Amendment 1 to Attachment 4 Domain 4 Sample RFTOP .pdf

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

SHEPheRD RFTOP 2021-4-001

AMENDMENT 1

DOMAIN 4 Sample RFTOP

RFTOP Title: Preventing Antimicrobial Resistant Infections in Low- and Middle-Income Countries

Multiple task orders may be awarded subject to availability of funds and contractors should prepare technical proposals that are priced in the range of $300,000.00 - $350,000 BASE PERIOD and $700,000.00 - $850,000.00 OPTION PERIOD ONE in order to be considered for award.

Proposed Period of Performance: Work shall begin from date of award of the order and shall continue for a period of 12 months for base period activities. The option period is proposed for 24 months, following the base period. This project is a non-severable and will be funded fully at the time of award.

PROPOSAL PREPARATION AND SUBMISSION

1. General Instructions: Offeror(s) shall submit proposals consisting of the following volumes:

Technical Proposal – Volume I Business Proposal – Volume II

a. Technical Proposal-Volume I

Technical Proposal Preparation Instructions – Page limit is (10) single-spaced pages of text for the technical proposal; (the page limit does not include appendices or resumes). Each volume in the proposal shall include a copy of the cover letter (letter of transmittal), title page and table of contents. The table of contents shall list sections, subsections and page numbers.

The technical proposal should be in as much detail as you consider necessary to reflect a clear understanding of the nature of the work being undertaken.

The technical proposal must NOT contain reference to cost; however, resource information, such as data concerning labor hours and categories, material, subcontracts, etc., must be contained in the technical proposal so that your understanding of the statement of work can be evaluated.

b. Business Proposal-Volume II

Pricing Narrative: The Offeror shall provide an explanation and/or detailed information on how the fully loaded labor rates were derived. The business proposal shall be an Excel spreadsheet, with an itemized price breakout per task for each period (e.g. Base Year, Option Years), including itemized prices for any subcontracted work. Proposed labor hours, labor costs, travel and other direct costs for this task order request shall be organized around the tasks and related deliverables described herein.

Pricing Worksheet: Utilizing the format in Attachment 11 of RFP, provide all applicable labor categories, descriptions, and rates, travel for the Prime Contractor/Subcontractor for each period (e.g. Base Year, Option Years). Please return Section B (CLIN and payment milestone) with Business Proposal.

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

SECTION B SUPPLIES OR SERVICES AND PRICES/COSTS

BASE PERIOD

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT

PRICE

EXTENDED

PRICES

0001 Safety and Healthcare Epidemiology Prevention Research Development (SHEPheRD) Program 2021 Domain 4 Preventing Antimicrobial Resistant Infections in Low- and Middle-Income Countries

POP: 12 months from award This is a Firm-Fixed Price and Non-Severable Line Item

1 Job $________ $ ___________

OPTION PERIOD ONE

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT

PRICE

EXTENDED

PRICES

1001 Safety and Healthcare Epidemiology Prevention Research Development (SHEPheRD) Program 2021 Domain 4 Preventing Antimicrobial Resistant Infections in Low- and Middle-Income Countries

POP: 24 months This is a Firm-Fixed Price and Non-Severable Line Item

1 Job $________ $ ___________

**The offeror requires to identify the zip code of the work site so the appropriate wage determination can be identified and included with an awarded task order.

B.1 PAYMENT TERMS

Payment will be made subject to receipt of deliverables in accordance with the payment schedule established herein and in accordance with FAR 52.232-25. Prompt Payment, which states that the due date for making invoice payments shall be the 30th day after the designated billing office (see block 21 of the order) has received a proper invoice from the vendor or the 30th day after Government acceptance of the services provided by the vendor, whichever is later.

B.2 Schedule of Milestones for Performance-Based Payments In accordance with FAR 52.232-32, PERFORMANCE BASED PAYMENTS (April 2012), upon successful completion of an event, the contractor may request performance based payments. The determination of eligibility for receipt of payment will be made by the Contracting Officer upon written certification from the Contracting Officer’s Representative (COR) that the performance milestone has been met. It is anticipated that each milestone payment will approximate the estimated timeline listed below but variation is anticipated and eligibility for payment could occur sooner or later depending upon the time of completion of the designated milestone.

Milestone payments are subject to the terms of FAR 52.232-32 incorporated in this contract.

The COR receiving and acceptance of monthly performance based payments is based on verification that work on the contract was satisfactorily performed during the month and that, at a minimum, the following activities were satisfactorily performed.

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

CONTRACTOR PROPOSED

MILESTONE EVENT PAYMENT %* DOLLAR AMOUNT

TOTAL 100 % $

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

SAMPLE PAYMENT SCHEDULE for this task order

Performance Base Payment Schedule [POP: 12 Months]

Deliverable Due Date Payment Once Approved by

COR

Maintain regular meetings and communications with Science Officer and COR; Provide agenda for conference calls, response to emails and telephone communications; Participation in protocol development meetings

Provide work plan and timeline

Monthly

Month 1

10% of award, to be divided into 12 equal installments

Status summary of project tasks, accomplishments, plans for next reporting period including status for the protocol

Due on the 10th working day of each 3rd month, summarizing information as of the end of the prior quarter.

10% of award, to be divided into 4 equal installments

Identify interventions for AMR prevention that will be included in pilot testing

End of Month 2 15% of award

Facilities committed to participation and the necessary approvals (MOUs)

End of Month 3 15% of award

Development of Draft Protocol

Final Protocol (pending IRB approval)

End of Month 4

End of Month 5

15% of award

IRB Approved Protocol End of Month 8 15% of award

Pilot test data and list of final interventions

End of Month 11

20% of award

Performance Option Period I Payment Schedule [POP: 24 Months]

Deliverable Due Date Payment Once Approved by COR

Maintain regular meetings and communications with Science Officer and COR; Provide agenda for conference calls, response to emails and telephone communications; Participation in protocol development meetings

Revised Work Plan & Timeline

Monthly

Month 1

15% of award, to be divided into 24 equal installments

Status summary of project tasks, accomplishments, plans for next reporting period including status

Due on the 10th working day of each 3rd month, summarizing information as of the end of the

10% of award, to be divided into 8 equal installments

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Performance Option Period I Payment Schedule [POP: 24 Months]

Deliverable Due Date Payment Once Approved by COR for the protocol prior quarter.

Development of data dictionary and data architecture plan

End of Month 7

20% of award

Summary reports for each site during the intervention

First Report Second Report Third Report Fourth Report

End of Month 9 End of Month 12 End of Month 15 End of Month 18

Data Management Plan End of Month 9

15% of award

Analytic Report with Summary Data

Draft I Draft II

End of Month 19 End of Month 20

Electronic Report

Electronic and paper copy final report, along with data collection tools, relevant data dictionaries, and summary data

End of Month 22

End of Month 23

10% of award

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

PERFORMANCE-BASED WORK STATEMENT

OVERVIEW

Despite the importance of antimicrobial resistance (AMR) as a public health threat, there are no good estimates of the global AMR burden. Only in the United States, approximately 2.8 million people get an antimicrobial-resistance infection and over 35,000 die every year. The AMR burden in low- and middle-income (LIMIC) countries are expected to be much greater than what it is observed in the United States given the lack of resource and leadership support for infection prevention and control measures, challenges with access to good laboratories to guide antimicrobial therapy, and poor control on antimicrobial prescribing and dispensing practices.

Although successful control of multi-drug resistance organisms has been documented in several high-income countries, some of the prevention strategies are costly and resource intense; making their implementation in LMICs a challenge. Understand the drivers of AMR infections in LMIC and identify effective and low-cost prevention measures are critical to improve patient outcomes and ensure a safe healthcare environment. This project seeks to expand our understanding on how to prevent AMR infections and deaths within acute care settings in LMICs through development and evaluation of innovative prevention strategies that balance efficacy, cost and burden to healthcare workers and staff.

PROJECT GOALS

The project is focused on determining the burden of AMR infections and on the identification of cost-effective, innovative and sustainable interventions to prevent AMR infections and improve patient outcomes in acute care hospitals in LMIC in order to inform global infection prevention and control practices

CDC is requesting proposals in which the Contractor:

1. Describes the burden of AMR infection by patient-days from single or multiple wards from a network of acute care hospitals

2. Assesses the burden of multi-drug resistant organisms in the healthcare environment and the role of the environment in transmission

3. Identifies innovative interventions intended to reduce the incidence of AMR infections in acute care hospitals in LMIC, including the role of chlorhexidine or microbiome-based strategies on prevention of AMR infections

4. Conducts small pilot studies to assess the feasibility, acceptability and cost of innovative interventions identified, which can be part of a bundle for AMR prevention

5. Evaluates the cost and effectiveness of innovative interventions in multiple intensive care units

SCOPE OF WORK

The purpose of this acquisition is to expand our understanding on how to prevent AMR infections and deaths within acute care settings in LMICs through development and evaluation of innovative prevention strategies that balance efficacy, cost and burden to healthcare workers and staff

TASKS TO BE PERFORMED

The contractor shall provide all labor, expertise, materials, supplies and perform all services required to carry out the work under this contract.

Base Period Tasks Goal: To identify relevant interventions, conduct pilot studies and develop a protocol for implementation of interventions, recruit facilities to participate and prepare/submit IRB applications.

Task 1: Start Up Meeting

1. The Contractor shall arrange and conduct an initial meeting (by teleconference) with the Contracting

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Officer’s Representative (COR) and other relevant staff within two weeks of the effective date of the task order. The purpose of the meeting will be to review and clarify the scope of work and delivery schedule for tasks, to delineate roles and responsibilities, and to establish communication protocols. Each task and deliverable will be reviewed.

2. The Contractor shall submit an agenda for the above meeting within one week of the effective date of the task order.

Task 2: Maintain Communication with the Science Officer

1. The Contractor shall coordinate with the Contracting Officer’s Representative (COR). The Contractor shall maintain regular communications with the Science Officer and CDC staff involved with the project.

The chief means of communication will be via conference calls that will be scheduled every month throughout the project period required to complete the project, and in-person meeting. Additional calls will be scheduled as needed. The Contractor shall provide an agenda and meeting minutes for each call.

All conference calls shall be scheduled and administered by the Contractor. The Contractor shall respond to all emails and telephone communications from the Science Officer within 2-3 working days.

2. The contractor shall coordinate with the Science Officer/Contracting Officer’s Representative (COR) two in-person meetings to deliver presentations on the current project status to the Contracting Officer’s Representative (COR) and other relevant CDC staff. In person meetings may be at the Contractor’s site or at CDC’s Atlanta, GA location.

Task 3: Quarterly Progress Reports

• On the 10th day following the three (3) months being reported, the contractor shall prepare and submit a quarterly progress report containing the current status of work and project spending. The report shall contain, at a minimum, the current progress on each of the requirements set forth below, the financial status of the project, problems encountered during the month, solutions implemented, planned activity for the upcoming month and any other information mutually agreed upon between the contractor and the Contracting Officer’s Representative (COR).

Task 4: Develop a Work Plan and Timeline

• The contractor shall develop a detailed plan and timeline for developing and implementing a study of interventions to reduce AMR infections in acute care hospitals’ wards in LMIC. The work plan shall specify the approach to developing a study protocol, recruiting facilities, implementing the activities outlined in the protocol, data collection and management, an analysis of the impact of the intervention, and report of findings. A timeline for the completion of these tasks including the identification of potential factors that may hasten or impede the accomplishment of stated objectives will be presented to CDC.

Task 5: Identify Interventions for AMR prevention

• The contractor shall identify innovative interventions to reduce the AMR burden in acute care hospitals’ wards in LMIC that could be tested via this proposal. Innovative solutions shall include new ways to approach traditional infection prevention and control practices (e.g. local produced chlorhexidine, environmental cleaning, medication safety).

• The contractor shall also identify the specific AMR pathogen linked to a healthcare-associated infection (e.g. carbapenem-resistant Enterobacteriaceae or carbapenem-resistant A. baumannii or carbapenem-resistant organisms blood stream infection or urinary tract infection) that will be included in the study as the outcome’s measured. If contractor plan to measure colonization burden with AMR pathogens or AMR environmental burden as one of the outcomes that should be specified in the proposal. Choosing the AMR pathogen to be monitored shall be based on expected effects of the chosen interventions, pathogen burden in selected acute care wards, and feasibility.

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Task 6: Recruit Facilities for Participation

• The Contractor shall be responsible for identifying, recruiting and maintaining sufficient acute care hospitals to reach sample sizes that are required to achieve definitive results and generalizability.

Facilities participating will include an adequate number of wards within a acute care hospitals that is recognized to have a high burden of AMR infections, and these hospitals should be willing to act in accordance with human subjects protections and study protocol requirements.

• The Contractor shall develop a plan for how and when implementation will occur within the participating facilities, including how they will obtain IRB approval and all approvals necessary both in country and in the United States.

Task 7: Develop a Protocol for Testing

• The contractor shall develop a protocol for testing the selected interventions and their effect on selected AMR infections. The contractor shall work with the Science Officer on the development of the protocol that specifically lays out the study question, hypothesis, methodology, data sources, analytic strategy and related tasks.

• The contractor shall perform standard power calculations to determine study size needed to achieve statistical power to detect a difference due to the interventions implemented, with a primary outcome being incidence of chosen AMR infection within chosen facilities. The protocol shall include a research plan that includes a baseline data collection period of 6 months and an intervention period of 12 months.

Task 8: Institutional Review Board (IRB)

• The Contractor will prepare and submit IRB, and oversee all aspects of package development and submission as required prior to collection of any data, including pilot data. The Contractor shall prepare the packages including all forms and attachments for Science Officer/Contracting Officer’s Representative (COR) approval as needed. The Contractor shall submit the IRB package to the relevant IRB(s) and shall ensure that all clinical sites involved in the study apply for and receive IRB approval. Copies of IRB approvals from the Contractor and all clinical sites shall be provided to the Science Officer/Contracting Officer’s Representative (COR).

Task 9: Pilot Test Select Interventions

• The Contractor shall conduct pilot testing on at minimum four of the chosen interventions in order to assess the feasibility and acceptability of implementing the interventions. Based on results from the initial pilot testing and discussion with the Science Officer/Contracting Officer’s Representative (COR), additional interventions shall be pilot tested as needed to come up with data on which interventions shall be implemented in the chosen hospital wards.

• The Contractor shall use data from pilot testing to define a bundle of interventions to be tested in a larger protocol as to their impact on chosen AMR infections in the selected hospital wards. The contractor shall discuss the proposed bundle of interventions with the Science Officer/Contracting Officer’s Representative (COR) before a final decision is made on the interventions.

Option Period I

Goal: To identify and implement a single or suite of interventions in acute care hospital wards in LMIC for AMR prevention, analyze data and determine impact on select AMR infections.

Task 1: Maintain Communication with CDC Staff

• The Contractor shall coordinate with the Contracting Officer’s Representative (COR). The Contractor shall maintain regular communications with the Science Officer and CDC staff involved with the project.

The chief means of communication will be via conference calls that will be scheduled every month

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

throughout the project period required to complete the project. Additional calls will be scheduled as needed. The Contractor shall provide an agenda and meeting minutes for each call. All conference calls shall be scheduled and administered by the Contractor. The Contractor shall respond to all emails and telephone communications from the Science Officer within 2-3 working days.

Task 2: Quarterly Progress Reports

• On the 10th day following the three (3) months being reported, the contractor shall prepare and submit a quarterly progress report containing the current status of work and a financial status report. The report shall contain, at a minimum, the current progress on each of the requirements set forth below, the financial status of the project, problems encountered during the month, solutions implemented, planned activity for the upcoming quarter by month and any other information mutually agreed upon between the contractor and the Contracting Officer’s Representative (COR).

Task 3: Revise Work Plan and Timeline

• The Contractor shall revise the detailed plan first outlined in the base period to present a timeline for implementing a pre/post study assessing the impact of a single or a suite of interventions on select AMR infections. A timeline for the completion of these tasks including the identification of potential factors that may hasten or impede the accomplishment of stated objectives will be presented to CDC.

• The work plan shall specify the approach to developing data collection and management, an analysis of the data collected (both baseline and intervention) and report of findings.

Task 4: Collect Baseline Data

• During this period the Contractor shall perform an assessment of the current incidence of chosen AMR infection in the study facilities as well as data on any baseline IPC practices as needed to measure the impact of the intervention during the intervention period.

• The Contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site (may be one or more sites depending on the protocol and project plan).

o The Contractor shall have primary responsibility for collecting and managing baseline data. Data elements, as defined in the protocol developed in the base period, and architecture shall be described and submitted for review by the Science Officer/Contracting Officer’s Representative

(COR).

• The Contractor shall collect baseline data for a period of six (6) months in the participating facilities. Data collection shall be completed before the implementation of interventions and collection of data during the intervention period. The protocol shall have a clear plan for the collection of data elements which include:

o Measurement of AMR infection, at least but not limited to healthcare-associated infections. It may also include AMR colonization prevalence.

o Measurement of appropriate denominator data in order to calculate incidence.

o Measurement of compliance with any relevant IPC practices needed to contextualize the later intervention period data (e.g. if one of the interventions is a novel method to improve hand hygiene compliance, data on hand hygiene compliance in the baseline period shall be collected).

Task 5: Collect Intervention Data

• During this period the Contractor shall perform an assessment of compliance with the interventions implemented as well as the incidence of chosen AMR infection in the study facilities.

• If multiple sites are included, the Contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site.

o The contractor shall have primary responsibility for collecting and managing baseline data. Data elements, as defined in the protocol developed in the base period, and architecture shall be

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

described and submitted for review by the Science Officer/Contracting Officer’s Representative

(COR).

• The Contractor shall collect intervention data for a period of 12 months in the participating facilities. The protocol shall have a clear plan for the collection of data elements which include:

o Measurement of AMR infection, at least but not limited to healthcare-associated infections. It may also include AMR colonization prevalence.

o Measurement of appropriate denominator data in order to calculate incidence.

o Measurement of compliance with interventions implemented to assure the uptake and compliance.

Task 6: Data Management

• The Contractor shall have primary responsibility to collect and manage baseline and outcome data. Data elements, defined in the protocol and developed in the base period, and data architecture shall be defined, described and submitted for review by the Science Officer/Contracting Officer’s Representative (COR).

In addition, the Contractor will have primary responsibility to validate data elements from the protocol on a selection of charts.

• The Contractor shall design and maintain a data management structure that will ensure consistent data collection and reporting for each participating site (may be one or more sites depending on the protocol and project plan).

Task 7: Data Analysis

• The Contractor shall prepare and submit to the Science Officer/Contracting Officer’s Representative

(COR) analytical and summary reports throughout project to ensure that there are adequate numbers of events to detect the impact of the intervention. Potential issues and solutions to data collection and management shall be reported in a timely manner, no later than two weeks after onset.

• The Contractor shall review the data to evaluate the effect of the interventions implemented for prevention of AMR infection at selected acute care hospitals. Additionally, compliance with the interventions shall be reviewed to assess uptake of and compliance with the interventions.

• The Contractor shall submit a draft of their analysis according to the description given in the protocol (as defined in the base period) for review by the Science Officer/Contracting Officer’s Representative (COR) and all analysis shall be approved prior to inclusion in the final report.

• Results of the final data analysis shall be included in the draft and Final Project Reports submitted to Contracting Officer’s Representative (COR).

Task 8: Final Report

• The Contractor shall present a draft report of the project to the Science Officer and Contracting Officer’s

Representative (COR) for review. After receiving comments and recommendations on the draft report, the Contractor shall submit the final report, incorporating CDC’s comments and recommendations within one month of receiving CDC feedback. Both reports shall include with it all materials that were developed.

• Writing manuscripts for publication will be the shared responsibility of CDC team and Contractor, and authorship will be granted based on scientific contribution in accordance with CDC authorship policy (http://www.cdc.gov/maso/Policy/Authorship.pdf).

Deliverables Summary Table: Base Period

Task Task Description Deliverable Quantity/

Frequency Due Date

Base Period

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Frequency

Due Date

Base Period 1 Initial Planning Meeting with Appropriate CDC Staff

Initial planning meeting agenda

1 Agenda within 1 week and teleconference within 2 weeks of task order award

2 Maintain Communication with CDC Staff

Agenda for conference calls, response to emails and telephone communications

Ongoing, Monthly

Agenda at least one day before the conference call. Responses to emails and calls within 2 days of event.

3 Quarterly Progress Reports 1 electronic report per quarter with progress and budget status and invoicing

Once every 3 Months

Due on the 10th day of each Quarter

4 Develop Work Plan and Timeline for Study Development

1 work plan approved by Contracting Officer’s Representative (COR)

1 Final Plan 1 month after award

5 Identify Interventions for AMR Prevention

Suite of interventions to be pilot tested approved by Contracting Officer’s

1 Final 2 months after award

6 Recruit Facilities for Participation

Listing and MOU of participating facilities

In-country approvals

1 Final

3 months after award

3 months after award

7 Develop a Protocol for Testing

Protocol approved by Science Officer that includes design, methodology and evaluation

1 Draft

1 Final

4 months after award

5 months after award

7 Protocol Development Meetings

Agenda for meeting.

Contractor shall deliver a presentation on the current project status to the CDC Science Officer and other relevant staff

2 Meetings Agenda at least 1 week before the meeting date

8 Prepare and Submit IRB Documents

Documentation of IRB packets submittal and copies of approvals

IRB Packets

IRB

Approvals

6 months after award

8 months after award

9 Pilot Test Selected Interventions

Pilot test data and list of final interventions reviewed by CDC Science Officer

1 Final 12 months after award

Deliverable Summary Table for Option Period I:

Frequency Due Date

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Frequency

Due Date

Option Period 1 1 Maintain

Communication with CDC staff

Agenda for conference calls, response to emails and telephone communications

Ongoing, Monthly

Agenda at least one day before the conference call. Responses to emails and calls within 2 days of event.

2 Quarterly Progress Reports

1 electronic report per quarter with progress and budget status and invoicing

1 every 3 months Due on the 10th day of each quarter

3 Revised Work Plan and Timeline

1 revised work plan and timeline 1 Final Plan 1 month after award

4 Collect Baseline Data at Participating Facilities

Data dictionary and data architecture plan submitted and approved by Contracting Officer’s Representative (COR)

Baseline Data Document

Completed 7 months after award

5 Implementation of Intervention and Data Collection at Participating Facilities

Summary reports on each site during the intervention and included in quarterly report

First Report

Second Report

Third Report

Fourth Report

Completed 9 months after award

Completed 12 months after award

Completed 15 months after award

Completed 18 months after award

6 Data Management Data management plan submitted and approved by Contracting Officer’s

1 Document 9 months after award

7 Data Analysis Analytic report with summary data approved by Contracting Officer’s Representative (COR)

1 Draft Analytical Report

Analytical Report

19 months after award

20 months after award

8 Final Report Electronic draft report

Electronic and paper copy final report, along with data collection tools, relevant data dictionaries, and summary data

1 Draft Project Report

1 Final Project Report

22 months after award

24 months after award

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

1. General Information

A. Place of Performance: The work to be performed under this contract will be performed at the Contractor’s facility and associated/collaborating academic, healthcare or research facilities, which may be international, as required.

B. Type of Contract: The government will award a firm-fixed price task order for this requirement.

C. Contractor Travel: The cost associate with completing the work/task, should be part of the task cost (i.e CLIN 0001 and CLIN 0002).

D. Data Rights (If applicable): 52.227-14 Rights in Data-General, Alternate IV (Dec 2007). As prescribed in 27.409(b)(5), substitute the following paragraph (c)(1) for paragraph (c)(1) of the basic clause: (c) Copyright—(1) Data first produced in the performance of the contract. Except as otherwise specifically provided in this contract, the Contractor may assert copyright in any data first produced in the performance of this contract. When asserting copyright, the Contractor shall affix the applicable copyright notice of 17 U.S.C. 401 or 402, and an acknowledgment of Government sponsorship (including contract number), to the data when such data are delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. For data other than computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. For computer software, the Contractor grants to the Government and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all such computer software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to distribute copies to the public), by or on behalf of the Government.

E. Government Furnished Property, Equipment, and Services – Not Applicable

Special Clearances:

A. Confidentiality of Information: Work on this project may require that personnel have access to Privacy

Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The user agency will identify and provide direction and guidance for safeguarding all information subject to the Privacy Act. Reports and case files containing individual personal information are confidential. The CDC is not authorized to release individual case reports, and access to individual case data is strictly controlled. The contractor personnel are required to work with case records as well as databases. It is a requirement that the data remain in a controlled access environment.

B. Section 508 Compliance

By agreeing to the terms of the Safe Healthcare, Epidemiology, and Prevention Research Development (SHEPheRD) Program IDIQ Contract, the offeror must comply with Section 508 standards for all deliverables in this task order. The offeror must complete an HHS/CDC checklist(s) as needed for each deliverable specified.

The applicable Section 508 standards to this task order are 1194.

302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Performance of Work Requirements Summary

1. The purpose of this section is to:

A. List the contract requirements considered most critical to acceptable contract performance.

B. Show, where applicable, the maximum allowable degree of deviation from perfect performance for each requirement that shall be allowed by the Government before contract performance is considered unsatisfactory.

C. Define the procedure the Government shall use in reducing the Contractor's payment if satisfactory performance is not rendered.

2. The Government's quality assurance procedures are based on actual performance of the contract and all areas will be reviewed periodically, (e.g. weekly, quarterly).

3. The criteria for acceptable and unacceptable performance are as follows:

A. Contract Requirements. The criteria for requirements are the level of performance deemed acceptable to the Government.

B. Quality. If the quality of work does not comply with the contract requirements the Contracting Officer’s Representative (COR) will initiate and the Contractor shall be required to complete a Contract Discrepancy Report (CDR).

C. The CDR will require the Contractor to explain in writing why performance was unacceptable, how performance will be returned to an acceptable level, and how recurrence of the problem will be prevented in the future. The Contractor will not be paid for services not rendered in accordance with the standards set forth in this contract.

D. If the level of performance is deemed unacceptable to the Government concurrent with two unsatisfactory ratings, monthly payment will be reduced for unsatisfactory performance by the percentage as shown in the chart below:

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

BASE PERIOD

OPTION PERIOD

Performance

Objective Performance

Standard and Acceptability

Quality Level

Disincentive

Method of Performance Assessment

Quarterly Progress Report Submittals

Turns in all required submittals 95% of the time.

5% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review submitted reports.

Development of Data Dictionary and Data Architecture Plan

90% of baseline data collected at participating facilities

20% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

Implementation of Intervention at Participating Facilities

90% of intervention data implemented

15% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

Performance Objective

Performance Standard and Acceptability Quality Level

Disincentive

Method of Performance Assessment

Quarterly Progress Report Submittals

Turns in all required submittals 95% of the time.

5% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review submitted reports.

Pilot Test Selected Interventions

90% of interventions tested

10% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

Development of Protocol for Testing

Develop protocol for testing.

Protocol must be sound, complete and delivered to CDC Science Officer in 9 months

20% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

Preparation and submission of IRB documents

100% IRB approval for document(s) submitted

10% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

Facility Recruitment

90% of facilities committed and maintaining participation and all necessary approvals obtained

10% of invoice deduction for failing to meet AQL

Inspections by Science Officer/COR (in person meetings, telephone calls).

Review progress reports and submitted documents.

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Security Compliance

Standard-1: Procurements Requiring Information Security and/or Physical Access Security A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ x ] Moderate [ ] High Integrity: [ ] Low [ x ] Moderate [ ] High Availability: [ ] Low [ x ] Moderate [ ] High Overall Risk Level: [ ] Low [ x ] Moderate [ ] High http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ x ] Yes PII

Complete this section using the information obtained from the Security and Privacy Checklist in Appendix A, parts A and B.

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular

A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ x ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed.

Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140- 2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor.

Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB

Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

See Appendix D for baseline deliverables.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including

PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

See Appendix C for the Contractor Non-Disclosure Agreement.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

ATTACHMENT 4 SAMPLE TASK ORDER DOMAIN 4

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined…