Attachment_1_280-15-0451_Statement_of_Work.docx

Statement of Work

Project Title: “National Training and Technical Assistance Center for Child, Youth and Family Mental Health (NTTAC)”

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government as needed to perform the Statement of Work below:

A. BACKGROUND INFORMATION:

Created in 1992, the Substance Abuse and Mental Health Services Administration (SAMHSA) is a public agency within the U.S. Department of Health and Human Services (HHS). SAMHSA's mission is to reduce the impact of substance abuse and mental illness on America's communities by supporting and promoting evidence-based mental and substance use disorders prevention, treatment, and recovery support services. SAMHSA has delineated six Strategic Initiatives to guide priorities, programs, and budgetary decisions. This work is part of SAMHSA’s Recovery Support Strategic Initiative (RSSI), which includes a working definition of recovery, as follows:

Recovery is a process of change through which individuals improve their health and wellness, live a self-directed life, and strive to reach their full potential.

SAMHSA’s Recovery Support Strategic Initiative has further delineated four major dimensions that support a life in recovery:

Health - Overcoming or managing one’s disease(s) or symptoms—for example, abstaining from use of alcohol, illicit drugs, and non-prescribed medications if one has an addiction problem or the use of clinical medical treatment for a mental illness— and for everyone in recovery, making informed, healthy choices that support physical and emotional wellbeing.

Home - A stable and safe place to live.

Purpose - Meaningful daily activities, such as a job, school, volunteerism, family caretaking, or creative endeavors, and the independence, income and resources to participate in society.

Community - Relationships and social networks that provide support, friendship, love, and hope.

The core elements of health, home, purpose, and community—are central to recovery from mental health disorders across the lifespan.

Within SAMHSA, the Center for Mental Health Services (CMHS) provides leadership in the design of national goals and establishment of national priorities for the prevention of mental illness, and the promotion of mental health. Furthermore they are responsible for the development of improved methods of treating individuals with mental health problems and improved methods of assisting the families of such individuals.

Within CMHS, the Comprehensive Community Mental Health Services for Children with Serious Emotional Disturbances also known as the Children’s Mental Health Initiative (CMHI), provides grants and cooperative agreements to States, political subdivisions of States, American Indian Tribes or tribal organizations, the District of Columbia and territories, to develop, implement expand and sustain systems of care that meet the needs of children and adolescents with serious emotional disturbances (SED) and their families. The program was first authorized in l993 under the Public Health Service Act, Part E, Sections 561-565. The program was re-authorized under the Child Health Act 2000. Under this authority, SAMHSA administers an average of 61 system of care grants and cooperative agreements per year. The authorizing legislation (Sec. 565 (B)) states, “The Secretary shall….provide to the entity training and technical assistance (TA) with respect to the planning, development, and operation of systems of care pursuant to section 290-ff-1 of this title.” There are currently 88 CMHI funded sites.

SAMHSA’s CMHS’ Child Adolescent and Family Branch has the primary mission of planning, implementing, sustaining and evaluating infrastructure and service delivery programs to develop models of innovative care for children with SEDs and their families.

The CMHI supports the development of more accessible and appropriate service delivery systems for children and adolescents with SEDs and their families. Training and TA to support and enhance service system development and skill enhancements is critical to advancing the program’s mission to expand and sustain community-based systems of care. Systems of Care are located in a diverse selection of communities throughout the United States, including urban, rural, Tribal and non-English speaking communities. The hallmark of systems of care is that they are family-driven, youth-guided and culturally and linguistically competent. Outreach efforts and interagency collaboration serve to increase access to mental health services among diverse populations.

The CMHI provides an excellent example of SAMHSA’s Theory of Change. Based on data demonstrating improved outcomes for children, youth and families, service system improvements, and a positive return on investment, CMHI has been successful in moving the system of care approach from a demonstration program towards more wide scale adoption of the system of care values and principles. The goal now is to continue these efforts to ensure that this approach becomes the primary way in which mental health services for children and youth with SED are delivered throughout the nation.

The purpose of this contract is to serve as a training and technical assistance center to continue efforts to move systems of care towards wide scale adoption, and to increase the effectiveness of mental health services for children and youth with SEDs and their families in states, counties, Tribes and Territories. This contract will provide training and (TA) on systems of care development, implementation, expansion, sustainability and related policy issues to states, Tribes, territories and communities with current CMHI grants and cooperative agreements as well as new CMHI cooperative agreements funded during the period of this contract.

Pursuant to language in the FY 2015 Consolidated Spending Bill, this contract will also provide training and TA to states, Tribes, territories and communities that do not have any of the above grants or cooperative agreements. This is consistent with SAMHSA’s Theory of Change efforts to move systems of care towards wide scale adoption, are interested in developing, expanding or enhancing their efforts to implement the system of care approach. The system of care approach is defined as the creation of “a spectrum of effective, community-based services and supports for children and youth with or at risk for mental health or other challenges and their families that is organized into a coordinated network with a supportive infrastructure, builds meaningful partnerships with families and youth, and addresses their cultural and linguistic needs, in order to help them to function better at home, in school, in the community and throughout life5.”

Children’s mental health is a significant public health concern. There is a high prevalence of mental disorders in children with about 10% of children having a SED, and 20% of children having a diagnosable mental disorder[footnoteRef:1]. The onset for 50% of adult mental health challenges is by age 14, and this number rises to 75% by age 24; yet limited resources are devoted to children and their families[footnoteRef:2]. There is also a high rate of suicide and depression in young people, with suicide being the second leading cause of death in individuals in the 15-24 year age group, and approximately one in five adolescents and young adult students having suicidal ideation every year[footnoteRef:3]. [1: Centers for Disease Control and Prevention, (2013). Mental Health Surveillance Among Children – United States, 2005-2011. MMWR 2013: Vol. 62, No. 2 (Supplement), pp. 1-32. Atlanta, GA.] [2: Kessler, R.C., Chiu, W.T., Demler, O., & Walters, E.E. (2010). Prevalence, severity, and comorbidity of twelve-month DSM-IV disorders in the National Comorbidity Survey Replication (NCS-R). Archives of General Psychiatry, 62(6), 617-627. ] [3: Centers for Disease Control and Prevention, National Centers for Injury Prevention and Control. Web-based Injury Statistics Query and Reporting System (WISQARS), 2012. Available from www.cdc.gov/injury/wisqars]

Since the concept of systems of care for children and youth with SEDs was first introduced, there has been significant growth in such systems throughout the country. Increasingly, research and evaluation studies from the CMHI have indicated that children, youth and families benefit from participating in these programs. Improvement has been demonstrated in emotional well-being and behavioral functioning, school performance, reduced contacts with law enforcement, and reduced use of inpatient care[footnoteRef:4]. Despite the progress that has been made, many communities across America have yet to benefit from implementing a system of care, and many existing system of care grantees face challenges in implementing the system of care approach. [4: U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Center for Mental Health Services. (2011). The Comprehensive Community Mental Health Services for Children and Their Families Program: Evaluation Findings – Annual Report to Congress, 2011. Rockville, MD.

5 Stroul, B. A. & Blau, G.M. (2010). Defining the system of care concept and philosophy: To update or not to update? Evaluation and Program Planning, 33 (1), 59-62.

Since its inception, the CMHI has impacted nearly 22% of the nation’s 3,177 counties, parishes, boroughs, independent cities, geographical census areas, geographical regions and the District of Columbia, and has served over 100,000 children and youth. Grants have also been awarded to 33 federally recognized Indian Tribes or Tribal Organizations. Given the demonstrated effectiveness of systems of care as one important part of a multi-faceted approach to improving services and systems for youth and their families, and given the absence of such systems of care in many communities, an important next step is to expand the reach of systems of care by bringing them to scale so that they exist throughout the country4.

B. OBJECTIVES:

The project objectives will be achieved through the creation and implementation of a TA center that develops and provides products, resources and supports to establish, enhance, expand and sustain the system of care approach to provide services for children and youth and young adults (up to age 21) with SEDs and their families.

The first objective of this contract is to provide support to the field of children’s mental health through researching, developing and disseminating critical information and documents, creating greater awareness of children’s mental health issues critical to the success of the CMHI. With limited resources and staff support, it becomes necessary for SAMHSA to obtain assistance from a contractor to accomplish this work. The TA and expert guidance enables SAMHSA to maintain a high level of support to the CMHI.

The second objective of this contract will be achieved through the development and implementation of a TA Center to support states, Tribes, territories and regions in CMHS’s Comprehensive Community Mental Health Services for Children and their Families Program in their efforts to successfully develop, implement and sustain expanded systems of care. This contract will provide training and TA to states, Tribes, territories and communities with cooperative agreements awarded under the following Requests for Applications:

1.) Cooperative Agreements for Comprehensive Community Mental Health Services for Children and Their Families Program (CMHI);

2.) Implementation Cooperative Agreements for Expansion of the Comprehensive Community Mental Health Services for Children and Their Families Program (System of Care Expansion Implementation Cooperative Agreements) and, 3.) Cooperative Agreements for Expansion and Sustainability of the Comprehensive Community Mental Health Services for Children and Their Families Program (System of Care Expansion and Sustainability Cooperative Agreements).

Note to offeror: The above programs are subject to potential changes in name. If during the course of this contract period a change in program name occurs the contractor will be informed by written communication and/or modification from the COR/ACOR.

The third objective of this contract will be achieved by providing training and TA to states, Tribes, territories and communities that do not have any of the above grants or cooperative agreements (including former grant recipients). Contingent upon the continuation of the FY15 Appropriations language, the revision of this statute will be done as part of SAMHSA’s Theory of Change efforts to move systems of care towards wide scale adoption, in communities that are interested in developing, expanding, or enhancing their efforts to implement the system of care approach.

The fourth objective of this contract will be achieved through the provision of logistical support, which includes support to conduct meetings, TA and federal monitoring site visits and associated documents and materials.

The Contractor shall work with these audiences to disseminate evidence-based policies, programs and practices, and to assist them with designing and implementing activities and programs that promote the system of care approach to serving children and youth with SEDs. In addition, innovative approaches and projects will be recognized through NTTAC so that other communities, states, Tribes and territories might replicate them. Ultimately, the activities of this contract will ensure that children, youth and young adults with serious mental health disorders have greater access to effective services and supports to improve their lives.

The NTTAC will engage a Steering Committee to provide input and guidance to the contract activities. The Steering Committee will be comprised of representatives of the primary audiences of the project, including but not limited to current and former System of Care community leaders, providers, national experts from the field and recipients of services, representing the diversity of SAMHSA’s stakeholders, and particularly youth and family members. The NTTAC will also compile and/or develop evidence-based TA materials and other resources for the audiences delineated above so that these can be made easily accessible to those seeking such information. The project will develop and deliver TA to the primary audiences, assisting them to design and deliver evidence-based programs. The TA will be provided telephonically, via electronic mail, through webinars and other electronic means. Site visits and meetings will also be used as directed and approved.

At the discretion of the government, five optional tasks may be exercised. Optional Tasks 1 and 2 would provide an opportunity to develop and implement a system of care grantee meeting for the purpose of peer exchange and “cutting edge” discussions to heighten awareness and address the challenges of creating and sustaining effective and cost efficient home and community based systems of care. These systems include clinical services, evidence-based interventions, financing strategies, cultural and linguistic competence, and family-driven and youth-guided care. Optional Task 3 would provide specialized TA in the area of child welfare, while Optional Task 4 would provide specialized TA in the area of juvenile justice. Optional Task 5 would support training and TA to any newly funded System of Care cooperative agreements.

Definitions

For the purposes of this contract, the terms listed below shall be defined as follows:

System of Care – Within the Comprehensive Community Mental Health Services for Children and their Families Program, a System of Care is “A comprehensive spectrum of mental health and other support services that are organized into a coordinated network to meet the multiple and changing needs of children and adolescents with SEDs and their families.” The creation of such systems of care involves a multi-agency, public/private approach to delivering services, an array of service options and flexibility to meet the full range of needs of children, adolescents and their families. Mechanisms for managing, coordinating, funding and sustaining services are necessary components of a system of care.

Peer-to-Peer Support – Peer-to-Peer Support is a system of providing and obtaining assistance across and among system of care grantees. Such support includes people from system of care communities working directly with people from other communities via web-based learning opportunities, bi-annual grantee meetings and participation in communities of practice.

Program Partners – are entities funded or enlisted by CMHS to provide related supports to the Comprehensive Community Mental Health Program for Children and their Families. Partners include contractors responsible for the National Evaluation and Social Marketing, Research and Training Centers, Statewide Family Networks, Youth Organizations and other entities engaged in the field of children’s mental health.

Family-Driven Care- Family-driven means families have a primary decision making role in the care of their own children as well as the policies and procedures governing care for all children in their community, state, tribe, territory and nation.

Youth Guided-Care- Youth-Guided means that youth are engaged as equal partners in creating systems change in policies and procedures at the individual, community, state and national levels.

Cultural Competence- requires systems and organizations to:

· have a defined set of values and principles, and demonstrate behaviors, attitudes, policies and structures that enable them to work effectively cross-culturally.

· have the capacity to (1) value diversity, (2) conduct self-assessment, (3) manage the dynamics of difference, (4) acquire and institutionalize cultural knowledge and (5) adapt to diversity and the cultural contexts of the communities they serve.

· incorporate the above in all aspects of policy making, administration, practice, service delivery and involve systematically consumers, key stakeholders and communities.

Linguistic Competence- is the capacity of an organization and its personnel to communicate effectively, and convey information in a manner that is easily understood by diverse audiences including persons of limited English proficiency, those who have low literacy skills or are not literate, and individuals with disabilities. Linguistic competency requires organizational and provider capacity to respond effectively to the health literacy needs of populations served. The organization must have policy, structures, practices, procedures and dedicated resources to support this capacity.

Field-Driven TA: Through the strategic planning process organized by the TA Center, federally funded system of care grantees shall assess their TA needs in the context of local site needs and Program requirements. Individual site TA plans shall reflect both current local implementation priorities and national children’s mental health goals.

Accountability through Continuous Quality Improvement Mechanisms: Implementation and outcome goals for the TA Center shall be correlated with the TA needs identified by system of care communities. The effectiveness of TA provided by the TA Center in assisting system of care communities achieve their identified goals and objectives shall be regularly monitored and reported, so that successes and obstacles can be readily identified and interim adjustments made. Feedback from the ongoing assessment of TA activities as well as data from the National Evaluation of the CMHI shall advise the strategic planning process for the TA Center so that each year’s TA plan will be revised and updated to reflect the findings from the previous year’s review activities as well as the identified needs of the system of care communities.

The TA Center structure and activities shall be designed to promote the concept of family-driven, youth-guided, culturally and linguistically competent systems of care. The Contractor shall demonstrate how family-driven and youth-guided care, and cultural and linguistic competence, is incorporated into all areas of activity, both within the TA Center itself and as imbedded in the TA provided to the communities. Staff should receive appropriate on-going training, and the Contractor shall continually assess that requirements for family-driven, youth-guided and culturally and linguistically competent care are met. All aspects of the planning, developing, implementing and evaluating TA activities shall be carried out with diverse representation and significant family and youth involvement.

C. SERVICES TO BE PERFORMED:

GENERAL REQUIREMENTS

1. Independently, and not as an agent of the Government, the Contractor shall furnish the necessary personnel, labor, equipment, software, services, materials, and supplies, except as otherwise noted specifically herein to perform the work set forth below.

2. All work under this contract will be monitored by the Contracting Officer’s Representative (COR)

3. SAMHSA/DIVISION OF TECHNOLOGY MANAGEMENT (DTM) GUIDELINES: The Contractor shall use software that meets SAMHSA Guidelines. Specifically, the system(s) must be PC compatible; operate in a Windows environment; and use Microsoft Office Suite (Word, Excel, PowerPoint, and Access); .Net, Java or other software, Oracle or SQL server databases, as well as web applications services such as IIS and Oracle AS or other software consistent with SAMHSA/OMTO/DTM standards. The Contractor shall at all times maintain compliance with current DTM standards, which may change over the duration of this contract. Any deviation from the SAMHSA standards should be negotiated with SAMHSA prior to contract award.

4. IT PLAN:

The Contractor shall prepare an IT Plan that addresses and describes the Design, Development, Implementation, and Maintenance for all IT Applications in the contract. The IT Plan should include functional requirements (e.g., data, workloads, user interface, reliability, security, and maintenance), technical requirements (e.g., hardware, software, and telecommunications) and operational and other requirements. It should also include major IT milestones and implementation dates of the project. The draft and final IT Plan [i.e., “Electronic Version” and “Hard Copy”] shall be submitted as a deliverable to the COR and the DTM [through the COR] for review and approval. Full acceptance of the Contractor’s IT Plan is required and contingent upon the review and approval of DTM. The IT Plan must be reviewed on an annual basis, and updated as necessary if major modifications. The IT Plan review shall occur 90 calendar days after the start of the contract year or 90 calendar days after a major modification. In the initial contract year and if an IT Plan update is necessary in following contract years, the Draft IT Plan shall be provided 90 calendar days after the start of the contract year or 90 calendar days after a major modification; and the Final IT Plan shall be submitted 30 days after the draft is reviewed by the DTM and returned to the Contractor.

5. SECURITY AND PRIVACY REQUIREMENTS FOR SAMHSA OWNED CONTRACTOR MANAGED SYSTEMS

(1) Adherence to security and privacy policy. The Contractor shall comply with all Federal and Department of Health and Human Services (HHS) security and privacy guidelines in effect at the time of the award of this contract. A list of applicable United States (U.S.) laws, Office of Management and Budget (OMB) requirements, HHS policies, standards and guidance, and Federal Government Computer Security guidelines can be located on the Secure One HHS website at http://www.hhs.gov/ocio/securityprivacy/index.html. The Contractor shall perform periodic reviews to ensure compliance with existing information security and privacy requirements. The Contractor reviews should revalidate compliance with previous requirements as well as any new requirements since the last review. The Contractor shall make all system information and documentation produced in support of the contract available to the agency and agency auditors upon request. All questions concerning IT security should be directed to the IT Security Team at infosecurity@samhsa.hhs.gov.

(2) Perimeter defense and notification. The Contractor shall ensure that the system and the information it contains are secured using appropriate perimeter defense technologies and that these technologies are monitored for anomalous traffic behavior. The Contractor shall immediately report any unauthorized system access to the agency COR and/or System Owner.

(3) Protection of sensitive information. The Contractor shall ensure that sensitive information is protected by information security and privacy controls commensurate with the risk associated with the potential loss or compromise of the information. For purposes of this contract, information is sensitive if: the loss of confidentiality or integrity could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.[footnoteRef:5][1] Further, the loss of sensitive information confidentiality or integrity could: (i) cause a significant or severe degradation in mission capability to an extent and duration that the organization is unable to perform its primary functions or the effectiveness of the functions is significantly reduced; (ii) result in significant or major damage to organizational assets; (iii) result in significant or major financial loss; or (iv) result in significant, severe or catastrophic harm to individuals. [5: [1] Federal Information Processing Standard (FIPS) 1999, Standards for Security Categorization of Federal Information and Information Systems, February 2004.]

Personally identifiable information (PII) is a subset of sensitive information and is defined as data which can potentially be used to identify, locate, or contact an individual, or potentially reveal the activities, characteristics, or other details about a person.[footnoteRef:6][2] PII shall receive a level of protection commensurate with the risk associated with the loss or compromise of sensitive information. [6: [2] DHHS Rules of Behavior, February 12, 2008.]

(4) Sensitive information on public systems. The Contractor shall ensure that sensitive information is not stored, processed or transmitted on any system (via the Internet) without the appropriate controls in place and specific authorization from the SAMHSA Chief Information Officer (CIO) and/or Chief Information Security Officer (CISO).

(5) Privacy requirements. The Contractor shall conduct and maintain a Privacy Impact Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002 and Federal Acquisition Regulation (FAR) Clause 52-239-1, and required by HHS policy. The PIA shall be completed in accordance with HHS PIA guidance at http://www.hhs.gov/ocio/securityprivacy/privacyresources/pias.html. Periodic reviews shall be conducted to determine if a major change to the system has occurred, and if a PIA update is subsequently required. If it is determined that an update is necessary, the Contractor shall make the necessary changes to the PIA. Questions or assistance required for PIA completion should be directed to Carla Burch (Carla.Burch@samhsa.hhs.gov).

The Contractor shall abide by all requirements of the Privacy Act of 1974 and FAR Clause 52-239-1. Pursuant to those requirements, the Contractor shall create and publish a System of Records Notice (SORN) in the Federal Register when required and shall publish an updated SORN following a major change to the system, as directed by OMB Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, or subsequent replacement guidance.

(6) Website Privacy Policy: The Contractor shall assure each page of the website, including the homepage, contains a link to SAMHSA's Website Privacy Policy (currently available at http://beta.samhsa.gov/privacy). DHHS and SAMHSA policy does not allow for persistent cookies on any SAMHSA or SAMHSA-funded websites. In addition, any forms on the site which will ask users to enter personal information must first be approved through SAMHSA channels and DTM. Questions or assistance required for SAMHSA websites should be directed to the SAMHSA webmaster (webmaster@samhsa.hhs.gov).

(7) Information System Security Plan (ISSP): The Contractor shall develop, submit and maintain an information system security plan compliant with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18 Revision 1, Guide for Developing Security Plans for Information Technology Systems, standards and must be consistent with the HHS and SAMHSA policy, as applicable to the contract’s Statement of Work.

Draft and Final ISSP Plan: The Contractor’s draft information system security plan shall be submitted [no later than 90 calendar days after the contract effective date (CED)] to the COR with the proposal for approval. The Final IT Plan shall be submitted 30 days after the draft is reviewed by DTM and returned to the Contractor. The draft and final IT Security Plan [i.e., “Electronic Versions” and “Hard Copies”] shall be submitted as a deliverable to the COR and DTM [through the COR]. Full acceptance of the Contractor’s ISSP [IT Security Plan] is required and contingent upon the review and approval of DTM.

Information System Security Plan requirements:

· Each of the 17 NIST security control families prescribed in NIST Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems, and the specific ways in which those controls are implemented must be addressed, if applicable, in the ISSP and pertinent to the function the system is designed to provide.

· The system security plan must be reviewed on at least an annual basis.

· The completion date of the ISSP should be revised to record when the plan has been reviewed and update completed.

· Version numbers must be employed and revised to record when changes are made to the document.

Updated ISSP Plan: Following approval of the draft ISSP, the Contractor shall update and resubmit its ISSP to the COR in contract year 3 and when a major modification has been made, as determined by the contracting officer. The Contractor shall use the current ISSP template in Appendix A of NIST SP 800-18 Revision 1, http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf to complete the ISSP. The information contained in the Contractor’s IT Security Plan shall be commensurate with the System Categorization indicated by the IT Security Officer.

Subcontracts: The Contractor shall include information consistent with this contract language in any subcontractor for performance under the SOW, whenever the submission of an IT Security Plan is required.

(8) System Authorization. The Contractor shall certify and accredit all systems developed for support of the contract in conformance with the standards set forth by the Federal Information Security Management Act (FISMA) and NIST SP800-37 Revisions 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, prior to the system becoming operational, or within 90 days after system completion with approval from the SAMHSA CIO or CISO. This activity shall be performed in conjunction with the initial development of the system, updated when a major change occurs to the system, and renewed no less than every three years. All system authorization (S&A) packages shall be compliant with all Public Law (PL)-107-347, OMB mandates, FIPS, and additional applicable NIST guidance. This guidance includes, but is not limited to FIPS 199, FIPS 200, NIST SP 800-18, NIST SP 800-30, NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, and NIST SP 800-60. All NIST and FIPS documentation can be found at the NIST website at http://csrc.nist.gov/.

SAMHSA has created an S&A checklist to facilitate compliance with the OMB-mandated S&A process. The SAMHSA S&A Checklist will be provided to the Contractor after contract award and upon request to DTM through the SAMHSA COR.

Annual requirements. The Contractor shall be responsible for meeting ongoing information security and privacy system requirements. These include, but are not limited to, performing annual system testing, completing an annual system self-assessment, and supporting quarterly and annual SAMHSA FISMA reporting. Additionally, SAMHSA reserves the right to test or review the system security and privacy controls at any time. All annual requirements will be administered by SAMHSA IT security and privacy team.

(9) Security and privacy training. All Contractors shall receive general awareness training and role-based training, commensurate with the responsibilities required to perform the work articulated in the terms and conditions of the contract.

The Contractor shall be responsible for ensuring each contractor employee has completed the SAMHSA Security Awareness Training as required by the agency prior to performing any contract work or accessing any system, and on an annual basis thereafter, throughout the period of performance of the contract. The Contractor shall maintain a list of all individuals who have completed this training and shall submit this list to the COR upon request. As a part of this training, the Contractor shall ensure that all staff read, agree to, and sign the DHHS Rules of Behavior at http://www.hhs.gov/ocio/policy/hhs-rob.html.

(10) Clearances. The Contractor shall ensure all staff has the required level of security clearance commensurate with the sensitivity of the information being stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract. At the minimum, all Contractor staff shall be subjected to a Public Trust background check and be granted a Public Trust clearance before access to the System or other HHS resources is granted.

(11) Non-Disclosure. The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information:

-18 U.S.C. 641 (Criminal Code: Public Money, Property or Records) -18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- PL 96-511 (Paperwork Reduction Act)

(12) Mobile device encryption. The Contractor shall: (a) encrypt all laptop computers, mobile devices and portable media which store or process, or may store or process, sensitive information using FIPS 140-2 compliant encryption technology; (b) verify that encryption products have been validated under the Cryptographic Module Validation Program at: http://csrc.nist.gov/groups/STM/cmvp/index.html to confirm compliance with FIPS 140-2; (c) establish key recovery mechanisms to ensure the ability to decrypt and recover sensitive information by authorized personnel; and (d) generate and manage encryption keys securely to prevent unauthorized decryption of information. For more information, reference the HHS Encryption Standard for Mobile Devices and Portable Media at: http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/EPF/encrypt_plan_format_for_protect_of_sensitive_info.pdf.

(13) Maintenance. The Contractor shall ensure that the system, once operational, is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with a defined configuration management process. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

References

1. Policy for Department-wide Information Security at http://www.hhs.gov/ocio/policy/hhs-ocio-2011-0003.html

2. HHS IRM Information Security Program Policy at http://www.hhs.gov/ocio/policy/index.html

3. HHS Personnel Security/Suitability Handbook at http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/PISSP/pol_for_info_sys_sec_and_priv_hndbk_20110707.pdf

4. NIST SP 800-18, Rev.1, Guide for Developing Security Plans for Information Technology Systems at http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

5. NIST SP 800-37, Guide for Security Certification and Accreditation of Federal Information Systems: at http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

6. NIST SP 800-53, Recommended Security Controls for a Federal Information System at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

7. NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf

8. NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume II at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

9. NIST SP 800-64, Security Considerations in the Information System Development Life Cycle at http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf

10. FIPS 199, Standards for Security Categorization of Federal Information and Information Systems at http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

11. Federal Information Processing Standards, Minimum Security, Requirements for a Federal Information System at http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

12. Cryptographic Module Validation Program at http://csrc.nist.gov/groups/STM/cmvp/index.html

13. HHS Policy for Records Management: http://www.hhs.gov/ocio/policy/2007-0004.001.html.

14. Enterprise Performance Lifecycle: http://www.hhs.gov/ocio/eplc/index.html

6. SECTION 508 COMPLIANCE:

Section 508 of the Rehabilitation Act, requires agencies and their Contractors to buy Electronic and Information Technology (EIT) that makes information accessible to people with disabilities.

1. On June 25, 2001, accessibility requirements for Federal Electronic and Information Technology took effect under Section 508 of the Rehabilitation Act. This law requires that such technology be accessible according to standards developed by the Access Board, which are now part of the Federal government's procurement regulations (Refers to the Section 508 Federal Acquisition Regulations (FAR) Final Rule published on April, 2001 in the Federal Register).

2. These standards, as issued by the Board, cover a variety of products, including computer hardware and software, websites, phone systems, fax machines, copiers, and similar technologies. Provisions in the standards spell out what makes these products accessible to people with disabilities, including those with vision, hearing, and mobility impairments. The Board included both technical criteria specific to various types of technologies and performance-based requirements, which focus on a product's functional capabilities.

3. The law relies strongly on the procurement process to ensure compliance with the new standards. Compliance with the standards is required except where it would pose an "undue burden" (as defined in the standards) or where no complying product is commercially available.

4. To be considered eligible for award, Offerors must propose goods and/or services that meet the applicable provisions of the Access Board's standards as identified by the agency. Alternatively, Offerors may propose goods or services that provide equivalent facilitation. Such offers will be considered to have met the provisions of the Access Board's standards for the feature or component providing equivalent facilitation.

5. In instances when deliverables and other artifacts generated by the Contractor are intended for distribution via the Web, deliverables must comply with Section 508 requirements. Additional online resources, including the Section 508 compliance standards are available for reference (http://section508.gov/summary-section508-standards or http://www.hhs.gov/web/508/).

7. SAMHSA/OFFICE OF COMMUNICATIONS (OC) REQUIREMENTS

A. Branding – The Contractor shall adhere to the branding and trademarking guidelines outlined in the SAMHSA Identity Standards. SAMHSA is the only entity that shall be branded in content, services, and products (including, but not limited to publications, webpages, mobile applications, program descriptions) developed through this contract. Communications products and promotion activities developed through this contract shall position and brand SAMHSA as the leading source for behavioral health expertise and innovation in the Nation.

B. Communications Products – The COR shall not direct the Contractor to expend funds on the development of any specific communications product until the SAMHSA Office of Communications (OC) has issued a concept clearance or other commensurate approval for the product including specific law or description in SAMHSA’s Strategic Communications Plan. The COR working with the Contractor shall ensure that SAMHSA products reflect SAMHSA's Strategic Initiatives and priorities and are produced with appropriate participation from all SAMHSA Centers/Offices and other relevant external agencies. Recommendations from an annual communication product planning meeting and Executive Leadership Team decisions shall determine the final communication products to be produced. As a cost reimbursable contract, SAMHSA maintains the right to stop work, cancel future work, or change the level of effort of work on any communications products within this contract. This includes, but is not limited to, the revising, repurposing, producing, finalizing, or disseminating of products. Changes that incur a significant reduction or incretion of effort may require a contract modification depending on the level of effort and cost implications. Any decision by SAMHSA to change the purpose, direction, production, completion, or dissemination of a product is not a reflection on the performance of the Contractor. The Contractor shall be reimbursed for any product development up to the date of request by the COR to end work on the product(s) or to change direction on the product(s). All products are the property of the Government and shall be turned over to the COR if the decision is made to stop work on the product(s).

Unless SAMHSA exercises the right to produce/print hard copies, products produced under this contract shall be developed for electronic and web-based distribution only, in accordance with the Executive Order on Promoting Efficient Spending (EO 13589). The duplication of print copies/DVDs/CDs shall be the exception and shall require OC approval prior to duplication. Products developed under this contract shall adhere to SAMHSA’s web governance policy for layout, file format and other technical specifications. The Contractor shall work with the COR to upload approved content into SAMHSA’s Web Content Management System (WCMS). Training on SAMHSA’s WCMS shall be provided to the Contractor and the COR. OC approval is required for final communication products to be produced in hard copy. The intent to produce hard copies shall be identified during the concept clearance approval process. In addition, all products prepared under this contract shall follow the “Plain English” guidelines and shall strive to maintain the national level of suggested reading levels for the appropriate audiences. Products granted an exception to print hardcopies prepared under this contract shall be written and edited in accordance with the Government Printing Office Style Manual and SAMHSA style guidelines. All materials granted an exception shall be printed by the Government Printing Office (GPO) or other approved entity, such as through SAMHSA’s Public Engagement Platform (PEP), that still meets GPO printing guidelines.

C. Public Engagement Platform (PEP) and Marketing Support - Use of and close collaboration with the COR and SAMHSA’s OC for the services provided by PEP and OC is a requirement of this contract. This contract shall not reproduce or budget for any of the services that are available through SAMHSA’s OC. See below for details on the distribution services and Marketing Support that SAMHSA already has available:

· Contact center – 1-877-SAMHSA-7 which responds to public inquiries.

· Warehouse – full warehouse functions of receiving, maintaining, shipping, and managing the entire SAMHSA print and audiovisual library.

· Communications Products Pages – provides online presence for products, including “shopping cart” functionality to order/download products, tagging with the SAMHSA taxonomy, and other related content.

· Reports – provides inventory management information, (e.g. remaining inventory, monthly distribution, and reprint recommendations) and data analytics on the electronic consumption of SAMHSA communications products. Analyzing the product inventory reports is a requirement of this contract. The Contractor shall work with the COR in obtaining these reports from the OC.

· Press releases, News bulletins – these are more traditional forms of information dissemination. They are typically distributed to other news outlets.

· Conference Exhibit Program – Provides a SAMHSA presence at meetings that are aligned with the Agency’s strategic initiatives. Provides publications, programmatic information, promotional materials, etc.

· eBlasts – Internet-based email marketing and current awareness tool that allows subscribers to create profiles and select to receive updates on topics of interest to them, including, but not limited to upcoming awareness campaigns, funding opportunities, and new publications.

· Social Media – SAMHSA utilizes various social media tools (Facebook, Twitter, Flickr, YouTube) with a strong presence and following.

· SAMHSA Newsletter – SAMHSA News, the Agency’s newsletter, disseminates information to behavioral health service providers, consumers, and the general public from all SAMHSA program divisions and offices.

D. Adherence to SAMHSA Technical Governance - The Contractor shall adhere to the SAMHSA Technical Governance. Any development, production and maintenance of Internet/Web applications, including Intranets and Extranets shall comply with SAMHSA policy and procedures.

The SAMHSA.gov website is the only authorized agency website. No new websites shall be created without prior written approval of the COR, in collaboration with OC and DTM and any appropriate agency website officials. Any new websites created by the Contractor shall be part of the SAMHSA.gov website. Websites or applications development may be accomplished on the Contractor's server(s). Production versions must reside on the SAMHSA/DTM infrastructure.

i. Content Development and Management Plan - Within sixty (60) days after the Contract Effective Date (CED), the Contractor shall submit electronic and hard copy versions of the Content Development and Management Plan through the COR to OC and DTM for review and approval. Full acceptance of the Contractor’s Content Development and Management Plan is required and contingent upon the review and approval of DTM—for IT Technical Issues; and OC—for Content and New Media Issues. This plan must include any information on the web content that is being prepared for the SAMHSA site. The plan must also include, but is not limited to:

· Social Media. Details on any channels of social media that are planned to be used, either external (e.g., Facebook, Twitter) or internal to the content, with justification for their use.

· E-mail. Details on mass e-mail distribution, or other Internet-based communication methods, with justification for their use.

· Processes. Descriptions of the processes for the review, approval, and clearance (if applicable) for the Web content (inclusive of social media, e-mail, etc.) for both initial posting and ongoing maintenance. Multiple/variable processes for different classes of content is suggested if applicable.

· Disposition. The management plan shall also include a plan for management or disposition of the content after the contract ends.

· Hosting. If there is a plan to physically host the content outside of SAMHSA.gov, details and a justification shall be provided.

· Content Management System Standards. Details how the Contractor plans to provide updates compatible with or directly through SAMHSA’s Web Content Management System.

· Metrics Standards. Provides information on how the Contractor plans to place “code” on each page of web content to allow it to be discovered and counted by SAMHSA metrics tools.

· Data Standards. Details how all data that is produced or incorporated as part of this contract and that is cleared for public distribution shall be made available in an open data format, compatible with Federal raw data and/or geo data standards at data.gov.

· Web Content Integration. If this contract includes assuming responsibility for a legacy site or content, the management plan shall include a plan for integrating that legacy site or content into SAMHSA.gov. This plan shall be coordinated with the agency plans for SAMHSA.gov, and may require multiple phases or steps for integration.

The COR, OC and DTM shall have 30 days to review and provide comments.

ii. Digital Engagement – The preferred approach to digital engagement focuses on the empowerment of trained Federal staff as the agent of engagement. However, there shall be instances where Contractors are responsible for engagement activities. Digital engagement activities should be included as part of the Content Development and Management Plan and should, as closely as possible, adhere to the following principles:

· Transparency is essential to effective…