22-FDA-RFQ-1250144 Politico Pro Subscription.pdf

FDA-22-RFQ-1250144 Page 1 of 26 Politico Pro Subscription

Offeror Name DUNS

PART 1 – GENERAL INFORMATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR 12.6 and 13as supplemented with additional information in this notice. Quotes are being requested and this announcement constitutes the only solicitation. The Government contemplates issuing a firm fixed-price purchase order resulting from this solicitation. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC 2022-01 dated December 6, 2021.

The associated North American Industrial Classification System (NAICS) code for this procurement is 511110: Newspaper Publishers, with an associated size standard in number of employees of 1,000. This requirement is being solicited as a Full & Open/Unrestricted.

PART 2 – SUPPLIES OR SERVICES AND PRICES/COSTS

Contract Type: The Government intends to issue a firm fixed-price purchase order resulting from this solicitation.

Pricing Table:

Line Item Description Quantity Total Price 1 Base Year: Politico Pro Subscription 4 $ 2 Option Year I: Politico Pro Subscription 4 $ 3 Option Year II: Politico Pro Subscription 4 $ 4 Option Year III: Politico Pro Subscription 4 $

TOTAL $

PART 3 – DESCRIPTION OF REQUIREMENT

Background

One aspect of CTP’s work is to establish and maintain meaningful and appropriate relationships with all stakeholders, including Congress and other government and non-government agencies and organizations, public health organization, the industry, and others to understand their positions on CTP policies and initiatives. In order to be successful in this aspect of the Center’s work, CTP requires efficient access to Politico Pro as it relates to a variety of topics, including FDA’s work in general and on tobacco issues. Politico Pro provides a timely, reliable source of information (high accuracy and frequency), and a format that is easily used. Since 2019, CTP has used the subscription services of Politico Pro as a way to collect data on legislative and regulatory developments in federal and state tobacco control, as well as to receive information on FDA and government-wide initiatives (and stakeholder reactions) that relate to CTP’s work. Many of CTP’s stakeholders, including Congressional

FDA-22-RFQ-1250144 Page 2 of 26 stakeholders, receive information from Politico so it is important that CTP receive the same information to increase our understanding of stakeholder perspectives and to know the information that Congressional staff are receiving and likely reading. For example, during a Congressional briefing, Congressional staff have referenced articles in Politico that are relevant to CTP’s work. It is important that we have timely access to this information so we are prepared to engage with Congressional staff when they raise issues reported by Politico. CTP would like to maintain access to timely and efficient information in order to continue to successfully perform this aspect of the Center’s work.

Objective

The purpose of this order is to purchase the online publication Politico Pro subscription services. The CTP/OCD requires the online subscription system access to receive breaking news and real time reporting, exclusive content, and to track federal and state legislative and regulatory developments as it relates to tobacco. This online subscription system access shall be able to provide bill tracking, breaking congressional news, and access to legislative and regulatory summaries, reports, and archives.

Scope of Work

Online subscription for 4 employees to access Political information displayed in a user-friendly format with easy navigation, timely updates, one-stop concise access to the following features:

A Politico Pro license grants access to the platform’s content, tools and resources within an all-inclusive pricing model. The Pro experience is completely customizable, giving users the ability to select specific policy areas to track and determine the format and frequency of the content they receive.

A Politico Pro subscription includes:

Pro Edge Platform Pro Edge is a next-generation policy intelligence platform that’s seamless, smart, and personalized, giving you access to Pro’s unrivaled policy intelligence.

Access to news across 22 Policy Areas

Through the Pro Edge platform, access all news across 22 coverage areas. Pro’s reporters are closely covering a range of issues – from Budget & Appropriations, Healthcare and Cannabis to name just a few – at both the state and federal level. State level reporting is currently available in New York, New Jersey, Florida and California.

Flexible Subscription Credits

Users can use subscription credits to re-align the coverage they receive in their inbox at any time. All users will have 14 subscription credits in their account.

Users will always be able to read news from all 22 policy areas on the site.

Policy Tools

Directories Congressional, Agency and States

Our Directories keep subscribers connected with House and Senate offices, state legislatures and federal agencies. Export lists and information for any external outreach purposes.

Document Drawer Document Drawer is our primary source depository, that houses 100% of committee hearing transcripts, CRS Reports, agency documents, and more.

FDA-22-RFQ-1250144 Page 3 of 26

Legislative Tracking

Our Legislative Compass is your one-stop-shop for all federal and state bill tracking, with in-depth analysis and search alert functionality.

Regulatory Tracking

Our Regulatory Compass gives you the ability to identify any and all rules/regs/notices impacting your organization and operations – at both the federal and state level.

Policy Calendar Gain access to an industry event calendar, including fly-ins, think tank forums, agency meetings, hearings, markups, and exclusive subscriber-only events.

Campaign Pro Race Dashboard

POLITICO Pro Campaigns helps you keep your finger on the pulse of every race in Senate, House, Gubernatorial and Presidential elections.

Projects Projects is a new collaborative project management tool that helps you streamline your workflow and bring all your policy work into a single destination for you and your team as you work to achieve your policy priorities and goals.

Exclusive Content

COVID-19

Coverage Round-up

This daily roundup provides a summary of top COVID-10 coverage from across our entire policy news operation nationwide.

The Fifty Coverage Roundup

Delivered every Thursday, this newsletter brings together stories covering how power players in state and local governments are driving politics, shaping policy, and influencing Washington.

Transition Playbook

Exclusive newsletter tracking the appointments, the people and the power centers of the next administration.

Day Ahead Receive a rundown of the day’s developments on Capitol Hill, schedule of House and Senate floor, as well as President and VP’s schedule.

Policy Newsletters, Articles & Alerts

Access to policy area newsletters, articles and alerts for which subscription credits have been applied.

Access to Subscriber Exclusive Events

Exclusive speaker events, conference calls with our reporting teams, panel discussions featuring opinion leaders in media, federal/local government, and private industry.

A. Technical Support Requirements:

Technical support to troubleshoot connectivity issues, user accounts and access. Support is required during normal business hours (8:30a - 5:00p Eastern Time, Monday - Friday, excluding Government holidays).

B. Training Requirements:

FDA-22-RFQ-1250144 Page 4 of 26

Dedicated account manager who serves as a resource for CTP/OCD throughout the year, providing on-call support for questions, additional tutorials, and updates on upcoming policy briefings.

6. Period of Performance

Base Year: 1/2/2022 – 1/1/2023 Option Year 1: 1/2/2023 – 1/1/2024 Option Year 2: 1/2/2024 – 1/1/2025 Option Year 3: 1/2/2025 – 1/1/2026

7. 508 Requirements

Section 508 Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) required Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Tile 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third application regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites – including text, audio or video – must confirm to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content unintended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below, Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must confirm to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/

FDA-22-RFQ-1250144 Page 5 of 26

Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002); http://csrc.nist.gov/policies/FISMA-final.pdf.

The following Section 508 provisions apply to the content identified in this SOW:

o Must meet WCAG 2.0 A and AA o E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements) o E203 Access to Functionality (Appendix A, Application and Scoping Requirements) o E204 Functional Performance Criteria (Appendix A, Application and Scoping

Requirements) o E205 Electronic Content (Appendix A, Application and Scoping Requirements) o 302 Functional Performance Criteria (Appendix C, Functional Performance Criteria and

Technical Requirements) o Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

o E207 Software (Appendix A, Application and Scoping Requirements) o E208 Support Documentation and Services (Appendix A, Application and Scoping

Requirements) o Chapter 5 Software (Appendix C, Functional Performance Criteria and Technical

Requirements) o Chapter 6 Support Documentation and Services (Appendix C, Functional Performance

Criteria and Technical Requirements)

8. Security Requirements

A.

Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

http://508.hhs.gov/ https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html

FDA-22-RFQ-1250144 Page 6 of 26

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Complete this section using the information obtained from the Security and Privacy Checklist in Appendix A, parts A and B.

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

FDA-22-RFQ-1250144 Page 7 of 26 are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

FDA-22-RFQ-1250144 Page 8 of 26

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including

PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf

FDA-22-RFQ-1250144 Page 9 of 26

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send FDA approved notifications to affected individuals as directed by FDA’s SOP.

FDA-22-RFQ-1250144 Page 10 of 26

3) Report all suspected and confirmed information security and privacy incidents and breaches to the FDA Systems Management Center, COR, CO, and other stakeholders, (Recommend adding the FDA Senior Official for Privacy with contact information and either defining or deleting “other stakeholders.”) including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour of discovery/detection, and consistent with the applicable FDA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum:

company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information and HHS and FDA incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation demand.

C. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract: [See the FDA Security Article, entitled Contractor Personnel Security Clearance Standards and Residency Requirements for the Position Risk Designation Tier(s) (i.e., 1, 2, and/or 4) that apply to this award.]

D. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster and any revisions to the roster as a result of staffing changes shall be submitted to the COR and/or CO per the COR or CO’s direction. Any revisions to the roster as a result of staffing changes shall be submitted within a timeline as directed by the COR

FDA-22-RFQ-1250144 Page 11 of 26 and/or CO. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

E. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the FDA EPLC framework and methodology in accordance with the FDA EPLC Project documentation, located here:

http://sharepoint.fda.gov/orgs/DelMgmtSupport/IntakeProc/EPLCv2/SitePages/v2/EPLCHome.a spx HHS EA requirements may be located here:

https://www.hhs.gov/about/agencies/asa/ocio/index.html

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with FDA OAGS SMGs to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization and FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR as soon as it is known that an employee will stop working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or FDA policies.

F. Records Management and Retention

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/FDA policies and shall not dispose of any records unless authorized by HHS/FDA.

FDA-22-RFQ-1250144 Page 12 of 26

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/FDA policies.

PART 4 - PACKAGING, MARKING and SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and contractor name. The contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition. All delivered equipment shall be newly manufactured, not used or refurbished or previously used for demonstration.

PART 5 – INSPECTION AND ACCEPTANCE

The Program Office POC will perform inspection and acceptance of all products and services. The performance criteria for these products shall be timely delivery and closure of all activities and deliverables listed above and within the established period of performance.

Inspection and acceptance will occur at the place of delivery. Inspection will include verifying all parts were received and warranties and services are in place. The Government will accept goods and services only if they conform to all terms and conditions of this order. The Government will provide written notification of acceptance or rejection within ten (10) business days of receiving the delivery.

The Government will reject non-conforming products and services. The contractor shall correct any deficiencies within thirty (30) days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the technical POC of the reason for the delay and provide a proposed corrective action plan within ten (10) business days.

PART 6 – DELIVERIES OR PERFORMANCE

The Vendor shall deliver the list of licensed CTP users via e-mail to the COR by 1/2/2022. The COR will then assess the delivery and provide acceptance.

All emails will be delivered to the point of contact identified between the COR and vendor. Access to the Politico Pro Online Subscription given to CTP licensed users identified by the COR.

The contractors’ performance shall take place at the contractor’s facility. However, the contractor’s technical staff/ help desk staff shall be contacted via telephone and email for help desk support as outlined in the “Technical Support Requirements” section above.

PART 7 – CONTRACT ADMINISTRATION DATA

The following personnel shall represent the Government for the purpose of this contract:

Technical Representative:

FDA-22-RFQ-1250144 Page 13 of 26

To be determined upon contract award

The Technical Representative is responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

Contract Specialist (CS): Contracting Officer (CO):

Contract Specialist Contracting Officer Valrica Manns Peter Lee U.S. Food and Drug Administration 4041 Powder Mill Road U.S. Food and Drug Administration 4041 Powder Mill Road Beltsville, MD 20705 Beltsville, MD 20705 Phone: 301-837-7506 Phone: 240-402-4287 Email: Valrica.Manns@fda.hhs.gov Email: Peter.Lee@fda.hhs.gov

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to (1) Direct or negotiate any changes in the order;

(2) Modify or extend the period of performance; (3) Change the delivery schedule; (4) Authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) Otherwise change any terms and conditions of this contract.

Payment Schedule:

Unless otherwise agreed to by the Technical POC, the Contractor shall submit invoices subsequent to the delivery of the required services.

FDA Three-Way Match Invoicing Procedures:

A. The contractor shall submit all invoices to:

U.S. FOOD AND DRUG ADMINISTRATION

Attn: Vendor Payments Division of Payment Services 10903 New Hampshire Ave WO32 - Second Floor

MAIL HUB 2145

Silver Spring, MD 20993-0002 301-827-3742 FDAVendorPaymentsTeam@fda.hhs.gov

*** Acceptable methods of delivery include: E-mail (preferred) and Standard Mail.

B. Invoices submitted under this contract must comply with the requirements set forth in FAR Clauses 52.232-25 (Prompt Payment) and 52.232-33 (Payment by Electronic Funds Transfer - System for mailto:FDAVendorPaymentsTeam@fda.hhs.gov

FDA-22-RFQ-1250144 Page 14 of 26

Award Management) and/or other applicable FAR clauses specified herein. To constitute a proper invoice, the invoice must be submitted on company letterhead and include each of the following:

(i) Name and address of the contractor;

(ii) Invoice date and invoice number;

(iii) Contract/Order number (including a reference to any base award for Indefinite-Delivery/Indefinite- Quantity Contracts or Blanket Purchase Agreements);

(iv) Description, quantity, unit of measure, unit price, and extended price supplies delivered or services performed, including:

(a) period of performance for which costs are claimed;

(b) itemized travel costs, including origin and destination;

(c) any other supporting information necessary to clarify questionable expenditures;

(d) the contractor shall include the award item number for each description, quantity, unit of measure, unit price, and extended price supplies delivered or services performed;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on government bill of lading;

(vi) Terms of any discount for prompt payment offered (Prompt Payment terms other than NET 30);

(vii) Name and address of official to whom payment is to be sent (must be the same as that in the purchase order/award, or in a proper notice of assignment)

(viii) Name, title, and phone number of person to notify in event of defective invoice;

(ix) Taxpayer Identification Number (TIN);

(x) banking routing transit number of the financial institution receiving payment for Electronic funds transfer (EFT);

(xi) Name and telephone number of the FDA Contracting Officer Representative (COR) or other Program Center/Office point of contact, as referenced on the award;

(xii) For all Inspections, Time-and-Materials and Labor-Hour Awards, Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance;

(xiii) Any other information or documentation required by the award.

C. An electronic invoice is acceptable if submitted in adobe acrobat (PDF) format. All items listed in

(i) through (xiii) of this clause must be included in the electronic invoice. Electronic invoices must be on company letterhead and must contain no ink changes and be legible for printing.

D. Questions regarding invoice payments should be directed to the Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

mailto:ERIC@fda.hhs.gov

FDA-22-RFQ-1250144 Page 15 of 26

PART 8 – CONTRACT PROVISIONS AND CLAUSES

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): https://acquisition.gov/far/

52.204-13 – System for Award Management Maintenance (Oct 2018) 52.204-18 – Commercial and Government Entity Code Maintenance (Aug 2020) 52.212-4 – Contract Terms and Conditions – Commercial Items (NOV 2021) 52.232-39 – Unenforceability of Unauthorized Obligations (Jun 2013) 52.232-40 – Providing Accelerated Payments to Small Business Subcontractors (NOV 2021)

52.217-9 Option to Extend the Term of the Contract.

OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within at any time provided that the Government gives the Contractor a preliminary written notice of its intent to extend at any time before the contract expires. The preliminary notice does not commit the

Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed four (4) years.

(End of clause)

(End of clause)

CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS-COMMERCIAL ITEMS

(NOV 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing https://acquisition.gov/far/ https://www.acquisition.gov/far/52.203-19#FAR_52_203_19

FDA-22-RFQ-1250144 Page 16 of 26

Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021 ) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUNE 2020), with Alternate I (OCT 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

_X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV 2021) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (NOV 2021) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) (41 U.S.C. 2313).

https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-15#FAR_52_203_15 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.204-15#FAR_52_204_15 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.209-9#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim

FDA-22-RFQ-1250144 Page 17 of 26

__ (10) [Reserved].

__ (11)

52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (SEPT 2021) (15 U.S.C. 657a).

___ (12)

52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (SEP 2021) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (13) [Reserved]

__ (14)

(i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17)

(i) 52.219-9, Small Business Subcontracting Plan (NOV 2021) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (NOV 2016) of 52.219-9.

__ (iii) Alternate II (NOV 2016) of 52.219-9.

__ (iv) Alternate III (JUN 2020) of 52.219-9.

__ (v) Alternate IV (SEP 2021) of 52.219-9

__ (18)

(i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (MAR 2020) of 52.219-13.

__ (19) 52.219-14, Limitations on Subcontracting (SEP 2021) (15 U.S.C. 637(a)(14)).

https://www.acquisition.gov/far/52.219-3#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/52.219-4#FAR_52_219_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6…