RFP_283-15-0458_Attach_1-3_SOW _QASP _Deliverables.pdf

RFP No. 283-15-0458

ATTACHMENT 1

Statement of Work

Project Title: “Substance Abuse and Mental Health Data Archive (SAMHDA)”

A. BACKGROUND INFORMATION

1. General Description of SAMHDA

The mission of the Substance Abuse and Mental Health Services Administration (SAMHSA) of the U.S. Department of Health and Human Services (DHHS) is to reduce the impact of substance abuse and mental illness on America's communities. SAMHSA administers competitive and block grant programs along with data collection, evaluation, and technical assistance activities. Within SAMHSA, programs are carried out by the Center for Mental Health Services (CMHS); the Center for Substance Abuse Prevention (CSAP); the Center for Substance Abuse Treatment (CSAT); and the Center for Behavioral Health Statistics and Quality (CBHSQ). The mission of CBHSQ includes the monitoring of substance use and abuse, and mental disorders and associated health consequences. The Substance Abuse and Mental Health Data Archive (SAMHDA) is sponsored by SAMHSA and is managed by CBHSQ. SAMHDA provides access to over 100 public-use datasets that include data on substance abuse and mental health, including datasets from CBHSQ such as the National Survey on Drug Use and Health (NSDUH), the Drug Abuse Warning Network (DAWN), the National Mental Health Services Survey (N-MHSS), the National Survey of Substance Abuse Treatment Services (N-SSATS), and the Treatment Episode Dataset (TEDS). The dissemination of these data is authorized by Section 505 of the Public Health Service Act (42 USC 290aa4), which states, in part:

(2) Annual surveys shall be carried out in the collection of data under this subsection. Summaries and analyses of the data collected shall be made available to the public.

The data disseminated through the SAMHDA has multiple applications, including:

(1) the study of the epidemiology of substance abuse and mental health; (2) monitoring substance abuse and mental health patterns and trends; (3) identifying licit and illicit substances being abused (including those causing/contributing to medical, psychological, or social problems requiring emergency medical care or rehabilitation);

(4) the study of the use of health care resources for treatment of substance abuse and mental health problems; and (5) assisting Federal, State and local agencies in the proper design and implementation of substance abuse prevention, treatment, and rehabilitation programs (including the evaluation of subsequent program impact).

The data made available through SAMHDA are used by a myriad of users, including SAMHSA, the National Institute on Drug Abuse (NIDA), the Centers for Disease Control and Prevention (CDC), the Office of National Drug Control Policy (ONDCP), and other Federal agencies interested in the prevalence of substance use and mental disorders, in order to: (1) design prevention programs, (2) respond to inquiries on the extent of substance use and mental disorders, (3) estimate treatment need, (4) study the socioeconomic impact of substance abuse and mental disorders, (5) identify correlates of substance use and mental disorders, and (6) evaluate the overall impact that Federal and State programs have on drug demand. These data are also used by state and local agencies and other researchers as well.

One of the key aspects of SAMHDA is that it is meant to make data and analyses more accessible to a variety of users. Sophisticated data users are able to download public-use datasets and conduct their own analyses using their own statistical software. Other users are able to use SAMHDA’s online data analysis tool to analyze data using cross tabulations, means and regressions. For quick access to data, SAMHDA also makes available a more limited set of tables that can be created by just selecting variables from drop down menus. SAMHDA also allows the users to create charts to aid in the interpretation of data. The archive currently receives over 56,000 page views a month,

1.1784 terabytes (TB) of data downloaded, and over 15,000 online analysis tool page views each month.

On November 9, 2006, the Office of Management and Budget (OMB) approved SAMHSA’s CBHSQ as a statistical unit. As a result, CBHSQ is now required to follow the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA) implementation guidelines established by OMB for use by all statistical agencies and units in the Federal government. CIPSEA, included as Title V in the E-Government Act of 2002 (became Public Law 107-347 on December 17, 2002), provides a uniform set of confidentiality protections to all individually identifiable data collected for statistical purposes under a pledge of confidentiality. Under CIPSEA, penalties are imposed for willfully disclosing information to a person or agency not entitled to receive it; unlawful disclosure could be considered a class E felony, with up to five (5) years imprisonment or fines not to exceed $250,000.

Any dissemination of confidential CBHSQ survey data, such as the NSDUH or the Drug Abuse Warning Network (DAWN), has to be in accordance with CIPSEA. SAMDHA will continue to ensure that all public-use data have been adequately assessed for disclosure-related vulnerabilities and that proper statistical disclosure limitation methods have been applied prior to the dissemination of any public-use data.

2. The Contribution of SAMHDA in Satisfying Federal Goals and Priorities

a. SAMHSA’s Data Strategy

The SAMHDA is used to satisfy and help achieve various objectives from SAMHSA’s Data Strategy. The Data Strategy is guided by a set of principles that help ensure that SAMHSA provides timely, relevant, cost-effective, and accurate data that can guide and improve policymaking, program development, and performance monitoring in support of SAMHSA’s vision for a life in the community for everyone. The SAMHSA Data

Strategy1 is a companion document and key element in SAMHSA’s strategic plan2.

SAMHSA’s overall data strategy vision3 is:

…SAMHSA provides leadership and devotes its resources, including programs, policies, information and data, contracts and grants, to help the United States act on the knowledge that:

•Behavioral Health is essential for overall wellbeing •Prevention works •Treatment is effective •People recover from mental and substance use disorders.”

SAMHDA helps CBHSQ and SAMHSA achieve its vision by providing widespread access to:

• Timely data: SAMHDA generally has TEDS and N-SSATS data available for release before (even though the data are not released until) the release of the first publication. On the NSDUH, SAMHDA is able to process the file for release within four weeks of its receipt, allowing for a release of all public-use data and documentation less than a year after the finish of data collection.

• Comprehensive data: SAMHDA holdings cover a wide variety of specialized topics and surveys. Some examples include substance use during pregnancy, HIV/AIDS, and several studies on youth.

• Relevant data: SAMHDA data includes the most current national substance abuse and mental health data as soon as they are available.

• Accurate data: SAMHDA documents all known caveats regarding its data collections and provides thorough study descriptions detailing study and sampling designs, universe, populations, response rates, and weighting (when applicable). This assists users in accurately using SAMHDA data. The goal of the Archive is to provide correct standard error data along with all estimates released.

The SAMHSA data strategy vision is operationalized into three (3) goals and related objectives for each goal. The goals are:

1. Provide periodic national information on the incidence and prevalence of substance abuse and mental illness; associated characteristics of individuals and communities; specialty and nonspecialty treatment and prevention providers and their services; and payers and financing of such services.

1 http://www.samhsa.gov/About/DataStrategyPlan.pdf 2 http://www.samhsa.gov/About/SAMHSAStrategicPlan.pdf 3U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration.

SAMHSA Data Strategy FY 2007 – FY 2011. Accessed 3/12/09:

http://www.samhsa.gov/About/DataStrategyPlan.pdf.

http://www.samhsa.gov/About/DataStrategyPlan.pdf http://www.samhsa.gov/About/SAMHSAStrategicPlan.pdf http://www.samhsa.gov/About/DataStrategyPlan.pdf

2. Provide effective performance information from block/formula and discretionary grant programs through developing and implementing SAMHSA-wide performance measures and rigorous evaluations. Performance data are vital to planning, decision-making, and implementing of policies, programs, and services.

3. Promote the use of interoperable electronic health records and health information technology to improve quality and safety of care, increase administrative efficiencies, and encourage consumer and family participation in their health care.

SAMHDA helps meet the first of these goals.

b. Meeting Other Objectives

SAMHDA supports other Departmental and government-wide objectives by providing wider access to data that can be used to support programs with objectives, such as the reduction of substance abuse (HHS goal 1.4), the promotion and encouragement of preventive health care, including mental health, lifelong healthy behaviors, and recovery. SAMHDA also satisfies DHHS Strategic Goal to “Ensure Efficiency, Transparency, Accountability, and Effectiveness of HHS Programs” (#4).

This contract supports President Obama’s expectations for transparency of government operations, as outlined in his memorandum on transparency and open government, which states, in part:

“Transparency promotes accountability and provides information for citizens about what their Government is doing. Information maintained by the Federal Government is a national asset. My Administration will take appropriate action, consistent with law and policy, to disclose information rapidly in forms that the public can readily find and use. Executive departments and agencies should harness new technologies to put information about their operations and decisions online and readily available to the public. Executive departments and agencies should also solicit public feedback to identify information of greatest use to the public.”

(http://www.whitehouse.gov/the_press_office/TransparencyandOpenGovernment )

SAMHDA supports greater transparency in making available increased amounts of data collected by SAMHSA by using new technologies, such as citrix-based servers allowing off-site access to microdata, and on-line data analysis systems incorporating real-time statistical disclosure limitation measures.

This effort also supports the President’s commitment to decisions based on sound science, as outlined in his memorandum on scientific integrity which states, in part:

“Science and the scientific process must inform and guide decisions of my Administration on a wide range of issues, including improvement of public health, protection of the environment, increased efficiency in the use of energy and other http://www.whitehouse.gov/the_press_office/TransparencyandOpenGovernment resources, mitigation of the threat of climate change, and protection of national security.

The public must be able to trust the science and scientific process informing public policy decisions. Political officials should not suppress or alter scientific or technological findings and conclusions. If scientific and technological information is developed and used by the Federal Government, it should ordinarily be made available to the public.”

(http://www.whitehouse.gov/the_press_office/Memorandum-for-the-Heads-of- Executive-Departments-and-Agencies-3-9-09/ )

By making increased amounts of data available to the public, including other governmental agencies, SAMHSA signals its commitment to science-based decision making.

B. CONTRACT OBJECTIVES

This contract includes the following broadly-defined domains or responsibilities:

1. Disseminate public-use data from CBHSQ data collections, such as DAWN, N-MHSS, NSDUH, N-SSATS, and TEDS.

2. Provide free access to data in a variety of electronic formats, including downloadable multi-format datasets and the ability to perform on-line data analysis.

3. Provide remote approved access to high quality, confidential data and documentation on substance use and mental health via a virtual desktop from a secure, approved location.

C. GENERAL REQUIREMENTS

General:

1. All work under this contract/task order will be monitored by the Contracting

Officer’s Representative (COR)

2. The Contractor shall prepare the necessary documentation to assist CBHSQ in seeking SAMHSA and OMB clearances for any new data collection, such as a customer satisfaction survey, including blanket clearances.

3. Independently, and not as an agent of the Government, the Contractor shall furnish the necessary personnel, labor, equipment, software, services, materials, and supplies, except as otherwise noted specifically herein to perform the work set forth below.

http://www.whitehouse.gov/the_press_office/Memorandum-for-the-Heads-of-Executive-Departments-and-Agencies-3-9-09/ http://www.whitehouse.gov/the_press_office/Memorandum-for-the-Heads-of-Executive-Departments-and-Agencies-3-9-09/

4. The Contractor shall submit to the COR for approval, any key personnel who plan to work offsite for the majority of time during the duration of the contract period. For each key personnel, the Contractor shall provide a justification for working offsite, including a reason for moving and a discussion of geographical relationships and communication plans with subordinates and higher-level management. The Contractor shall also submit for COR approval, any key personnel who request to reside in a geographical area outside of the area of his/her responsibility.

5. The Contractor will be expected throughout the contract period to recommend well thought-out, innovative approaches for accomplishing the contract objectives. All changes to procedures must be approved by the COR.

6. Unless the COR specifically requests participation of Contractor staff at a meeting or conference, the Contractor shall use overhead costs or other non-contract costs to pay for travel, registration fees, and other expenses for their staff to attend and participate.

7. All hard copy printed materials sent to the COR, where appropriate, must be printed double-sided, unless otherwise requested by the COR.

8. The content and format of data tabulations and reports shall be determined in collaboration with the COR.

9. For tables and charts which display only percent distributions, the Contractor shall produce and provide to the COR source tabulations containing the frequency counts which support the data displays.

10. All data and products developed under this contract including, but not limited to, interim and final papers, notes, disks, tapes, programs, software, reports, materials, and questionnaires, are the property of and shall revert to the Government. All software shall be accompanied by complete documentation.

11. The following requirements regarding documentation apply to all software and data files created or maintained under this contract:

a. The Contractor shall develop and maintain all the design, operation, and user documentation in a format approved in advance by the COR. The Contractor shall provide the COR with a detailed outline of the document, allowing 10 days for COR review and approval.

b. The Contractor shall use software that meets SAMHSA Guidelines.

Specifically, the system(s) must be PC compatible, operate in a Windows environment, and use Microsoft Office Suite (Word; Excel; PowerPoint; and Access), .Net, Java or other software; Oracle or SQL server databases, as well as web applications services such as IIS and Oracle AS or other software consistent with SAMHSA/DTM standards. The Contractor shall at all times maintain compliance with current DTM standards, which may change over the duration of this contract/task order. Any deviation from the SAMHSA standards should be negotiated with SAMHSA prior to contract/task order award.

c. The Contractor is responsible for developing or maintaining all software necessary for production of deliverables – including detailed documentation, which must address the purpose of each program, the program language, file and program names, as well as compiling, linking, and running specifications.

The programs shall be created from non-proprietary software commonly available to Government and Industry, such as SAS (in compliance with the Government's desire for portability in applications) to the extent possible. The documentation shall be written in technical language understandable by a programmer/analyst. A copy of all software, and associated documentation, developed during the period of performance of the contract shall be delivered to the COR (upon request) in conjunction with the deliverable for which it was used (final drafts only).

12. All statistical analyses of complex sample data shall be reconciled with the complex sample design. Methods that assume the sample observations are from a simple random sample shall not be used, unless requested by the COR.

13. All statistics used to support comparative and concluding statements in the text of reports or on the website must be supported by tests for statistical significance using commonly accepted principles of statistical inference.

14. The Contractor is responsible for ensuring the accuracy of all data and associated statements contained in the deliverables.

15. Whenever Contractor staff are involved in the presentation or publication of information obtained, processed or maintained through the contract, the following policy shall be observed: (1) the COR will be involved in the project and will review all concepts, abstracts, presentation material, papers, and reports submitted for presentation or dissemination; (2) all ideas for presentations, publications, and reports shall be submitted to the COR for approval before any work begins. This includes all ideas for improving current practices used in SAMHDA.

16. Attribution for all internal reports shall be: "Substance Abuse and Mental Health

Services Administration." An acknowledgment shall follow, including the following:

“This report was developed for the Substance Use and Mental Health Data Archive, sponsored by the Substance Abuse and Mental Health Services Administration, Center for Behavioral Health Statistics and Quality, by [Contractor name, address] under Contract No. xxx-xx-xxxx.”

CBHSQ staff names must be included in the acknowledgements if they either reviewed or co-authored the report. Exceptions to these specifications may be made by the COR on a case-by-case basis.

17. All Contractor (and subcontractor, if applicable) project staff with access to confidential data collected under CIPSEA shall participate in SAMHSA-approved confidentially training, as required under CIPSEA guidelines as established by OMB.

The Contractor shall certify and provide notification to the COR that each project staff member has received this training. These staff shall be re-certified annually to ensure their understanding of confidentially requirements. All Contractor staff with access to confidential non-public data collected under 501(n) shall sign and provide to the COR a COR-approved contractor agreement regarding the security of the data. The Contractor shall also provide CBHSQ with annual reports consistent with OMB requirements regarding the number of contractors trained and certified as agents under CIPSEA annually, and the nature of their access to data. Details on OMB requirements regarding the annual report to OMB are available at http://www.whitehouse.gov/omb/fedreg/2007/061507_cipsea_guidance.pdf.

18. No Contractor staff with access to non-public data under the contract shall make those data public without examination for disclosure issues by contract and CBHSQ staff and without prior approval by the COR. The Contractor shall assume full responsibility for privacy and confidentiality of data. No data, products or reports prepared under this contract shall be released to any party without the written approval of the COR. Use of the data shall be consistent with Section 501(n) of the Public Health Service Act (42 U.S.C. 290aa), as amended, which states:

LIMITATION ON THE USE OF CERTAIN INFORMATION— No information, if an establishment or person supplying the information or described in it is identifiable, obtained in the course of activities undertaken or supported under section 505 may be used for any purpose other than the purpose for which it was supplied unless such establishment or person has consented (as determined under regulations of the Secretary) to its use for such other purpose. Such information may not be published or released in other form if the person who supplied the information or who is described in it is identifiable unless such person has consented (as determined under regulations of the Secretary) to its publication or release in other form.

19. In general, the information developed or collected by the Contractor under this contract may not be used for purposes other than those stated in the contract.

20. Unless approved by the COR, the Contractor shall be prohibited from using any non-public data received by SAMHDA for use on non-SAMHDA projects. This includes the use of the data as a sampling frame in other studies, use of non-public screening, interview, or call data to conduct research on projects outside of the SAMHDA project, and other uses.

http://www.whitehouse.gov/omb/fedreg/2007/061507_cipsea_guidance.pdf

Information Technology Requirements:

(1) Adherence to security and privacy policy. The Contractor shall comply with all Federal and Department of Health and Human Services (HHS) security and privacy guidelines in effect at the time of the award of this contract/task order. A list of applicable United States (U.S.) laws, Office of Management and Budget (OMB) requirements, HHS policies, standards and guidance, and Federal Government Computer Security guidelines can be located on the Secure One HHS website at http://www.hhs.gov/ocio/securityprivacy/index.html. The Contractor shall perform periodic reviews to ensure compliance with existing information security and privacy requirements. The Contractor reviews should revalidate compliance with previous requirements as well as any new requirements since the last review. The Contractor shall make all system information and documentation produced in support of the contract/task order available to the agency and agency auditors upon request. All questions concerning IT security should be directed to the IT Security Team at infosecurity@samhsa.hhs.gov.

(2) Perimeter defense and notification. The Contractor shall ensure that the system and the information it contains are secured using appropriate perimeter defense technologies and that these technologies are monitored for anomalous traffic behavior. The Contractor shall immediately report any unauthorized system access to the agency COR and/or System Owner.

(3) Protection of sensitive information. The Contractor shall ensure that sensitive information is protected by information security and privacy controls commensurate with the risk associated with the potential loss or compromise of the information.

For purposes of this contract/task order, information is sensitive if: the loss of confidentiality or integrity could be expected to have a serious, severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.[1] Further, the loss of sensitive information confidentiality or integrity could: (i) cause a significant or severe degradation in mission capability to an extent and duration that the organization is unable to perform its primary functions or the effectiveness of the functions is significantly reduced; (ii) result in significant or major damage to organizational assets; (iii) result in significant or major financial loss; or (iv) result in significant, severe or catastrophic harm to individuals.

Personally identifiable information (PII) is a subset of sensitive information and is defined as data which can potentially be used to identify, locate, or contact an individual, or potentially reveal the activities, characteristics, or other details about a person.[2] PII shall receive a level of protection commensurate with the risk associated with the loss or compromise of sensitive information.

[1] Federal Information Processing Standard (FIPS) 1999, Standards for Security Categorization of Federal Information and Information Systems, February 2004.

[2] DHHS Rules of Behavior, February 12, 2008.

http://www.hhs.gov/ocio/securityprivacy/index.html mailto:infosecurity@samhsa.hhs.gov

(4) Sensitive information on public systems. The Contractor shall ensure that sensitive information is not stored, processed or transmitted on any system (via the Internet) without the appropriate controls in place and specific authorization from the SAMHSA Chief Information Officer (CIO) and/or Chief Information Security Officer

(CISO)

(5) Privacy requirements. The Contractor shall conduct and maintain a Privacy

Impact Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002 and Federal Acquisition Regulation (FAR) Clause 52-239-1, and required by HHS policy. The PIA shall be completed in accordance with HHS PIA guidance at http://www.hhs.gov/ocio/securityprivacy/privacyresources/pias.html. Periodic reviews shall be conducted to determine if a major change to the system has occurred, and if a PIA update is subsequently required. If it is determined that an update is necessary, the Contractor shall make the necessary changes to the PIA.

Questions or assistance required for PIA completion should be directed to Carla Burch (Carla.Burch@samhsa.hhs.gov)

The Contractor shall abide by all requirements of the Privacy Act of 1974 and FAR Clause 52-239-1. Pursuant to those requirements, the Contractor shall create and publish a System of Records Notice (SORN) in the Federal Register when required and shall publish an updated SORN following a major change to the system, as directed by OMB Memorandum (M) 03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, or subsequent replacement guidance.

(6) Website Privacy Policy: The Contractor shall assure each page of the Website, including the home page, includes a link to SAMHSA's Website Privacy Policy (found at http://beta.samhsa.gov/privacy). DHHS and SAMHSA policy does not allow for persistent cookies on any SAMHSA or SAMHSA funded websites. In addition, any forms on the site which will ask users to enter personal information must first be approved through SAMHSA channels and the DTM. Questions or assistance required for SAMHSA websites should be directed to the SAMHSA webmaster (webmaster@samhsa.hhs.gov).

(7) Information System Security Plan (ISSP): The Contractor shall develop, submit and maintain an information system security plan compliant with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18 Revision 1, Guide for Developing Security Plans for Information Technology Systems, standards and must be consistent with the HHS and SAMHSA policy, as applicable to the contract’s/task order’s statement of work.

Draft and Final ISSP Plan: The Contractor’s draft information system security plan shall be submitted [no later than 90 calendar days after the contract/task order effective date (CED)] to the COR with the proposal for approval. The Final IT Plan shall be submitted 30 days after the draft is reviewed by the DTM and returned to the Contractor. The draft and final IT Security Plan [i.e. “Electronic Versions” and http://www.hhs.gov/ocio/securityprivacy/privacyresources/pias.html http://www.hhs.gov/ocio/securityprivacy/privacyresources/pias.html mailto:Carla.Burch@samhsa.hhs.gov http://beta.samhsa.gov/privacy mailto:webmaster@samhsa.hhs.gov

“Hard Copies”] shall be submitted as a deliverable to the COR and the DTM [through the COR]. Full acceptance of the Contractor’s ISSP [IT Security Plan] is required and contingent upon the review and approval of the DTM.

Information System Security Plan requirements:

• Each of the 17 NIST security control families prescribed in NIST Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems, and the specific ways in which those controls are implemented must be addressed, if applicable, in the ISSP and pertinent to the function the system is designed to provide.

• The system security plan must be reviewed on at least an annual basis.

• The completion date of the ISSP should be revised to record when the plan has been reviewed and update completed.

• Version numbers must be employed and revised to record when changes are made to the document.

Updated ISSP Plan: Following approval of the draft ISSP, the Contractor shall update and resubmit its ISSP to the COR in contract/task order year 3 and when a major modification has been made, as determined by the contracting officer. The Contractor shall use the current ISSP template in Appendix A of NIST SP 800-18 Revision 1, http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf to complete the ISSP. The information contained in the Contractor’s IT Security Plan shall be commensurate with the System Categorization indicated by the IT Security Officer.

Subcontracts: The Contractor shall include information consistent with this contract/task order language in any subcontractor for performance under the SOW, whenever the submission of an IT Security Plan is required.

(8) System Authorization. The Contractor shall certify and accredit all systems developed for support of the contract/task order in conformance with the standards set forth by the Federal Information Security Management Act (FISMA) and NIST SP800-37 Revisions 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, prior to the system becoming operational, or within 90 days after system completion with approval from the SAMHSA CIO or CISO. This activity shall be performed in conjunction with the initial development of the system, updated when a major change occurs to the system, and renewed no less than every three years. All system authorization (S&A) packages shall be compliant with all Public Law (PL)-107-347, OMB mandates, FIPS, and additional applicable NIST guidance. This guidance includes, but is not limited to FIPS 199, FIPS 200, NIST SP 800-18, NIST SP 800-30, NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, and NIST SP 800-60. All NIST and FIPS documentation can be found at the NIST website at http://csrc.nist.gov/.

http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/

SAMHSA has created an S&A checklist to facilitate compliance with the OMB-mandated S&A process. The SAMHSA S&A Checklist will be provided to the Contractor after contract/task order award and upon request to DTM through the

SAMHSA COR.

Annual requirements. The Contractor shall be responsible for meeting ongoing information security and privacy system requirements. These include, but are not limited to, performing annual system testing, completing an annual system self-assessment, and supporting quarterly and annual SAMHSA FISMA reporting.

Additionally, SAMHSA reserves the right to test or review the system security and privacy controls at any time. All annual requirements will be administered by SAMHSA IT security and privacy team.

(9) Security and privacy training. All Contractors shall receive general awareness training and role-based training, commensurate with the responsibilities required to perform the work articulated in the terms and conditions of the contract/task order.

The Contractor shall be responsible for ensuring each contractor employee has completed the SAMHSA Security Awareness Training as required by the agency prior to performing any contract/task order work or accessing any system, and on an annual basis thereafter, throughout the period of performance of the contract/task order. The Contractor shall maintain a list of all individuals who have completed this training and shall submit this list to the COR upon request. As a part of this training, the Contractor shall ensure that all staff read, agree to, and sign the DHHS Rules of Behavior at http://www.hhs.gov/ocio/policy/hhs-rob.html.

(10) Clearances. The Contractor shall ensure all staff has the required level of security clearance commensurate with the sensitivity of the information being stored, processed, transmitted or otherwise handled by the System or required to perform the work stipulated by the contract/task order. At the minimum, all Contractor staff shall be subjected to a Public Trust background check and be granted a Public Trust clearance before access to the System or other HHS resources is granted.

(11) Non-Disclosure. The Contractor shall not release, publish, or disclose agency information to unauthorized personnel, and shall protect such information in accordance with the provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information:

-18 U.S.C. 641 (Criminal Code: Public Money, Property or Records) -18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- PL 96-511 (Paperwork Reduction Act)

(12) Mobile device encryption. The Contractor shall: (a) encrypt all laptop computers, mobile devices and portable media which store or process, or may store http://www.hhs.gov/ocio/policy/hhs-rob.html or process, sensitive information using FIPS 140-2 compliant encryption technology;

(b) verify that encryption products have been validated under the Cryptographic Module Validation Program at http://csrc.nist.gov/groups/STM/cmvp/index.html to confirm compliance with FIPS 140-2; (c) establish key recovery mechanisms to ensure the ability to decrypt and recover sensitive information by authorized personnel; and (d) generate and manage encryption keys securely to prevent unauthorized decryption of information. For more information, reference the HHS Encryption Standard for Mobile Devices and Portable Media at http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/EPF/encrypt_plan_form at_for_protect_of_sensitive_info.pdf.

(13) Maintenance. The Contractor shall ensure that the system, once operational, is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with a defined configuration management process. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

IT PLAN:

(14) The Contractor shall prepare an IT Plan that addresses and describes the

Design, Development, Implementation, and Maintenance for all IT Applications in the contract/task order. The IT Plan should include functional requirements (e.g., data, workloads, user interface, reliability, security, and maintenance), technical requirements (e.g., hardware, software, and telecommunications) and operational and other requirements. It should also include major IT milestones and implementation dates of the project. The draft and final IT Plan [i.e. “Electronic Version” and “Hard Copy”] shall be submitted as a deliverable to the COR and the DTM [through the COR] for review and approval. Full acceptance of the Contractor’s IT Plan is required and contingent upon the review and approval of the DTM. The IT Plan must be reviewed on an annual basis, and updated as necessary if major modifications. The IT Plan review shall occur 90 calendar days after the start of the contract/task order year or 90 calendar days after a major modification. In the initial contract/task order year and if an IT Plan update is necessary in following contract/task order years, the Draft IT Plan shall be provided 90 calendar days after the start of the contract/task order year or 90 calendar days after a major modification; and the Final IT Plan shall be submitted 30 days after the draft is reviewed by the DTM and returned to the Contractor.

References

1. Policy for Department-wide Information Security at http://www.hhs.gov/ocio/policy/hhs-ocio-2011-0003.html

2. HHS IRM Information Security Program Policy at http://www.hhs.gov/ocio/policy/index.html

3. HHS Personnel Security/Suitability Handbook at http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/PISSP/pol_for_info_s ys_sec_and_priv_hndbk_20110707.pdf http://csrc.nist.gov/groups/STM/cmvp/index.html http://csrc.nist.gov/groups/STM/cmvp/index.html http://csrc.nist.gov/groups/STM/cmvp/index.html http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/EPF/encrypt_plan_format_for_protect_of_sensitive_info.pdf http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/EPF/encrypt_plan_format_for_protect_of_sensitive_info.pdf http://www.hhs.gov/ocio/policy/hhs-ocio-2011-0003.html http://www.hhs.gov/ocio/policy/hhs-ocio-2011-0003.html http://www.hhs.gov/ocio/policy/index.html http://www.hhs.gov/ocio/policy/index.html http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/PISSP/pol_for_info_sys_sec_and_priv_hndbk_20110707.pdf http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/PISSP/pol_for_info_sys_sec_and_priv_hndbk_20110707.pdf http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/PISSP/pol_for_info_sys_sec_and_priv_hndbk_20110707.pdf

4. NIST SP 800-18, Rev.1, Guide for Developing Security Plans for Information Technology Systems at http://csrc.nist.gov/publications/nistpubs/800-18- Rev1/sp800-18-Rev1-final.pdf

5. NIST SP 800-37, Guide for Security Certification and Accreditation of Federal Information Systems: at http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

6. NIST SP 800-53, Recommended Security Controls for a Federal Information System at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 53r4.pdf

7. NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf

8. NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume II at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

9. NIST SP 800-64, Security Considerations in the Information System Development Life Cycle at http://csrc.nist.gov/publications/nistpubs/800-64- Rev2/SP800-64-Revision2.pdf

10. FIPS 199, Standards for Security Categorization of Federal Information and Information Systems at http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB- 199-final.pdf

11. Federal Information Processing Standards, Minimum Security, Requirements for a Federal Information System at http://csrc.nist.gov/publications/fips/fips200/FIPS- 200-final-march.pdf

12. Cryptographic Module Validation Program at http://csrc.nist.gov/groups/STM/cmvp/index.html

13. HHS Policy for Records Management: http://www.hhs.gov/ocio/policy/2007-

0004.001.html.

14. Enterprise Performance Lifecycle:

http://www.hhs.gov/ocio/eplc/index.html

6. SECTION 508 COMPLIANCE:

1—Section 508 of the Rehabilitation Act, requires agencies and their Contractors to buy Electronic and Information Technology (EIT) that is accessible to people with disabilities.

2—On June 25, 2001, accessibility requirements for Federal Electronic and Information Technology took effect under Section 508 of the Rehabilitation Act. This law requires that such technology be accessible according to standards developed by the Access Board, which are now part of the Federal government's procurement regulations (Ref. to the Section 508 Federal Acquisition Regulations (FAR) Final Rule published on April, 2001 in the Federal Register).

http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf http://dx.doi.org/10.6028/NIST.SP.800-53r4 http://dx.doi.org/10.6028/NIST.SP.800-53r4 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/groups/STM/cmvp/index.html http://csrc.nist.gov/groups/STM/cmvp/index.html http://www.hhs.gov/ocio/policy/2007-0004.001.html http://www.hhs.gov/ocio/policy/2007-0004.001.html http://www.hhs.gov/ocio/eplc/index.html

3—These standards, as issued by the Board, cover a variety of products, including computer hardware and software, Websites, phone systems, fax machines, copiers, and similar technologies. Provisions in the standards spell out what makes these products accessible to people with disabilities, including those with vision, hearing, and mobility impairments. The Board included both technical criteria specific to various types of technologies and performance-based requirements, which focus on a product's functional capabilities.

4—The law relies strongly on the procurement process to ensure compliance with the new standards. Compliance with the standards is required except where it would pose an "undue burden" (as defined in the standards) or where no complying product is commercially available.

5—To be considered eligible for award, Offerors must propose goods and/or services that meet the applicable provisions of the Access Board's standards as identified by the agency. Alternatively, Offerors may propose goods or services that provide equivalent facilitation. Such offers will be considered to have met the provisions of the Access Board's standards for the feature or component providing equivalent facilitation.

6—In instances in which deliverables and other artifacts generated by the Contractor are intended for distribution via the Web, deliverables must comply with Section 508 requirements. Additional online resources, including the Section 508 compliance standards are available for reference ( http://section508.gov/summary-section508-standards or http://www.hhs.gov/web/508/).

7. SAMHSA/OFFICE OF COMMUNICATIONS (OC) REQUIREMENTS

A. Branding – The Contractor shall adhere to the branding guidelines outlined in the SAMHSA Identity Guide. SAMHSA is the only entity that shall be branded in content, services, and products developed through this contract/task order (including products, Web pages, program descriptions, etc.). Communications products and promotion activities developed through this contract/task order shall position and brand SAMHSA as the leading source for behavioral health expertise and innovation in the Nation.

B. Communications Products - The COR shall not direct the Contractor to expend funds on the development of any specific communications product until the SAMHSA Office of Communications (OC) has issued a concept clearance or other commensurate approval for the product including specific law or description in SAMHSA’s Strategic Communications Plan. The COR working with the Contractor shall ensure that SAMHSA products reflect SAMHSA's Strategic Initiatives and priorities and are produced with appropriate participation from all SAMHSA Centers/Offices and other relevant external agencies. Recommendations from an annual communication product planning meeting and Executive Leadership Team decisions shall determine the final communication products to be produced. As a cost reimbursable contract/task order, SAMHSA maintains the right to stop work, cancel http://section508.gov/summary-section508-standards http://www.hhs.gov/web/508/ future work, or change the level of effort of work on any communications products within this contract/task order. This includes, but is not limited to, the revising, repurposing, producing, finalizing, or disseminating of products. Changes that incur a significant reduction or incretion of effort may require a contract/task order modification depending on the level of effort and cost implications. Any decision by SAMHSA to change the purpose, direction, production, completion, or dissemination of a product is not a reflection on the performance of the Contractor. The Contractor shall be reimbursed for any product development up to the date of request by the COR to end work on the product(s) or to change direction on the product(s). All products are the property of the Government and shall be turned over to the COR if the decision is made to stop work on the product(s).

Unless SAMHSA exercises the right to produce/print hard copies, products produced under this contract/task order shall be developed for electronic and web-based distribution only, in accordance with the Executive Order on Promoting Efficient Spending (EO 13589). The duplication of print copies/DVDs/CDs shall be the exception and shall require prior OC approval. Products produced under this contract/task order shall adhere to SAMHSA’s web governance policy for layout, file format and other technical specifications. The Contractor shall work with the COR to upload approved content into SAMHSA’s Web Content Management System (WCMS). Training on SAMHSA’s WCMS shall be provided to the Contractor and the COR. Recommendations determined through an annual communication product planning meeting and Executive Leadership Team decisions shall determine whether the final communication products qualify to be produced in hard copy. In addition, all products prepared under this contract/task order shall follow the “Plain English” guidelines and shall strive to maintain the national level of suggested reading levels for the appropriate audiences. Products granted an exception to print hardcopies prepared under this contract/task order shall be written and edited in accordance with the Government Printing Office Style Manual and SAMHSA style guidelines. All materials granted an exception shall be printed by the Government Printing Office (GPO) or other approved entity, such as through SAMHSA’s Public Engagement Platform (PEP), that still meets GPO printing guidelines.

C. Public Engagement Platform (PEP) and Marketing Support - Use of and close collaboration with the COR and SAMHSA’s OC for the services provided by PEP and OC is a requirement of this contract/task order. This contract/task order shall not reproduce or budget for any of the services that are available through SAMHSA’s OC.

See below for details on the distribution services and Marketing Support that SAMHSA already has available:

o Contact center – 1-877-SAMHSA-7 which responds to public inquiries.

o Warehouse – full warehouse functions of receiving, maintaining, shipping, and managing the entire SAMHSA print and audiovisual library.

o Communications Products Pages – provides online presence for products, including “shopping cart” functionality to order/download products, tagging with the SAMHSA taxonomy, and other related content.

o Reports – provides inventory management information, (e.g. remaining inventory, monthly distribution, and reprint recommendations) and data analytics on the electronic consumption of SAMHSA communications products. Analyzing the product inventory reports is a requirement of this task order. The Contractor shall work with the COR in obtaining these reports from the OC.

o Press releases, News bulletins – these are more traditional forms of information dissemination. They are typically distributed to other news outlets.

o Conference Exhibit Program – Provides a SAMHSA presence at meetings that are aligned with the Agency’s strategic initiatives. Provides publications, programmatic information, promotional materials, etc.

o eBlasts – Internet-based email marketing and current awareness tool that allows subscribers to create profiles and select to receive updates on topics of interest to them, including, but not limited to upcoming awareness campaigns, funding opportunities, and new publications.

o Social Media – SAMHSA utilizes various social media tools (Facebook, Twitter, Flickr, YouTube) with a strong presence and following.

o SAMHSA Newsletter – SAMHSA News, the Agency’s newsletter, disseminates information to behavioral health service…