NHSN’s infrastructural upgrades, and participation in consultations, discussions, and collaborative projects with other CDC programs and other public health entities that support an integrated approach to modernizing public health surveillance platforms.

Deliverables

The Contractor shall provide deliverables in accordance with the deliverable schedule below:

TASK # Deliverable Quantity/Format DELIVERY

DATE

DELIVERED

TO

Task 1 Task Force – Monthly written summary of participation and contributions to Task Force (or successor group) meetings and projects, including copies of any written work products developed for the Task Force or Task Force

Work Groups (or successor groups).

1 electronic copy – include in Monthly Status

Report

15th of each month

COR

Task 2 NHSN AUR Module – Monthly written summary of consultations with information technology vendors and

NHSN users, including resolution or current status of technical issues

1 electronic copy -include in Monthly Status

Report

15th of each month

COR

Task 3 State Cooperative agreements – Monthly written summary of conference calls or other contacts with state recipients of CDC cooperative agreements and communications and work products pursuant to informatics training materials for public health work force

1 electronic copy – include in Monthly Status

Report

15th of each month

COR

Task 4 NHSN Upgrades - Monthly written summary of contributions to deliberations or decisions by the NHSN information technology development team’s plans for

NHSN upgrades and any communications with other CDC programs or public health stakeholders concerning modernization and integration of surveillance platforms

1 electronic copy – include in Monthly Status

Report

15th of each month

COR

Monthly Status Report

1 electronic copy 15th of each month

COR

Note: All documents listed as deliverables shall be submitted to the COR in an electronic file (Microsoft

Word, Excel, in a PC/IBM compatible format)

Monthly Status Reports

The contractor shall submit monthly reports to the COR. The reports shall cover the following items:

a. Accomplishments during the reporting period

b. Difficulties encountered and remedial action(s) taken

c. A brief summary of activities anticipated during the upcoming reporting period

d. Personnel and other management changes (e.g. change in staff)

Reporting Schedule

The contractor shall participate in regularly scheduled conference calls with the COR monthly and the CDC meeting point of contact(s) weekly. Additional conference calls may be scheduled as necessary to ensure effective communication.

Data Rights

The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be

Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Period of Performance

The estimated Period of Performance for this task order is 12 months from Date of Award

52.227-17 RIGHTS IN DATA—SPECIAL WORKS (DEC 2007)

(a) Definitions. As used in this clause—

“Data” means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

“Unlimited rights” means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of Rights.

(1) The Government shall have—

(i) Unlimited rights in all data delivered under this contract, and in all data first produced in the performance of this contract, except as provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced in the performance of this contract, and to obtain assignment of copyright in that data, in accordance with paragraph (c)(1) of this clause.

(iii) The right to limit the release and use of certain data in accordance with paragraph (d) of this clause.

(2) The Contractor shall have, to the extent permission is granted in accordance with paragraph (c)(1) of this clause, the right to assert claim to copyright subsisting in data first produced in the performance of this contract.

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) The Contractor shall not assert or authorize others to assert any claim to copyright subsisting in any data first produced in the performance of this contract without prior written permission of the

Contracting Officer. When copyright is asserted, the Contractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402 and acknowledgment of Government sponsorship (including contract number) to the data when delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. The Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

(ii) If the Government desires to obtain copyright in data first produced in the performance of this contract and permission has not been granted as set forth in paragraph (c)(1)(i) of this clause, the

Contracting Officer shall direct the Contractor to assign (with or without registration), or obtain the assignment of, the copyright to the Government or its designated assignee.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without prior written permission of the Contracting Officer, incorporate in data delivered under this contract any data not first produced in the performance of this contract and that contain the copyright notice of 17 U.S.C. 401 or

402, unless the Contractor identifies such data and grants to the Government, or acquires on its behalf, a license of the same scope as set forth in paragraph (c)(1) of this clause.

(d) Release and use restrictions. Except as otherwise specifically provided for in this contract, the

Contractor shall not use, release, reproduce, distribute, or publish any data first produced in the performance of this contract, nor authorize others to do so, without written permission of the Contracting

Officer.

(e) Indemnity. The Contractor shall indemnify the Government and its officers, agents, and employees acting for the Government against any liability, including costs and expenses, incurred as the result of the violation of trade secrets, copyrights, or right of privacy or publicity, arising out of the creation, delivery, publication, or use of any data furnished under this contract; or any libelous or other unlawful matter contained in such data. The provisions of this paragraph do not apply unless the Government provides notice to the Contractor as soon as practicable of any claim or suit, affords the Contractor an opportunity under applicable laws, rules, or regulations to participate in the defense of the claim or suit, and obtains the

Contractor’s consent to the settlement of any claim or suit other than as required by final decree of a court of competent jurisdiction; and these provisions do not apply to material furnished to the Contractor by the

Government and incorporated in data to which this clause applies.

(End of clause)

The below information complies with HHSA Security compliance requirements for the

EGovernment Act of 2002 (FISMA)

Security Compliance

The contractor must have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government. We provide the following information to assist in the preparation of documents necessary for the Security Assessment and

Authorization (SA&A)of an Information System. The EGovernment Act of 2002, (Federal Information

Management Act) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/

Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with

OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

Requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

FIPS Publication 200, Minimum Security Requirements for Federal Information and Information

Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf), FIPS Publication 199, Standards for Security Categorization of Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)

NIST Special Publication 800-18, Guide to Developing Security Plans for Federal Information

Systems http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf

NIST Special Publication 800-60, Guide for Mapping Types of Information and Information

Systems to Security Categories Vol. 1 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v1r1.pdf and Vol. 2 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf

NIST Special Publication 800-53, Recommended Security Controls for Federal Information

Systems and Organizations http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53Ar4.pdf

NIST Special Publication 800-63, Electronic Authentication Guideline http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the EGovernment Act of 2002 and NIST Special Publication 800-18, 800-37, and will include selected mandatory controls required by NIST Special Publication 800-53, and NIST Special Publication

800-60 Volume I & II. The successful contractor in conjunction with the NCHHSTP Information System

Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer

(CISO). The successful completion of the SA&A documents will result in an award of an Authority To

Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCHHSTP ISSO and confirmed by the CDC OCISO Certifying

Authority as part of the Certification and Accreditation process.

The successful contractor is responsible for providing pertinent security information to the NCHHSTP

ISSO and Security Staff and assisting in completing the below CDC Certification and Accreditation documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCHHSTP Security Staff.

Completed documents will be sent to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

Baseline System Information (BSI)

Privacy Impact Assessment (PIA)

System Security Plan (SSP)

Business Continuity Plan (BCP)

Risk Assessment Report (RAR)

Deliverable Table

BSI, PIA, SSP, BCP, RAR

(SA&A)

Completed Documents due to

NCHHSTP ISSO 75 days prior to desired System Production date

Completed Documents Due to

CDC Chief Information Security

Office 60 days prior to desired

System production date

Recertification (required every 3 years or when significant change occurs

Completed Documents due to

NCHHSTP ISSO 75 days prior to current ATO expiration date

Completed Documents Due to

CDC Chief Information Security

Office 60 days prior to current

ATO expiration date

Annual Assessment/Business

Continuity Plan (BCP)

Completed Documents due to

NCHHSTP ISSO 15 days prior to date of annual renewal

Completed Documents Due to

CDC Chief Information Security

Office 1 day prior to date of annual renewal

Non Significant Change Requests

(OS or application version change, change in data variables)

Completed documentation due to

ISSO for signature prior to change implementation

Completed documentation due to

OCISO for approval prior to change implementation

The Contractor shall respond to the following seven security–associated requirements in the application:

(1) Position Sensitivity Designations

CDC requires a Public Trust Level 5 for the following:

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI).

Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum

Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-contractor staff) working under the contract that will have the ability to access sensitive NCHHSTP information from the system. The roster shall be submitted to the Project Officer/technical monitor, with a copy to the

Contracting Officer, within 14 calendar days of the effective date of the contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The

Contracting Officer shall notify the licensor of the appropriate level of suitability investigations to be performed, but Licensor employees and subcontractors who have met investigative requirements within the last five years may only require an updated or upgraded investigation. An electronic template, “Roster of

Employees Requiring Suitability Investigations,” is available for contractor use at:

http://ais.nci.nih.gov/forms/Suitability-roster.xls. Upon receipt of the Government’s notification of applicable suitability investigations required, the Licensor shall complete and submit the required forms within 30 days of the notification.

Non-Disclosure Agreements

The Contractor and any sub-Contractors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Contractor's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact

Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and contractor, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Contractor’s Official Responsible for Information Security

The contractor shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the contractor be selected for an award.

(4) Rules of Behavior

The contractor’s employees and subcontractors shall comply with the HHS Information Technology

General Rules of Behavior.

(5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements.

The successful contractor shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by

CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Contractor's expense and would be the Contractor's responsibility to plan and arrange.

The successful contractor shall maintain a listing of all individuals who have completed this training and shall submit this listing to the project officer.

http://ais.nci.nih.gov/forms/Suitability-roster.xls

(6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential

Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain sensitive CDC- data shall be encrypted using FIPS 140-2 compliant algorithms.

Section 508 of the Rehabilitation Act (29 USC 794d)

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment

Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and

Information (EIT) Accessibility Provisions (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit:

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility provisions. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access- board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this solicitation are identified in the Statement of

Work/Specification/Performance Work Statement. In order to facilitate the Government’s evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific

Section 508 standard. Instructions for preparing the HHS Section 508 Product Assessment Template may be found at http://508.hhs.gov.

Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards in its completed HHS Section 508 Product

Assessment Template, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility in the Product

Assessment Template, remediation of the products and/or services to the level of conformance specified in the vendor’s Product Assessment Template will be the responsibility of the Contractor at its expense.

The applicable provisions of this solicitation are: 1194.21, .22, .24, .31, and .41.

http://www.section508.gov/ http://www.access-board.gov/sec508/provisions.htm http://508.hhs.gov/