A1b PWS_TRDT Support_v3.docx

Performance Work Statement Title: Technology Research and Development Team (TRDT) Support

Period of performance of this contract is: One (1) 12-month Base Period, plus Four (4) 12-month Option Periods

SECTION 1 – BACKGROUND

The mission of the Office of the Chief Information Officer (OCIO) is to administer the Centers for Disease Control and Prevention's (CDC) information resources and information technology programs including collection, management, use, and disposition of data and information assets; development, acquisition, operation, maintenance, and retirement of information systems and information technologies; IT capital planning; enterprise architecture; information security; education, training, and workforce development in information and IT disciplines; development and oversight of information and IT policies, standards, and guidance; as well as the administration of certain other general management functions and services for CDC.

The Technology Research and Development Team (TRDT) is located within the Technology Modernization Office (TMO) of the Office of the Chief Information Officer (OCIO). Its mission is to (1) collaborate with CDC programs and external partners to develop innovative technologies and techniques to positively impact public health practice; (2) execute OCIO's technology research and development agenda in support of advancing public health programs and enterprise IT; (3) prototype products and processes and gather user feedback to evaluate and refine big ideas to prioritize investments; (4) transition new technology-based solutions, standards, and techniques to programs for deployment and implementation; (5) provide consultation, evaluation, guidance, and support in the use of new informatics solutions and architectures; (6) rapidly define problems, create prototypes, conduct pilot projects, and examine and test hypotheses to support information technology solutions; and (7) participate and represent the agency on technology innovation committees, workgroups, organizations, and councils, within CDC and with other federal agencies.

SECTION 2 – PURPOSE/OBJECTIVE

This effort will provide the capacity for technology innovation, given the rapidly changing field of technology research and development. Specifically, it will enable the TRDT to rapidly evaluate, test, and prototype new tools and technology to positively impact public health activities.

The contractor shall provide consultation, evaluation, guidance, and support of the use of new information technology and health information technology (informatics) solutions and architecture while working directly with customers & end-users. The contractor shall also assist in the transitioning of new technology-based solutions, standards, and techniques to public health programs for deployment and implementation. From a technology infrastructure perspective, contract staff will support the delivery of the Technology Research and Development’s on premise/hybrid Research & Development Cloud resources, enabling CDC staff to more efficiently and effectively investigate and test innovative technologies. This task order will enhance the use of technology, tools and techniques to improve health through innovation.

SECTION 3 – SCOPE OF WORK

The TRDT is a resource for CDC and its public health partners, that identifies, studies, models, and tests new and innovative technology-based tools, approaches, best practices and resources to maximize programmatic public health impact.

a. The contractor shall be responsible for supporting TRDT in providing CDC and its external partners (academic, industry, public health, healthcare, etc.) consultation, evaluation, guidance, support, and insight into the use of new public health IT / informatics solutions for public health practice. Core to these activities will be the contractor supporting TRDT’s activities focusing on maximizing end-user input/feedback.

b. The contractor shall be responsible for supporting TRDT’s rapid technology innovation prototyping activities, leveraging tools such as Sketch and/or Balsamiq mockups. The types of prototypes to be created include paper, low fidelity non-functional, low fidelity functional, high fidelity non-functional, and high fidelity functional.

c. The contractor shall be responsible for carrying out its technology innovation development activities leveraging a collaborative, agile development approach (scrum) to engage program stakeholders directly using multiple rapid iterations of created prototypes. These prototypes can be used for an internal evaluation within the TRDT or an investigation in partnership with a public health program within CDC or its external partners. This development approach leverages a cross-functional mixture of web & mobile software development hardware, network engineering, computer science, clinical public health informatics, human centered design, and user experience design.

d. The contractor shall be responsible for supporting / maintaining a flexible and scalable on-premise / hybrid cloud environment ("the TRDT R&D Cloud") for the rapid prototyping / proof of concept development of public health technology/informatics solutions for testing and evaluation purposes. This resource is to be available for TRDT, OCIO, CDC, and its partners. The operation of this cloud leverages a mix of both vendor specific hardware and software technologies as well as open source software technologies.

e. The contractor shall be responsible for sharing the insights and knowledge gained, within TRDT, via web-based blogs/wikis, information sharing sessions, meetings, presentations, peer-reviewed publications, and other channels; Prototype results and descriptions are shared through many channels (where appropriate), including written reports, presentations, or web-based contented shared on TRDT’s internet / intranet sites. The contractor will support TRDT in preparing mature proof of concept technologies and pilots for translation / hand-off to production teams within CDC

SECTION 4 – TASKS TO BE PERFORMED

4.1 TASK 1 – TRDT RAPID PROTOTYPE / EMERGING TECHNOLOGY / PROOF OF CONCEPT DEVELOPMENT

a. The contractor shall provide support to TRDT in the area of rapid prototype development. This activity is carried out via web-based and mobile application development, user experience/human centered design (HDC), computer-user interface design, graphic design, software and cloud architecture, continuous integration/continuous delivery (CI/CD), database design (relational, NoSQL, graph databases, etc.), data science/informatics/data analytics, hardware device customization (i.e., Internet of Things), agile project management (i.e., scrum), health communications, network engineering, privacy enhancing technologies (e.g., homormorphic encryption) and IT system administration.

1) The contractor, on a monthly basis, shall provide a 1-page summary document containing the design, development and prototype activities to TRDT personnel suitable for sharing with internal and external collaboration partners.

b. The contractor shall provide this support leveraging both industry standard (e.g., client and server-side architecture and programming languages, cloud computing, responsive design, open source, and flat design) as well as new and emerging tools and technologies (e.g., node.js, D3.js, react, GraphQL, python, javascript, .NET core, Web3, containerization, data pipelines (e.g., LangChain), platforms such as databricks and Palantir, microservices, traditional and novel databases (e.g., relational, graph, NoSQL), artificial intelligence & machine learning – including both traditional and generative AI).

c. The contractor shall develop both non-functional and functional prototypes. These developed prototypes will be of low-fidelity and/or high-fidelity quality - depending on the type of project / prototype undertaken by TRDT. Approximately two to three prototypes will be created/supported on a monthly basis.

d. The contractor shall assist and support in collaboration with the R&D team to create functional mockups. The functional mockups will include the source code, runtime, and all graphical elements of design. The both non-functional and functional prototypes will facilitate the rapid collection of user requirements.

e. The contractor shall perform web application development activities leveraging industry standards as well as emerging tools and technologies (examples of technologies to be used include, node.js, D3.js, react, Web3, microservices, javacript, python, GraphQL, .NET core, relational and NoSQL databases, data/analytic pipelines (e.g., LangChain), and cloud services (e.g., Azure). User experience design activities will involve mockup development, leveraging tools such as Balsamiq mockups, and user feedback techniques (e.g., user testing, questionnaire development, collecting and analyzing performance metrics).

f. The contractor shall perform agile project management activities which follow the scrum methodology including the development and collection of user stories, product backlogs, running daily standup meetings, bi-monthly sprint review meetings, and using tools, such as JIRA, to collect and organize user stories in the sprints and backlog. The contractor shall carry out industry standard code management and documentation processes. The contractor shall perform interim and formal prototype releases - occurring in coordination with the end of sprint cycles. Sprint cycles will vary based on project scope and will occur in 2 to 4 week intervals.

g. The contractor shall perform health communications activities which will involve the development of white papers, internet and intranet site updates, communications plans, press releases, presentations, product fliers, media interview facilitation and coordination, and social media updates.

h. The contractor shall perform Network engineering and IT system administration will involve the customization, support and maintenance of both virtual and physical Windows and Linux-based servers to optimize the prototype tools and systems running on them.

1) The contractor shall:

i. Perform activities in the maintenance and support of the TRDT R&D Cloud (a flexible and scalable on-premise / hybrid cloud environment) - based on VMware, Nutanix, NetApp, Cisco Nexus networking, and other open source-based cloud technologies.

ii. Perform the daily monitoring of the health of the overall system - including assuring that software versions are appropriately updated, and that storage hardware has adequate available space. In addition, backup and recovery resources require daily examination and testing. From a security operations and maintenance standpoint, monitoring of anti-virus protection status, administration of firewalls policies, assurance of software updates, and quarantining of viruses, examining of firewall logs is required daily- with monthly reporting to the OCIO Security Team (within CSPO).

iii. Create documentation of the processes involved in the daily operation and maintenance of the TRDT R&D Cloud, and the implementation and testing of cloud automation tools to improve user experience.

i. The contractor, on a monthly basis, shall perform an environmental scan / horizon scanning of new and emerging technologies – with a potential impact on the practice of public health. Findings gathered from this scanning will be shared with TRDT staff every 6 to 8 weeks – in the form of an oral presentation and or written briefing / report.

4.2 TASK 2 (OPTIONAL): ADDITIONAL TRDT FOCUSED SOFTWARE APPLICATION DEVELOPMENT SUPPORT Contingent upon the availability of funding, leveraging many of the existing processes and resources generated from TASK 1, the contractor shall develop a smaller scale technology project using agile development methods. This project will require web-based application development, software architecture, database design (involving both relational and NoSQL databases).

a. The contractor shall provide this support leveraging both industry standards (e.g., client and server-side programming languages, cloud computing, responsive design, and open source) as well as new and emerging tools and technologies (e.g., D3, NoSQL, React, javascript, GraphQL, python, .NET Core, Web3, data pipelines leveraging AI, etc.). Development will follow the Scrum Agile project management methodology.

b. The contractor shall carry out agile project management used for the project. The activity will involve following the scrum methodology including the development and collection of user stories, product backlogs, running daily standup meetings, bi-monthly sprint review meeting, and using tools, such as JIRA, to collect and organize user stories in the sprints and backlog. Industry standard code management processes will be implemented. For example, The contractor, on a weekly basis, shall carry out sprint review meetings to TRDT personnel– to evaluate all tasks (user stories) selected the week before, and evaluate the next tasks to be selected for the following week.

c. The contractor shall develop at least one non-functional and functional prototype. These developed prototypes will be of low-fidelity and/or high-fidelity quality - depending on the type of project / prototype undertaken by TRDT. Functional mockups will include the source code, runtime, and all graphical elements of design. Both the non-functional and functional prototypes will facilitate the rapid collection of user requirements.

d. The contractor shall perform web application development activities leveraging industry standards as well as emerging tools and technologies (examples of technologies to be used include, node.js, D3.js, react, Web3, microservices, javacript, python, GraphQL, .NET core, relational and NoSQL databases, data/analytic pipelines (e.g., LangChain), and cloud services (e.g., Azure). User experience design activities will involve mockup development, leveraging tools such as Balsamiq mockups, and user feedback techniques (e.g., user testing, questionnaire development, collecting and analyzing performance metrics).

e. The contractor shall carry out the hosting of the solution leveraging both local as well as off-premises cloud resources- as directed. Specifically, both Windows and Linux-based servers will be used to optimize the tools and systems running on them.

4.3 TASK 3 (OPTIONAL): TRDT CONSULTATION AND TECHNICAL SUPPORT

Contingent upon the availability of funding, the contractor shall provide consultation, guidance, as well as technical support on select technology projects. These include:

a. The area of emerging technology trends and industry standards (e.g., artificial intelligence, machine learning, natural language processing, data science/informatics, data pipelines, data analytics, robotic process automation, Web3, microservices architecture, differential privacy, secure multiparty computation, homomorphic encryption, and quantum computing).

b. The area of technical web based and mobile application development, including project processes, objectives, and execution, database design (relational, NoSQL, graph databases, etc.), iOS expertise (including objective C and Swift) and Android OS mobile application development expertise.

c. The area of project management principles for the IT product development lifecycle. This includes requirements, efficiencies, technical development, user experience, and execution. Specifically, it can include support and guidance on the documents required for submission for CDC’s Enterprise Performance Lifecycle (EPLC) as well as for CDC’s Security Assessment and Authorization (SA&A) process.

d. The area of IT product communication includes the development and/or review of communication plans, training documentation, press releases, product fliers, media interview facilitation and coordination, and social media updates.

e. Documentation of technology processes and project technical details. Examples include technical architecture diagrams, data use agreements, code repository management and continuous integration processes.

SECTION 5 – GOVERNMENT FURNISHED PROPERTY

The CDC will not provide smartphones or similar equipment to The contractors. Additionally, CDC will only provide computers, printers, etc., to contractor employees working on-site or require specific LAB devices for R&D or testing purposes. For contractor employees working off-site, the CDC will not provide GFE, except when necessary for access to the CDC network via VPN, and Leased Line. For access via CITGO the CDC will only provide key fobs.

SECTION 6 – PLACE OF PERFORMANCE AND CONTRACT SUPPORT HOURS

SUBSECTION A – PLACE OF PERFORMANCE

The majority of work on this task order will be completed off-site, with contractors located at their own facilities. A portion of the work on this task order may also be completed on-site at CDC facilities.

SUBSECTION B – CONTRACT SUPPORT HOURS

No specific/non-standard hours of support are required.

SECTION 7 – TRAVEL

Travel will be in accordance with / and not to exceed the Federal Travel Regulation rates. Travel costs need to be approved in advance by the COR. The contractor shall be required to provide their travel policy with the Government for review.

Travel does not include conferences. Conference Approval Management Systems (CAMS) approval is required in advance of any travel for conferences. If the need for conference travel occurs, the contract will be modified to separately add funding.

SECTION 8 – DELIVERABLES/REPORTING SCHEDULE

4.1.c

4.1.c

4.1.d

4.1.e

4.1.e

4.1.e

4.1.f

4.1.g

4.2.a

a) Deliverables with similar due dates, such as weekly/monthly, may be combined into a single document with COR approval to minimize the number of documents sent and stored. As HHS or CDC adds or changes existing applications requiring interfaces or integration, additional deliverables consistent with deliverable details above will be required for those interfaces and integration efforts.

b) All deliverables shall be presented in an electronic format and produced utilizing current versions of Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Visio and Microsoft Project software, as appropriate. Other software may be used with COR’s approval.

c) While the Government is including a quality assurance surveillance plan (QASP) in the performance matrix below, the Government is also requesting the offeror submit a proposed Quality Assurance Plan (QAP) after the award. The Government and The contractor will perform a final inspection and acceptance of work performed, including reports and documentation regarding that work. Progress will be tracked in the monthly status reports and weekly project meetings.

d) Final inspection and acceptance of all work performed, reports, and other deliverables will be performed by the COR. Inspection and acceptance will occur in accordance with Federal Acquisition Regulation (FAR) 52.212-4(a). In the absence of other agreements negotiated with respect to time provided for Government review, deliverables will be inspected, and The contractor notified of the COR’s findings within five (5) workdays of normally scheduled review. If the deliverables are not acceptable, the COR will notify The contractor immediately.

Performance by the contractor to correct defects found by the Government as a result of quality assurance surveillance and by The contractor as a result of quality control, must be at its own expense and without additional reimbursement by the Government. Unless otherwise negotiated, The contractor must correct or replace all non-conforming services or deliverables no later than five (5) workdays after notification of non-conformance.

e) Within five (5) business days following the task order award date, The contractor shall attend a Post award Orientation meeting to review the task order goals and objectives. The contractor shall be prepared to discuss the technical requirements, administrative matters, security requirements, project transition Government Furnished Information/Materials/Equipment (GFI/GFM/GFE), milestone schedule, review cycles, and invoicing. At the meeting The contractor shall present their transition plan, and task management plan. The meeting shall be attended by all contractors identified by key personnel, CO, COR and all CDC TMs. The meeting location will be determined by the Government. The contractor shall record detailed minutes of this meeting and provide a completed copy to the CO and COR within five (5) business days.

f) The Monthly Staffing Report (MSR) shall be prepared by The contractor and delivered to the CDC COR via email unless otherwise agreed upon. Each report shall be submitted at the time of invoicing. The MSR shall contain the following information:

· Brief description of requirements.

· Brief summary of accomplishments during the reporting period and significant events regarding the task order.

· Deliverables submitted or progress on deliverable products.

· Any current or anticipated problems and proposed solutions.

· Brief summary of activity planned for the next reporting period.

· Staffing Lists- The staffing list shall be by task number, with contractor employee name, labor category, managers name, physical location. Reports shall include vacancies and updates of new hires and departing staff.

g) All documents and materials developed by The contractor for the fulfillment of this contract, including all SOPs, manuals, security plans, management plans and plans of operations, software and code, and hardware shall be considered the property of the Government and may be disposed of by the Government in any manner at the Government’s discretion.

SUBSECTION A – PERFORMANCE MATRIX

The table below lists the Government’s necessary performance outcomes, services, and quality standards. The contractor must satisfy to meet performance standards for the requirements and tasks in this PWS. The COR shall be responsible for the oversight of the Task Order’s performance. The Technical Monitors providing day-to-day assistance with the performance of specific tasks in this Task Order will provide input to the COR of The contractor’s performance in the tasks for which they are monitors.

Deficiencies resolved by designated dates.

www.techlab.cdc.gov

SECTION 9 – ADDITIONAL REQUIREMENTS

Information Security and Privacy

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

6) Confidentiality and Nondisclosure of Information. Any information provided to The contractor (and/or any subcontractor) by HHS or collected by The contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of The contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by The contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The contractor shall use templates provided, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The contractor (and/or any subcontractor) shall:

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

B. TRAINING

C. RULES OF BEHAVIOR

D. INCIDENT RESPONSE

The contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/CDC CSIRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, The contractor (and/or any subcontractor) shall:

E. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

F. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12

The contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12) Roster. The contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where The contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within the CDC Specified timeline of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify The contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, The contractor shall provide a position description and the Government will determine the appropriate suitability level.

G. CONTRACT INITIATION AND EXPIRATION

H. RECORDS MANAGEMENT AND RETENTION

The contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/CDC policies and shall not dispose of any records unless authorized by HHS/CDC.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/CDC policies.

1. Security Requirements for GOCO and COCO Resources:

a. Federal Policies. The Contractor (and/or any subcontractor) must comply with applicable federal laws, directives and CDC policies that include, but are not limited to, HHS Information Security and Privacy Policy (IS2P), the CDC IT Security Program Implementation Standards, Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C.