5. Statement of Work 56391.docx

Statement of Work

Procurement Request #: 56391 Period of Performance: 9/8/2021- 9/7/2023

Title: QDS™ Maintenance Support for the Medical Monitoring Project and National HIV Behavioral Surveillance

SECTION 1 – BACKGROUND

HIV causes a chronic infection that leads to a progressive disease. Without treatment, most HIV-infected persons develop life threatening illnesses within 10 years of infection, which results in substantial morbidity and premature death. CDC reports an estimated 1 million persons aged 13 years and older with diagnosed HIV infection in the U.S. at the end of 2018 (CDC, 2020), with over 37,000 diagnosed HIV infections occurring each year (CDC, 2020). Monitoring key indicators among persons with HIV and populations at increased risk for HIV is critical to achieving the goals of the Ending the HIV Epidemic (EHE): A Plan for America initiative, which aims to reduce new HIV infections by 90% by 2030 by implementing evidence-based strategies.

The Division of HIV/AIDS Prevention (DHAP) oversees a comprehensive multi-component surveillance system to measure and characterize the scope and magnitude of disease and to monitor progress toward achieving national strategies and the EHE goals. MMP (OMB No. 0920-0740) and NHBS (OMB No: 0920-0770) are the most comprehensive surveillance systems for producing population-based local and national measures of behaviors and clinical outcomes associated with HIV infection. Both systems incorporate the use of a 45-minute interview to capture responses from a combined sample size of approximately 21,000 "hard-to-reach" respondents each year. The interviews cover a breadth of topics to better understand behavioral and clinical characteristics and care utilization among HIV-infected persons or those at highest risk of HIV. Because of their complex topical areas, the surveys incorporate the use of hundreds of skip and repeat patterns. Over 250 interviewers in locations across the United States administer face-to-face or telephone interviews using a computer-assisted personal interviewing (CAPI) electronic survey application. The surveys are programmed using Questionnaire Development System (QDS™) software. All state and local health departments participating in these surveys have incorporated the use of QDS™ as part of the data collection infrastructure. Interviewers currently use tablet, laptop, and desktop computer devices for survey administration.

Due to the unique structures of the MMP and NHBS surveillance systems and the multiple modes of administration of their respective surveys, each system utilizes different formats for their questionnaires and related programming specifications; hereinafter referred to as “requirements documents.” For example, NHBS currently utilizes a CAPI Reference Questionnaire (or CRQ) requirements document which allows investigators to quickly locate variable names and understand skip patterns when conducting analysis of data collected through QDS™ software. The CRQ can also be adapted to develop new requirement documents for supplemental NHBS surveys to conduct behavioral surveillance among emerging populations at risk for HIV, such as NHBS among transgender women (NHBS-Trans).

The MMP and NHBS survey instruments programmed in QDS™ are very complex, are offered in two languages (English and Spanish), and use multiple modes of administration (face-to-face, telephone), and multiple computer platforms (tablet, laptop, desktop). Through a previous contract, CDC commissioned enhancements to the QDS™ software to improve the efficiency of programming and testing the MMP and NHBS survey applications. These enhancements were released in a commercial version of the QDS™ software (QDS™ 5.0) by the sole proprietary owner, NOVA Research Company. Maintenance will be needed for these CDC commissioned enhancements to QDS™ 5.0 if errors are encountered when administering MMP and NHBS survey applications.

Data produced from the surveys must meet specific requirements to allow for the analyses needed to reach the objectives for each of these surveillance systems. The importance of the data and the annual multi-million-dollar investment in these surveillance systems require that the electronic survey programs are free of errors. Procuring highly specialized services in QDS™ maintenance and support will help to protect CDC's investment in MMP and NHBS.

SECTION 2 – PURPOSE

The purpose of this contract is to maintain and deploy high functioning survey applications for use in public health jurisdictions across the United States. The survey applications are necessary for CDC and state and local health departments to collect timely, high quality data that meet informational demands for public health action.

The overall objectives of this contract are to:

1) Conduct maintenance on CDC-commissioned QDS™ 5.0 enhancements;

2) Use QDS™ 5.0 to program small amount of changes (10- 20% each) to the final existing codes for MMP, NHBS and NHBS-Trans Survey Questionnaires and local survey templates;

3) Conduct analysis, programming, testing and delivery of error-free electronic survey data capture applications for NHBS-Trans in English and Spanish; and

4) Provide QDS™ end-user training for NHBS-Trans field staff.

SECTION 3 – SCOPE OF WORK

As an independent organization, and not as an agent of the government, the Contractor shall furnish the necessary services through all tasks and activities contained within this Statement of Work. The Contractor shall provide all necessary labor, facilities, supplies, including SAS licenses, and equipment required to provide support in the following areas.

SECTION 4 – TASKS TO BE PERFORMED

Base Period:

TASK 1. QDS™ v5.0 Enhancement Maintenance.

The Contractor shall program repairs as identified by CDC and the Contractor based on errors, flaws, problems, mistakes, failures, faults or other “bugs” and limitations with the previously CDC commissioned QDS™ 5.0 Enhancements.

TASK 2. Maintenance of Programmed MMP and NHBS Questionnaires.

Task 2.1.1. Maintenance of MMP Survey Questionnaire and MMP Local Survey Template. Based on CDC identified requirements, the Contractor shall use QDS™ 5.0 to program changes to 10% or less of the final existing code in English and Spanish interfaces for the 2021 MMP Survey Questionnaire (Attachment A) and the 2021 MMP local survey template (Attachment B), including both text and logic elements. The Contractor shall use the final testing plan for the 2021 MMP Survey Questionnaire (Attachment C) to conduct testing for the changed portion of the code in English and Spanish interfaces for the MMP Survey Questionnaire and the MMP local survey template.

Task 2.1.2. Maintenance of NHBS Survey Questionnaire and NHBS Local Survey Template. Based on CDC identified requirements, the Contractor shall use QDS™ 5.0 to program changes to 20% or less of the final existing code in English and Spanish interfaces for the NHBS-IDU2022 Survey Questionnaire (Attachment D) and the NHBS-IDU2022 local survey template (Attachment E), including both text and logic elements. The Contractor shall use the final testing plan for the NHBS-IDU2022 Survey Questionnaire (Attachment F), to conduct testing for the changed portion of the code in English and Spanish interfaces for the NHBS Survey Questionnaire and the NHBS local survey template.

TASK 3. Analysis Phase for NHBS-Trans Survey Questionnaire.

The Contractor shall review, investigate, and document decision points related to the existing 2019 version of the NHBS-Trans Survey Questionnaire code (Attachment G), the existing 2019 version of the NHBS-Trans local survey template (Attachment H) and the new English and Spanish versions of the NHBS-Trans requirements documents (Attachments I-L) to code the questionnaire for the next round of NHBS-Trans data collection.

Task 3.1 Review of NHBS-Trans Requirements Documents. The Contractor shall review the English and Spanish versions of NHBS-Trans requirements documents (Attachments I-L), line by line, checking for inconsistencies of items or requirements that are not clear. Only CDC will make revisions to the NHBS-Trans requirements documents.

Task 3.2 Issues Log. The Contractor shall organize each inconsistency identified in Task 3.1 into an Issues Log. The Contractor shall create the Issues Log in the form of a spreadsheet or data base (according to the Contractor’s internal best practices procedures for survey development) and submit to the COR for review. The Contractor shall coordinate with the COR to discuss the appropriate way to update the Issues Log. As analysis is conducted, the Contractor shall make notes on the Issues Log that include the questions, suggested revisions and decisions regarding the correct variable, logic or skip pattern. The Contractor shall analyze all aspects of functionality including calculations, user interface, and operational issues such as values to be assigned for legitimate skips.

Task 3.3. Completion of Analysis Phase. After completion of the analysis phase, the Contractor shall notify the COR when the Analysis Phase is complete stating that "all requirements are understood in their entirety" in writing, and that the Contractor is ready to begin programming according to the approved NHBS-Trans requirements documents.

TASK 4. Programming for NHBS-Trans.

The Contractor shall use QDS™ 5.0 and the existing 2019 codes (Attachments G and H) to program the NHBS-Trans Survey Questionnaire in English and Spanish for use with tablet, laptop, and desktop devices with strict adherence to the approved NHBS-Trans requirements documents finalized in TASK 3. The Contractor shall also use QDS™ 5.0 to program the NHBS-Trans local survey template in English and Spanish. The Contractor shall discuss with the COR any limitations that prohibit programming as specified in the NHBS-Trans requirements documents to identify an acceptable alternate solution.

Task 4.1. Programming NHBS-Trans Survey Questionnaire. The Contractor shall program the new NHBS-Trans Survey Questionnaire to be ready for the testing phase (Option Period 1). The Contractor shall submit to the COR a Beta version of the newly coded NHBS-Trans Survey Questionnaire in English and Spanish formats to check the progress and quality of QDS™ programming completed to date. When submitting the Beta version of the coded NHBS-Trans Survey Questionnaire in English and Spanish, the Contractor shall also submit the English and Spanish versions of the Design Studio file, the Codebook in both MS Excel and Word (.RTF), a change history report and an MS Word version of the interviewer administered questionnaire in English and Spanish generated from the QDS™ Design Studio files.

Note: For the NHBS-Trans Survey Questionnaire items that display text to the user but are not associated with variables (e.g., element type "Information" and element type "Edit" that displays text on the screen), the Contractor shall record the item ID from the NHBS-Trans Survey Questionnaire requirements documents in the item's Notes in the Design Studio file.

Task 4.2. Programming NHBS-Trans Local Survey Template. The Contractor shall program in English and Spanish a separate QDS™ 5.0 Design Studio file for the new NHBS-Trans local survey template to be ready for the testing phase (Option Period 1). The Contractor shall program the NHBS-Trans local survey template so that field staff can edit the QDS™ file to code each jurisdiction’s local questions. The programming for the NHBS-Trans local survey template shall consist of no more than 50 variables.

The Contractor shall program the NHBS-Trans local survey template to include code to carry over specific values from the coded NHBS-Trans Survey Questionnaire to the NHBS-Trans local survey template to ensure consistent administration from the users. The Contractor shall also program the NHBS-Trans local survey template to include code to allow the user to have the option for the NHBS-Trans local survey to automatically open upon completion of the coded NHBS-Trans Survey Questionnaire (‘auto-launch’).

Option Period 1:

TASKS 1-2 as listed in the Base Period shall be repeated for Option Period 1. In addition to these tasks, the Contractor shall complete the following additional tasks:

TASK 5. Testing for the NHBS-Trans Survey Questionnaire and for the NHBS-Trans local survey template.

The Contractor shall develop a testing plan for the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template that includes internal testing to ensure that the Contractor developed survey application is working according to the relevant requirements documents.

Task 5.1. Testing Plan. As part of the testing plan, the Contractor shall:

a) Develop specific testing scenarios that cover every possible skip and logic pattern and ensure all items in the requirements documents are 100% implemented.

b) Ensure that the user-interface displays all items appropriately in English and Spanish on each computer type to be used.

c) Ensure that all variables from the coded questionnaires and the local survey templates are tested, including all calculated variables.

d) Ensure SAS output functionalities are properly working. This shall require testing with licensed SAS software. The Contractor shall provide scenarios for calculated and other critical variables exported to SAS and cross tabulations for each calculated variable showing that every possible combination was tested.

e) Develop methods to identify and document the minor errors that may be identified during user acceptance testing (UAT) and then to validate that errors were corrected.

Task 5.2 Testing in Spanish interface. Once testing in Task 5.1 (a-e) as listed above is completed for the English version of the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template, the Contractor shall begin testing for the Spanish version of the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template, unless the COR determines that simultaneous testing of the English and Spanish versions is preferable.

Task 5.3. User Acceptance Testing (UAT). The Contractor shall submit to the COR a UAT-ready version of the newly coded English and Spanish versions of the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template to inspect the QDS™ programming. CDC will complete the UAT within 28 days of receipt. Only one round of UAT is expected for the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template given adherence to the requirements documents; however, additional rounds of UAT may be necessary if errors are encountered. The NHBS-Trans Survey Questionnaire requirements documents are unambiguous and were developed to provide detailed and exact specifications for programmers.

The Contractor shall ensure that the programmed survey applications for the NHBS-Trans Survey Questionnaire and the NHBS-Trans local survey template are 100% functional before UAT begins. CDC reserves the right to reject a product as not ready for UAT and request completion of testing and programming from the Contractor before UAT continues.

TASK 6. NHBS-Trans Deployment

Task 6.1. Technical assistance. The Contractor shall provide technical assistance to approximately 50 survey users located in up to 10 state, local and territorial health departments across the United States for a period beginning 1 month prior to NHBS-Trans survey application program set deployment and up to 4 months after deployment. The contractor shall conduct phone consultations to ensure the correct installation of QDS™ modules and on an ad-hoc basis to trouble-shoot QDS™ software programming challenges.

Task 6.2. NHBS-Trans survey application program set deployment. The Contractor shall deliver to the COR the final tested NHBS-Trans Survey Questionnaire electronic survey application, local survey template and corresponding materials. The Contractor shall provide to the COR the control files (English and Spanish), codebooks in both MS Excel and Word (.RTF) (English and Spanish), Design Studio file, change history report and other documentation using CDC-provided naming conventions.

TASK 7. Training for NHBS-Trans The Contractor shall develop a training curriculum to train via webinar approximately 50 field staff located throughout the United States to effectively use QDS™ 5.0 CAPI programs. The Contractor shall also develop an evaluation for the training curriculum. The Contractor shall provide a draft of the training curriculum and evaluation plan to the COR for review and approval at least 2 weeks prior to the first of the two training sessions. The Contractor shall include in the curriculum basic QDS™ functions, best practices, local question programming guidance, and examples using QDS™ 5.0 code from the NHBS-Trans Survey Questionnaire and local survey template survey applications. CDC will send out a training notification and agenda to the potential participants along with the logistical details needed to access the webinar. The Contractor shall record the webinars, and the Contractor shall provide a clean copy of the recording to CDC. The Contractor shall develop and disseminate a training evaluation within 72 hours following the training to assess the session and to better understand future training needs. The Contractor shall compile the results of the evaluation and submit to the COR.

TASK 8. Maintenance of NHBS-Trans Survey Questionnaire.

Based on CDC identified requirements, the Contractor shall use QDS™ 5.0 to program changes to 10% or less of the final code in English and Spanish interfaces for the NHBS-Trans Survey Questionnaire (deliverable for Task 6.2), including both text and logic elements. The Contractor shall use the final testing plan (deliverable for Task 5.1) to conduct testing for the changed portion of the code in English and Spanish interfaces for the NHBS-Trans Survey Questionnaire and local survey template.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

2021 MMP Survey Questionnaire code (Attachment A)

2021 MMP local survey template code (Attachment B)

Final testing plan for the 2021 MMP Survey Questionnaire (Attachment C)

NHBS-IDU2022 Survey Questionnaire code (Attachment D)

NHBS-IDU2022 local survey template code (Attachment E)

Final testing plan for the NHBS-IDU2022 Survey Questionnaire (Attachment F)

2019 NHBS-Trans Survey Questionnaire code (Attachment G)

2019 NHBS-Trans local survey template code (Attachment H)

NHBS-Trans requirements documents (Attachments I-L)

SECTION 6 – PERIOD OF PERFORMANCE

Base Period: September 8, 2021 – September 7, 2022 Option Period 1: September 8, 2022 – September 7, 2023

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Reporting Requirements:

The Contractor shall provide a Monthly Status Report, in accordance with this Contract. The Monthly Status Report shall include a summary of the tasks’ progress, program management, and financial activities. The Contractor shall electronically submit a copy of the Monthly Status Report to the COR and the Contracting Officer by the 15th day of each month following the month reported. In addition, the report shall describe and include:

a) The tasks’ schedule, milestones, and progress.

b) Work accomplished in prior month; and work scheduled on tasks for the next month.

c) Current and anticipated problems that will impact the Contractor's performance.

d) Proposed solutions or lessons learned in response to current and anticipated problems.

e) Usability plans, findings and recommendations submitted intermittently during the course of each task.

Once a week, the Contractor shall participate in conference calls and/or web-based meetings to discuss product enhancement and clarification. Days and times of the conference calls and web-based meetings will be determined by the COR. The COR will determine if fewer or more conference calls are needed. The Contractor shall submit notes from the weekly conference calls/web-based meetings to the COR within 5 business days.

Task #

Description Quantity or No.

of Copies

Delivery Date

Deliver To

1 (E-copy)

option year 1 (2022)

COR

option year 1 (2022)

COR

option year 1 (2022)

COR

option year 1 (2022)

COR

option year 1 (2022)

COR

option year 1 (2022)

COR

option year 1 (2022)

COR

COR

Reporting Requirements

SECTION 8 – REFERENCE MATERIALS

https://www.cdc.gov/hiv/statistics/systems/mmp/index.html https://www.cdc.gov/hiv/statistics/systems/nhbs/index.html

SECTION 9 – POINT OF CONTACT INFORMATION

The Point of Contact (POC) for this procurement is: Elana Morris Centers for Disease Control and Prevention National Center for HIV/AIDS, Viral Hepatitis, STD, and TB Prevention Division of HIV/AIDS Prevention 1600 Clifton Rd., Mail Stop US8-4 Atlanta, Georgia 30329

Telephone Number: 404-718-8193 Fax Number: Click here to enter text.

E-mail Address: EMorris1@cdc.gov

Preferred method of communication: Email

SECTION 10 – MINIMUM VENDOR QUALIFICATIONS AND LEVEL OF EFFORT

The Contractor shall have a minimum of 10 years’ experience in QDS™ software programming and have access to the QDS™ 5.0 source code.

The Contractor shall have expertise in QDS™ coding, QDS™ testing, survey design, project management, training, and technical assistance.

The Contractor shall have a minimum of one (1) resource with training in epidemiology and one (1) resource with advanced Spanish language skills.

SECTION 11 – EVALUATION FACTORS

In evaluating offers for an award, the Government anticipates awarding a contract to the Offeror whose quotation is most advantageous to the Government, that is, making award to the Offerors whose overall integrated proposal, including technical proposal, business proposal, and past performance information is most advantageous to the Government. Offerors shall be evaluated in accordance with FAR 15.308 to an Offeror whose quotation represents the best value to the Government. Failure to respond or follow the instructions regarding the organization and content of the Technical and Business Proposals may result in the Offeror’s quotation being removed from further consideration. In accordance with FAR 2.101, best value is defined as the expected outcome of an acquisition that, in Government’s estimation, provides the greatest overall benefit in response to the requirement. While the evaluation of no single aspect of an Offeror’s integrated proposal; is expected to be the controlling factor in the selection of the successful Offeror, the technical evaluation factors are more important than price; the Government, however, will not make an award at a significantly higher overall price to achieve slightly superior technical approach and understanding of the requirement or management features.

The following instructions are provided to assist the Offerors in understanding the information needed to make an objective selection of the contractor for the proposed procurement. Since the information constitutes the major basis for proposal evaluation, it will be advantageous to the Offeror to present a proposal in a clear, concise manner and in terms understandable to those who may be unfamiliar with the Offeror’s detailed intentions and reasoning process.

The proposal must be sufficiently detailed and complete to demonstrate an understanding of and ability to comply with the requirements of the RFP. The quotation shall demonstrate such understanding and ability in a concise, logical manner, and should not contain superfluous material that is not related directly to this acquisition. Offerors must demonstrate capability of performing all tasks outlined in the Statement of Work (SOW).

1. Technical evaluation:

Technical evaluation criteria for this proposal is listed in order of importance and is as follows:

Criteria

Technical Approach Management and Staffing Plan

Each criterion will be evaluated according to the extent that it reflects a clear understanding of the subject areas to be accomplished and on the soundness, practicality, and feasibility of the Offeror’s technical approach for providing the services required for this contract.

1. Technical Approach:

The Offeror shall provide a discussion of their technical approach for providing the services required for this contract and indicate their understanding of the requirements, operating environment, and the contract objectives. This discussion shall be in the Offeror’s own words; not simply a regurgitation of the requirements listed. The Offeror shall provide a Project Plan with milestones and clearly labeled timelines for providing the services as described in the RFP. The Project Plan shall include separate timelines for the Medical Monitoring Project (MMP), National HIV Behavioral Surveillance (NHBS) and NHBS among Transgender Women (NHBS-Trans) survey questionnaires. The timelines shall illustrate major milestones for all deliverables with level of effort. The Project Plan shall be no more than 25 pages. The Offeror shall provide a Contract Work Breakdown Structure (CWBS) describing the process and approach they propose to use in successfully completing this project. The CWBS should correlate to the Offeror’s price/cost proposal.

The Offeror shall specifically address aspects such as technical understanding, methodology, approach, and the following:

a. Provide a detailed and comprehensive statement of the problem, scope, and purpose of the project to demonstrate complete understanding of the intent and requirements of the contract and potential problems that may be encountered.

b. Describe the proposed technical approach to comply with each of the requirements specified in the SOW. The proposal must be consistent with the stated goals and objectives. The proposed approach must ensure the achievement of timely and acceptable performance and will include a milestone and/or phasing charts to illustrate a logical sequence of proposed events.

c. Discuss the plan and solutions for overcoming difficulties involved with performing the work requirements. The plan shall address what action the Offeror will take if milestones are missed and how the project will stay on schedule to meet set annual survey deployment dates (deployment dates cannot be moved).

2. Management and Staffing Plan:

The Offeror shall present a complete description of their management and staffing plan to meeting the requirements and tasks listed in the SOW.

a. The Offeror shall describe their organizational structure and how they propose to manage this task, including a discussion of timelines and issues.

b. The Offeror shall include methods of communication with CDC to report status of tasks.

c. The Offeror shall adequately describe the resources they propose to complete the work described in the SOW and a rationale for their proposed approach. The Offeror shall identify any resources (facilities, hardware, software, communications, etc.) that would be required above and beyond that already addressed as part of this RFP. The Offeror shall demonstrate current access to QDSTM 5.0 source code.

d. The Offerors shall provide (1) a detailed description of how conflicts are managed; (2) a plan to ensure client satisfaction; and (3) a measurement of fiscal responsibility and accountability paying particular attention to the deliverable timeline in this task order.

e. Offeror shall identify (if any) assumptions or conditions relating to their Management Plan and Other Qualification Information. The Government reserves the right to reject any proposal that includes any assumption or condition that adversely impacts or affects the Government’s requirement.

a. A staffing matrix showing type and number of staffing resources readily available for the base effort, including breakdowns by skill sets, security clearances and any related technical IT certifications. The matrix of proposed personnel shall also include their experience, education, skills, and qualifications to do the job. The matrix shall identify which staff will be assigned to each task in the SOW. A plan shall be included for managing conflicting, time-sensitive demands from MMP, NHBS and NHBS-Trans.

b. A description of experience of assigned staff, including a detailed resume, biography, or curriculum vitae (CV) of each candidate. Experience must include expertise in Spanish. The backgrounds of the personnel will reflect the length and variety of experience and expertise in tasks similar to the tasks required by this project and any relevant training.

c. A description of the Offeror’s approach to rapidly obtain and/or replace qualified staffing, including a table showing employee turnover rates for each of the past three years

d. Document the decision-making authority of the project director as related to other elements of the organization. The percentage of time each staff member shall contribute to the program will be adequately identified. The extent to which outside consultants or specialists will be used and evidence of availability shall be indicated.

SECTION 12 – SPECIAL CONSIDERATIONS

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

(End of provision)

SECTION 13 – INFORMATION SECURITY

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

5) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

7) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

8) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

9) Training

Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

10) Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

11) Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

a. Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.