2023-09-06 RFQ No. FDA-SOL-23-1267862 CDRH_OCE Communications Assessment.pdf

Request for Quotation (RFQ) No. FDA-SOL-23-1267862 Center for Devices and Radiological Health (CDRH)

Office of Communication and Education (OCE) Comprehensive Internal Communications Assessment

1. DESCRIPTION/COMMERICAL ITEM PROCUREMENT

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6- Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. This is Request for Quotation (RFQ) no. FDA-SOL-23- 1267862 for commercial services in accordance with the procedures of FAR Part 12- Acquisition of Commercial Products and Commercial Services, and FAR Part 13- Simplified Acquisition Procedures.

The associated North American Industry Classification System (NAICS) code is 541611- Administrative Management and General Management Consulting Services. The associated small business size standard is $24.5 million.

This is a total small business set-aside solicitation in accordance with FAR Subpart 19.5- Small Business Total Set-Asides, Partial Set-Asides, and Reserves.

2. NOTICE OF FAC

This solicitation document incorporates provisions and clauses in effect through Federal Acquisition Circular (FAC) 2023-04, effective June 2, 2023.

The FAR provisions and clauses referenced in this solicitation can be found on the following website: www.acquisition.gov

The Department of Health and Human Services (HHS) Acquisition Regulation (HHSAR) provisions and clauses referenced in this solicitation can be found on the following website:

https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

3. PURCHASE ORDER REQUIREMENTS

See Section 7, Statement of Work, for a full description of the services to be acquired.

4. ORDER TYPE

The Government anticipates awarding one (1) Firm-Fixed-Price (FFP) type Purchase Order.

5. PERIOD OF PERFORMANCE

The anticipated period of performance consists of one (1) 12-month base period and no http://www.acquisition.gov/ https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

Request for Quotation (RFQ) No. FDA-SOL-23-1267862 Center for Devices and Radiological Health (CDRH)

Office of Communication and Education (OCE) Comprehensive Internal Communications Assessment option periods.

6. PRICING

Anticipated Period of Performance: Base Period (September 25, 2023, through September 24, 2024) Item Description Quantity Unit Unit Price Extended Price Focus Groups 7 EA $ $ Communications Survey 1 EA $ $ Stakeholder Interviews 5 EA $ $ Channel and Content Analysis and Digital Workplace Study 1 EA $ $

Employee Personas 3 EA $ $ Report, Presentation of Findings, and Strategic Summit 1 EA $ $

TOTAL FIRM-FIXED-PRICE (FFP) $

7. STATEMENT OF WORK

STATEMENT OF WORK (SOW)

U.S. FOOD AND DRUG ADMINISTRATION (FDA)

CENTER FOR DEVICES AND RADIOLOGICAL HEALTH (CDRH)

OFFICE OF COMMUNICATION AND EDUCATION (OCE)

COMPREHENSIVE INTERNAL COMMUNICATIONS ASSESSMENT

BACKGROUND

The U.S. Food and Drug Administration (FDA) is responsible for protecting public health by assuring the safety, efficacy, and security of human and veterinary drugs, biological products, medical devices, our nation’s food supply, cosmetics, and products that emit radiation. The FDA is also responsible for advancing public health by helping to speed innovations that make medicines and foods more effective, safer, and more affordable, and by helping the public get the accurate, science-based information they need to use medicines and foods to improve their health.

The mission of the FDA’s Center for Devices and Radiological Health (CDRH) is to protect and promote public health. CDRH assures that patients and providers have timely and continued access to safe, effective, and high-quality medical devices and safe radiation-emitting products.

CDRH provides consumers, patients, their caregivers, and providers with understandable and accessible science-based information about the products it oversees. CDRH facilitates medical device innovation by advancing regulatory science, providing industry with predictable, consistent, transparent, and efficient regulatory pathways, and assuring consumer confidence in devices marketed in the United States.

CDRH’s Office of Communication and Education (OCE) manages communications about medical devices and radiation-emitting products to external audiences, communicating safety as well as benefit and risk information to patients and consumers, health care professionals, industry, and domestic and foreign governments. OCE provides regulated industries with information and education on the regulatory and policy information they need to bring new products to market and remain in compliance with FDA laws. Additionally, OCE manages CDRH-wide internal communications; therefore, work related to this Purchase Order shall support multiple offices throughout CDRH.

OCE requires a Contractor to perform a comprehensive internal communications assessment that will help OCE better understand how CDRH-wide employee messages travel through CDRH and what is working well, and to identify gaps and opportunities for improvement so CDRH can optimize employee messages and channels for employee communications and ensure content is engaging as well as usable and useful.

OBJECTIVE

The objective of this Purchase Order is to procure a comprehensive internal communications assessment performed off-premises (remotely).

SCOPE—DESCRIPTION OF WORK

The Contractor shall provide experts in internal communications; diversity, equity, and inclusion communications; qualitative and quantitative research for communications; and social sciences to design a research strategy and methodology; conduct research and analysis of CDRH internal communication channels and the content in them; and develop specific, feasible recommendations that outline the design, implementation, and measurement of a future state for a strategic communication framework to improve CDRH internal communications. The Contractor shall work with CDRH Technical Experts to make the changes required for improvement, which may include plans to upgrade or eliminate tools and channels, skills training for communicators, training and counsel for communications leaders and managers, and streamlining editorial processes. The six (6) general areas below are expected to be part of this Purchase Order and the comprehensive internal communications assessment:

1. Project management

2. Research strategy and methodology

3. Comprehensive channel and content analysis

4. Digital workplace experience study

5. Employee personas

6. Presentation of findings, recommendations, and a strategic planning summit

The performance of this Purchase Order requires an understanding of and ability to leverage the FDA’s internal messaging, web content, and other digital content and platforms (e.g., Communifire and SharePoint), supporting CDRH’s internal communications for employee communication and engagement.

TASKS

TASK 1 - PROJECT MANAGEMENT

Within fifteen (15) business days following the Purchase Order award date, the Contractor shall conduct a Kick-off Meeting to review Purchase Order goals and objective, and to discuss technical requirements, administrative matters, project transition, reporting requirements, and invoicing. At the meeting, the Contractor shall present their approach to performing the project and timeline for meeting the respective deliverables. The Contractor shall provide summary meeting minutes, detailing the discussion held, and shall provide a copy of the minutes to the Contracting Officer’s Representative (COR) within five (5) business days after the meeting.

Throughout the Purchase Order’s period of performance, the Contractor shall work with the Technical Experts, the FDA’s COR, various CDRH staffers, and/or the Contracting Officer (CO) to ensure that the tasks are performed efficiently, accurately, on time, and in compliance with the requirements of this Statement of Work (SOW).

The Contractor shall coordinate as necessary with the Technical Experts and COR to ensure that the tasks are managed consistently with overall Order requirements.

The Contractor / Project Manager shall be responsible for the following Project Management tasks:

• Prepare and update project management plans and artifacts.

• Monitor adherence to project schedules, milestones, and plans.

• Meeting support (scheduling, developing agendas, and providing minutes).

• Status reporting to the Technical Experts (or designee).

PROJECT WORK PLAN AND SCHEDULE

The Contractor shall prepare the Project Work Plan and Schedule (draft, proposed) and present it during the Kick-off Meeting. The Contractor shall identify which resources will be assigned to each part of the plan and schedule, as necessary to complete this effort. The schedule, at the minimum, shall specify the due date of each deliverable and the due date of any associated revision cycles.

Based on any clarifications and feedback provided by participants at the Kick-off Meeting, the Contractor shall revise and submit the Project Work Plan and Schedule (final) within five (5) business days after the Kick-off Meeting.

CDRH will approve the Project Work Plan and Schedule or provide comments for revision, within ten (10) business days of the Contractor’s delivery of the Project Work Plan and Schedule (final). The Contractor shall work interactively with CDRH to address all issues so that the Project Work Plan and Schedule is in an approvable form and is approved by CDRH within thirty (30) business days after the Kick-off Meeting.

The Contractor shall update the Project Work Plan and Schedule (final) as necessary, as determined by CDRH. The updated Project Work Plan and Schedule shall not take effect until approved by CDRH.

WORKING / PLANNING / STATUS MEETINGS

The Contractor shall schedule, prepare for, conduct, and attend working, planning, or status meetings with CDRH to review the status of task completion, to provide updates on the schedule and any current or anticipated issues, and to accomplish the work described in this Purchase Order. The meetings shall be held regularly or ad hoc, as determined by CDRH.

The meetings shall be held remotely.

The Contractor shall attend additional meetings as needed and at the discretion of CDRH.

The Contractor shall provide meeting minutes to the COR, Technical Experts, and any other designated subject matter experts.

Throughout the performance of this Purchase Order, the Contractor shall be available to attend ad hoc status meetings related to the Purchase Order. For all Status Meetings, the Contractor shall provide meeting minutes within three (3) business days after each meeting.

Monthly Invoices The Contractor shall ensure timely and accurate submission of invoices that will track, at a minimum, the total hours (dollars) used to date on the Purchase Order and remaining funding under the Purchase Order.

Monthly Progress Report The Contractor shall prepare and submit a Monthly Progress Report to the COR, Technical Experts, and any other designated subject matter experts to help track the status of the Purchase Order. The reports shall contain at a minimum:

• Synopsis of tasking

• Status of tasks

• Status of deliverables, which shall include activities and accomplishments, date due/delivered

• Milestones to ensure progression is measured

• Issues (to include any resource-related issues) and expected resolution dates; risks;

mitigation approach

• Planned activities for the next reporting period

• Open technical questions

• Requests for information and documentation

TASK 2- RESEARCH STRATEGY AND METHODOLOGY

The Contractor shall conduct qualitative and quantitative research, using representative samples of CDRH employees, to gather organizational communications data across all functions, find barriers to employee engagement, and understand how CDRH employees can and want to receive internal communications. The research shall consider CDRH’s communication efforts and tactics before, during, and beyond COVID-19, and the impact of a remote, hybrid, and in-person workforce. The Contractor shall incorporate diversity, equity, and inclusion considerations that are specific and unique to CDRH and CDRH internal communications. The Contractor shall develop all research tools and materials necessary to execute research (for example, focus group moderators’ guides, interview guides, surveys, and accompanying messages to launch and promote them), monitor survey responses (as applicable), analyze research results, and write a report of research findings (including charts and graphics to illustrate key findings and recommendations).

TASK 3- COMPREHENSIVE CHANNEL AND CONTENT ANALYSIS

The Contractor shall examine CDRH internal communications content and channels to review the current state and how well the editorial process is working. The Contractor shall consider ways CDRH may change existing content, what CDRH may need to add, and what CDRH may need to stop doing. The Contractor shall assess writing, organization, redundancies, frequency, storytelling, reporting, inclusive language, and presentation in each channel to review the current approach, considering audience research to help the Contractor identify any gaps and recommended improvements. The Contractor shall assess current communications against best practices in writing, editing, design, inclusivity, display, type of message, style, and delivery, with recommendation for improvements. The Contractor shall identify types of communications and communication vehicles that can be upgraded, consolidated, or even discontinued.

TASK 4- DIGITAL WORKPLACE EXPERIENCE STUDY

The Contractor shall perform a deep analysis of CDRH’s intranet platform to better understand the employee perspective on CDRH’s digital workplace. The CDRH Technical Experts will decide whether to include all or some of the following topics in the study:

• How do employees keep up to date with the latest organizational news?

• What do employees feel about the news?

• Where do employees go for trusted content?

• What do they feel about reference content?

• Who are employees working with digitally?

• Do digital tools help employees get tasks done?

• Can employees find what they need?

• How do employees feel about CDRH’s online communities or forums?

• Can employees tailor their digital experience to meet their needs?

• Do the design and user experience (UX) meet employee expectations?

• Does the digital workplace help employees do their job?

At the conclusion of the study, the Contractor shall deliver a report showing where the CDRH digital workplace stands in its employees’ eyes, how is it judged, where is it performing well, where CDRH can best target employees to meet growing expectations, and benchmarks to demonstrate how CDRH compares to other organizations.

TASK 5- EMPLOYEE PERSONAS

The Contractor shall develop CDRH employee personas for use in CDRH internal communications to help inform the best channels, timing, and frequency to target employees, increase engagement, and support or improve morale.

TASK 6- PRESENTATION OF FINDINGS, RECOMMENDATIONS, AND STRATEGIC PLANNING

SUMMIT

The Contractor shall use their research and analysis to inform strategic internal communications planning and help build the framework for CDRH’s new plan.

For the presentation of findings and recommendations, the Contractor shall:

• Create an assessment report for the CDRH communications team.

• Create an executive summary of findings and recommendations to share with the OCE and CDRH leadership teams.

• Present the executive summary and plan to the OCE leadership team in a virtual summit.

• Present assessment findings and recommendations to the communications team.

For the strategic planning summit, the Contractor shall:

• Identify CDRH’s current and future state of communications (big picture, aspirational).

• Review and refine the current editorial approach and process and what, if anything, must change based on the assessment.

• Discuss strengths and weaknesses of content and what, if anything, needs to improve.

• Create CDRH’s communications wish list (for example, new tools, approaches, vehicles).

Determine which tools fit OCE’s budget, meet CDRH’s communication goals, and deliver on CDRH’s internal communications mission.

• Make the business case for collaboration among all communicators, regardless of whether they’re writing for internal or external audiences.

• Build a timeline for changes in three (3) buckets (specifically, short-term, mid-term, and long-term).

QUALIFIED KEY PERSONNEL

The Contractor shall provide qualified key personnel for the below two (2) positions:

Research Lead- Shall possess at minimum a bachelor’s degree and at minimum fifteen (15) years of experience in the field working on qualitative and quantitative research projects, with a focus on communications assessments.

Content Communications Consultant- Shall possess at minimum a bachelor’s degree and at minimum fifteen (15) years of experience of writing, editing, communications research, and communications consulting.

DELIVERABLES

Deliverables are specified in Table 1 below. The Contractor shall deliver all products to the FDA COR, various programmatic staff, and/or the CO, where applicable. Electronic transmission shall be the primary delivery mechanism; however, paper copies shall be provided, as requested.

Electronic copies must be in a format compatible with Microsoft Office 365 and Adobe Acrobat (version 10 or later).

Be advised that the FDA does not accept documents which contain the use of macros. Document submissions required throughout the period of performance of this Purchase Order must not have macro-enabled functionality, and any document delivered having that functionality will be deemed delinquent, if not corrected prior to the due date.

5.1 SUMMARY OF DELIVERABLES AND MILESTONES

Table 1: Deliverables

Task Deliverables Quantity/Frequency Due Date

1 Monthly Invoices Monthly On the fifth (5th) day of each month

1 Kick-Off Meeting One (1) / Once Within fifteen (15) business days after award

Kick-Off Meeting

Minutes

One (1) / Once

Within five (5) business days after Kick-off Meeting.

Project Work Plan and Schedule (draft, proposed)

Project Work Plan and Schedule (final)

One (1) / Once

Once with revisions as required by the FDA

COR

Within fifteen (15) business days after award (at the Kick-off Meeting)

Within five (5) business days after the Kick-off

Meeting

Working/Planning/Status Meetings

Ad Hoc Status Meeting

Minutes

Regular meetings starting after approval of Project Work Plan and Schedule

Ad hoc meetings as required by the COR to accomplish the work.

Frequency of regular meetings determined at Kick-off Meeting

Meeting minutes are due within three (3) business days after meeting

1 Monthly Progress Report Monthly

Once per month (due the fifth (5th) day of the following month)

Research Strategy, Methodology, and supporting materials

Once with revisions as required by OCE and the COR

Due date based upon approved

Project Work Plan and Schedule.

4 Digital Workplace Experience Study Report One (1)/Once

Due date based upon approved

Presentation of Findings, Recommendations, and

Strategic Planning Summit

One (1)/Once

Due date based upon approved

The COR expects that the Final Presentation shall take place at least forty-five (45) calendar days before the Purchase Order end date.

6 Draft Final Report with analysis

Once with revisions as required by OCE and the COR

Due on date of Final Presentation

6 OCE Final Report One (1)/Once Due date based upon approved Project Work Plan and

Schedule.

The OCE COR expects that the Final Report shall be submitted at least thirty (30) calendar days before the Purchase Order end date.

PLACE OF PERFORMANCE

All services shall be provided off-premises. The Contractor shall work remotely using FDA-furnished property on the FDA network.

PERIOD OF PERFORMANCE (POP)

The Period of Performance (PoP) is the 12-month period following the date of award, anticipated to commence on September 25, 2023. The actual PoP will be determined at time of award.

GOVERNMENT-FURNISHED PROPERTY (GFP)

The FDA shall provide the Contractor with a laptop and a Personal Identity Verification (PIV) card (badge) for network access in addition to other software and tools that are provided with the standard laptop image package to a certain number of Contractor personnel. Contractor-owned or personally-owned hardware or software shall NOT be connected to or used on the FDA network.

The Department of Health and Human Services (the “Department”) prohibits the use of unauthorized external information systems to conduct Department business. An authorized external information system is one that is Federally-owned, contracted or used by the Department, or approved for use pursuant to a Department or Operating Division (OpDiv) personally-owned device policy. At no time shall the Contractor use their own device to conduct official Government business.

The Contractor and Government shall maintain an inventory of all Government-Furnished Property (GFP). The Contractor’s list of GFP shall periodically be compared to the Government’s list of GFP as a means of inventory control. At the end of the period of performance, upon termination of the Purchase Order, or upon termination of Contractor personnel, the Contractor and its employees shall return the PIV cards (badges), laptops, and all other GFP.

GOVERNMENT-FURNISHED INFORMATION (GFI)

The FDA will provide the Contractor with existing policy documentation via the COR or Technical Point of Contact (POC). The Government will retain all rights and privileges, including those of patent and copy, to all Government-furnished data and materials (covered by FAR/HHSAR, FDA Clauses). The Contractor shall neither retain nor reproduce for private or commercial use any data or other materials furnished under this Purchase Order (covered by clause). The Contractor agrees not to assert any rights at common law or in equity or establish any claim to statutory copyright in such data. These rights are not exclusive and are beyond any other rights and remedies to which the Government is otherwise entitled elsewhere in this Purchase Order. Moreover, at the conclusion of the Purchase Order (or as Acquisition projects are completed), the Contractor shall ensure all data and information is appropriately returned to the COR. All Contractor personnel working under this Purchase Order shall be required to complete a Non-Disclosure Agreement

GOVERNMENT POINTS OF CONTACT

Contracting Officer (CO)

• Name and Position: Nicholas Bisher, Lead Contract Specialist

• Office: Office of Operations (OO)/ Office of Finance, Budget, Acquisitions, and Planning

(OFBAP)/ Office of Acquisitions and Grants Services (OAGS)/ Division of Acquisition Operations (DAO)/ Service Contracts Branch (SCB)

• Phone: 240.402.2773

• Email: Nicholas.Bisher@fda.hhs.gov

Contract Specialist (CS)

• Name and Position: Melinda Kim, Contract Specialist

• Office: OO/OFBAP/OAGS/DAO/SCB

• Phone: 301.796.0607

• Email: Melinda.Kim@fda.hhs.gov

Contracting Officer’s Representative (COR)

• Name and Position: Laurel Woest, Acquisition Program Specialist

• Office: CDRH/Office of Management (OM)/Division of Acquisition Services (DAS)

• Phone: 240.402.7671

• Email: Laurel.Woest@fda.hhs.gov

Technical Expert

• Name and Position: Kemba Ford, Supervisory Public Health Analyst

• Office: CDRH/OCE/Division of Communication (DC)

• Phone: 301.796.6682

• Email: Kemba.Ford@fda.hhs.gov

• Name and Position: Nikki Jovel, Supervisory Public Health Analyst

• Office: CDRH/OCE/DC/Internal Communication Branch (ICB)

• Phone: 240.402.4234

• Email: Nicole.Jovel@fda.hhs.gov

• Name and Position: Alicia Witters, Supervisory Public Health Specialist

• Office: CDRH/OCE mailto:Nicholas.Bisher@fda.hhs.gov mailto:Melinda.Kim@fda.hhs.gov mailto:Laurel.Woest@fda.hhs.gov mailto:Kemba.Ford@fda.hhs.gov mailto:Nicole.Jovel@fda.hhs.gov

• Phone: 301.796.5846

• Email: Alicia.Witters@fda.hhs.gov

• Name and Position: Brian Lappin, Social Scientist

• Office: CDRH/OCE

• Phone: 301.796.9126

• Email: Brian.Lappin@fda.hhs.gov

Contracting Officer’s Authority The Contracting Officer (CO) identified above has responsibility for ensuring the performance of all necessary actions for effective contracting, ensuring compliance with the terms of the Purchase Order, and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this Purchase Order and is the only person authorized to approve changes to any of the requirements under this Purchase Order; notwithstanding any provision contained elsewhere in this Purchase Order, this authority remains solely with the CO.

No statement, whether oral or written, by anyone other than the CO, shall be interpreted as modifying the terms and conditions of the Purchase Order. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the Purchase Order. The Government will not reimburse the Contractor for any work not authorized by the CO.

COMPLIANCES

Contractor Compliance The Contractor shall be responsible for knowledge of, and compliance with all applicable federal information technology and information management laws, regulations, policies, and standards at the government-wide, HHS, and FDA levels. At the government-wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/. HHS documents are found at:

http://www.hhs.gov/oirm/

GOVERNMENT CLOSURES AND FEDERAL HOLIDAYS

Recognized Federal Holidays – The Contractor is not required to provide on-site services on the following days that are Federal Holidays or on any other day designated as a Federal holiday for the Washington, D.C. area:

New Year’s Day Martin Luther King, Jr.’s Birthday Washington’s Birthday mailto:Alicia.Witters@fda.hhs.gov mailto:Brian.Lappin@fda.hhs.gov http://www.hhs.gov/oirm/

Memorial Day Juneteenth National Independence Day Independence Day

Labor Day Columbus Day

Veterans Day Thanksgiving Day

Christmas Day

Inclement Weather – The Contractor is not required to provide on-site service on days when the Federal Government is closed due to inclement weather. The Contractor is required to follow, as a minimum, other directives issued by the U.S. Office of Personnel Management (OPM) or other such official for late arrivals due to inclement weather (unless otherwise specified in the Purchase Order).

In the event the Federal Government is closed by order of the President of the United States or OPM for any reason, or the agency, the Center or the building is closed for administrative or safety reasons, the Contractor shall follow directives issued by the COR or Contracting Officer concerning reporting for work. In the event of early closings, the Contractor may be approved to leave early at the discretion of the COR and/or local policy.

INVOICING INSTRUCTIONS AND REQUIREMENTS

Health and Human Services Acquisition Regulation (HHSAR) 352.232-71 - Electronic Submission of Payment Requests (FEB 2022)

(a) Definitions. As used in this clause- Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), "Content of Invoices" and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of Clause)

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

a. All Invoice submissions for goods and or services must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

http://www.ipp.gov/ http://www.ipp.gov/vendors/index.htm

b. Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract, or the clause FAR 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

c.

1. The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award for new contracts or date of modification for existing contracts.

2. Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

3. The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

4. If your company is already registered to use IPP, you will not be required to re-register.

5. If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

d. Invoices that include time and materials or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

e. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts. At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred:

• Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

• Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

• Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

• Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

• Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

• Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and http://www.ipp.gov/vendors/index.htm

• Fee - amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

f. Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

g. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

h. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

i. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

j. The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

k. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827- ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories.

Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

• Confidentiality: [ ] Low [ X ] Moderate [ ] High

• Integrity: [ ] Low [ X ] Moderate [ ] High

• Availability: [ ] Low [ X ] Moderate [ ] High

• Overall Impact Level: [ ] Low [ X ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/Purchase Order involves:

[ ] No PII [ X ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries. FDA personnel must also request loaner GFE from the FDA Foreign Travel program for official travel to any foreign country. Please see the FDA IS2P, Appendix T

Government Furnished Equipment for Foreign Travel.

h. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS and FDA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

i. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

j. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

k. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

l. Contract Documentation. The Contractor must use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

m. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with an encryption solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificates from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

n. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the FDA non-disclosure agreement (3398 Form), as applicable.

Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable FDA information security awareness, privacy, and records management training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees must complete FDA information security awareness, privacy, and records management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and FDA policies and standards.

b. All Contractor employees performing on the contract must read and adhere to the Rules of…