SOW_ASPR TRACIE_2024.docx

STATEMENT OF WORK

Operate the Technical Resources, Assistance Center, and Information Exchange (TRACIE), a service of the U.S. Department of Health and Human Services, Administration for Strategic Preparedness and Response (ASPR)

May 13, 2024

1. REQUIRING ORGANIZATION

Administration for Strategic Preparedness and Response Department of Health and Human Services

ASPR/CP

400 7th St SW Washington, DC 20024

2. BACKGROUND

ASPR’s Strategic Plan goals are as follows: 1) prepare for future public health emergencies and disasters, 2) manage the Federal response to and recovery from public health emergencies and other disasters, 3) Improve and leverage partnerships with healthcare and public health stakeholders, and 4) Ensure workforce readiness through development of innovative workplace practices. Through a series of diverse stakeholder outreach and demonstration sessions, ASPR developed the Technical Resources, Assistance Center, and Information Exchange (TRACIE) to meet the information and technical assistance needs of regional ASPR staff, health care coalitions, health care entities, health care providers, emergency managers, public health practitioners, and others working in disaster medicine, health care system preparedness, and public health emergency preparedness. All work under TRACIE falls under one of the three components of technical resources, assistance center, and information exchange.

3. OBJECTIVE

The goal is to help improve Federal, state, health care coalitions and entities, healthcare professionals, local communities, and individuals in the area of medical and public healthcare preparedness, response, and recovery across the country. Key objectives include the following:

Technical Resources: Self-service support through a searchable, comprehensive Resource Library that contains hundreds of healthcare, public health, and emergency management published and gray literature. TRACIE will also provide specific Topic Collections which are select resources chosen by TRACIE subject matter experts as the most useful for healthcare preparedness practitioners. Additionally, TRACIE will develop resources to share best practices and fill identified knowledge gaps in health care preparedness and response.

Assistance Center: Remote support from Technical Assistance Specialists via an online submission, toll-free number, and email. Users will have access to a cadre of subject matter experts to assist in specific requests. Requests are categorized as urgent, simple, standard, and complex.

Information Exchange: Secure, restricted access site where users can post threads, respond to peer inquiries and exchange information on disaster healthcare delivery in a real-time environment.

4. SCOPE:

Through a series of interactions with the multiple ASPR stakeholders and Hospital Preparedness Program survey results it was determined that there was a significant knowledge gap in health care system preparedness. Specifically, there was a need for enhanced technical assistance, a comprehensive, one-stop, national knowledge center for healthcare system preparedness, multiple ways to efficiently share and receive (push-pull) information between various entities including peer-to-peer discussion boards and leveraging and better integrating support (force multiplier) for ASPR Regional staff.

5. APPLICABLE DOCUMENTS

· ASPR Strategic Plan

· National Biodefense Strategy

· National Defense Authorization Act of 2021

· National Health Security Plan

· National Response Plan- Emergency Support Function (ESF) #08

· National Security Memo 22

6. TECHNICAL REQUIREMENTS/TASKS

The contractor shall assist ASPR in compilation, analysis, and synthesis of knowledge about effective organization and delivery of disaster services across the continuum of healthcare, public health, and emergency management systems. The purpose of this effort will be to improve and broaden the range of overall technical assistance and public sector capacity for medical and public heath preparedness, response and recovery.

The contractor shall assist with identifying and analyzing the broad spectrum of existing disaster healthcare preparedness, response, and recovery knowledge centers and technical assistance centers activities and recommend new functions and capabilities. The contractor shall assist with how ASPR TRACIE can continuously improve, leverage and integrate various domains, while continuing to develop unique features and characteristics.

Knowledge Brokering: The contractor shall assist with development of a process to identify, retrieve, and integrate the best possible information and thinking available about the effective organization and delivery of disaster healthcare services in the aftermath of small- and large-scale disasters, criminal events, acts of terrorism, and other events that cause impact and disruption to the public health and healthcare system. The contractor shall:

· Assist with the process of pushing knowledge and information to others as well as pull and receive knowledge and information from a broad spectrum of sources.

· Include and integrate disaster medical and public health materials, such as plans, tools, templates, guidance documents, gray literature, and other services provided through a variety of public and private partner agencies to inform planning at the state, local community, and individual healthcare facility levels.

· Assist with the collection materials, which are reviewed by subject maters experts from government, academia, private industry, and healthcare to ensure the materials offered truly are best/ promising practices.

· Assist with creating a tailored content and streamlined processes that can be strategically used across the relevant platforms for various audiences and disaster scenarios.

· Have a workflow design and a content management system that helps to eliminate steps and leverages automation to as much of the process as possible so ASPR TRACIE will generate more content with the same resources and ensure that content is consistent across delivery platforms.

· Assist with identifying and coordinating technical assistance delivery through peer-to-peer support. TA delivery should utilize other States, healthcare preparedness professionals or ASPR TRACIE SME expertise when possible.

Consultation: At times, subject matter experts may be sought from within the public and private sectors. Examples of the type of expertise required would include such areas as behavioral and mental health; medical operations coordination centers (MOCCs); crisis standards of care (CSC); chemical, biological, radiological, and nuclear (CBRN); emergency medical services (EMS); triaging, health care infrastructure; medical product supply chain management; rural considerations; pediatric patients; medical countermeasures; emergency management; populations with access and functional needs; Centers for Medicare & Medicaid Services (CMS) reimbursement and conditions of participation; risk-communication/messaging; ventilator and respiratory apparatus; and other ASPR TRACIE topic areas as identified. The contractor shall:

· Provide telephone and on-site consultation, including the identification and use of subject matter experts when necessary.

· Continue to identify and acquire subject matters experts to assist with ASPR TRACIE information requests and document review prior to posting on ASPR TRACIE.

· Provide a subcontract to the ASPR TRACIE Senior Editor. The Senior Editor shall be designated by ASPR TRACIE Program Director, with input and consent from senior ASPR Leadership. This critical position provides subject matter expertise to the ASPR TRACIE Program Director and contract team and works with the team on resource development, outreach activities, and the continued development of ASPR TRACIE.

Coordination: ASPR TRACIE activities will take place in a very dynamic and diverse inter-agency, state, and local organizational environment. The contractor shall:

· Assist in coordinating and disseminating information releases across various HHS OPDIVs and STAFFDIVS, as well as FEMA and other federal interagency partners, state, local, healthcare coalition, and other stakeholders involved in disaster preparedness, response, and recovery activities.

· Assist in organizing and facilitating virtual conferences, workshops, training events, regional conferences, and meetings addressing disaster healthcare services using a combination of logistical knowledge and programmatic expertise.

· Continue to support ASPR TRACIE’s role as an organizing entity for difficult technical assistance requests and projects.

Dissemination: The materials, activities, and resources under-taken through ASPR TRACIE activities need to be systematically housed and disseminated, for a wide array of audiences. The contractor shall:

· Establish and operate a website to provide a main point of entry for users.

· Identify materials that already exist by actively canvassing universal domains to see what already exists, how that information might be improved upon and/or tailored to different audiences and serve as a collation point for such materials.

· When necessary, provide training and technical materials (such as webinars or podcasts, tools, tip sheets, best practices models) based on evidence-based models adapted to meet the needs of diverse populations in order for states and service providers to fulfill medical and public health disaster cycle activities.

· Coordinate dissemination strategies through applicable HHS communications offices, to include:

· Creating and supporting communications goals/objectives; and

· Identify target audiences, through market research and a creative mix of communications and marketing approaches.

Tools and Frameworks: Based on requirements identified via the ASPR TRACIE process, recipient and health care coalition input, and lessons learned from exercises and real-life incidents, assist ASPR in identifying and developing modeling, simulation, and visualization tools and frameworks that can help address knowledge gaps. Domains might include areas like patient movement, medical surge, continuity of operations, coordination of care, downtime procedures, communication processes, triaging mechanisms, behavioral and mental health, scare resources and supply chain coordination, utility failures, durable medical equipment, health equity, and various healthcare delivery platforms. The contractor shall:

· Help identify and assimilate tools and frameworks from various organizational domains.

· Assist in developing frameworks and tools to help various components of the healthcare delivery continuum to better meet their hazard vulnerabilities.

· Maintain existing ASPR TRACIE developed tools and frameworks that our housed on the ASPR TRACIE website and partner websites.

Continual Improvement: ASPR TRACIE provides comprehensive, targeted technical assistance to various stakeholders on preparedness planning to build on existing capabilities and integrated strategies. In addition, because the nation faces unique new challenges related to the medical, healthcare, and public health consequences of disasters, emerging areas will need to be continuously monitored as newly developed technical assistance materials may be created for use at the Federal, state, and community levels. The contractor shall:

· Provide ongoing technical assistance in needs assessment, planning, and development of command and response systems.

· Develop and support guidance materials, decision-support materials, planning training events for new or emerging areas.

· Continuously review emerging issues and technical assistance trends to provide recommendations to ASPR on gaps in available information and resources and how to address those gaps.

· As needed, will make updates to the ASPR TRACIE website to improve the user experience.

6.2. Specific Deliverables

6.2.2 ASPR TRACIE Technical Resources

A. The Contractor shall update and maintain the ASPR TRACIE website located at https://ASPRtracie.hhs.gov. This will include providing a cloud-based system; the completion and maintenance of any information system security requirements for the Authority to Operate; develop and maintain a database and content management system to support the website; and develop and maintain an ASPR TRACIE Listserv. The website shall comply with Section 508 of the Rehabilitation Act according to the latest standards posted at http://www.hhs.gov/web/section-508/index.html. The website must maintain the following capabilities:

a. Be built in a mobile-friendly responsive design format

b. Be able to support all features currently available on the website (e.g., three domains, search function, etc.)

B. The contractor shall maintain all existing resources in the Technical Resources component and shall develop new ASPR TRACIE resources when approved by the COR.

6.2.3. ASPR TRACIE Communications and Outreach

A. The Contractor shall develop and maintain a general ASPR TRACIE Communications Plan that details regular scheduled communication with stakeholders including the ASPR TRACIE Listserv, the Hospital Preparedness Program and Health Care Coalition Listserv, and other HHS and ASPR stakeholders. This plan shall also include social media outreach. The communications plan may include the numerous publication types.

B. The Contractor shall develop and disseminate all materials as directed by the COR.

C. The Contractor shall be aware of emerging needs and maintain the ability to develop and produce materials in a variety of communication formats such as, but not limited to booklets, brochures/pamphlets, reports, newsletters, electronic/web, videos, and audio recordings, budget permitting. All products may be available for use via HTML 5 software or current ASPR TRACIE COR approved software and shall be available for use with portable hardware technologies such as with smartphones or tablets. In addition, all materials developed under this task order meant for publication on the ASPR TRACIE website also require 508-compliant electronic versions in either HTML 5 or tagged, 508-compliant Adobe Acrobat formats according to the latest standards posted at http://www.hhs.gov/web/section-508/index.html.

6.2.4. Develop and Launch/Conduct and Analyze Surveys and Feedback –Facilitate OMB Clearance Packages A. The Contractor shall develop OMB Clearance memoranda and supporting statements in consultation with ASPR TRACIE COR and ASPR OMB clearance officer. The Contractor shall be up to date on Privacy Act issues related to survey administration. The ASPR TRACIE COR will be responsible for submitting the package. The contractor will maintain all current feedback mechanisms.

6.2.5. Information Exchange

A. Situated within the ASPR TRACIE website, continue to develop and maintain the ASPR TRACIE Information Exchange (IE), a user-restricted peer-to-peer discussion board.

B. The Contractor shall vet registrants to ensure they have a valid need for access to the IE, according to the ASPR TRACIE Standard Operating Procedure.

C. The Contractor shall monitor and moderate all discussion threads for appropriate use.

D. The Contractor shall engage subject matter experts in discussion threads, as appropriate.

6.2.6. Maintain the Assistance Center

A. The Contractor shall provide free (to requestors) consultation and technical assistance to regional ASPR staff, healthcare coalitions, healthcare entities, healthcare providers, emergency managers, SLTT public health practitioners, and professionals/paraprofessionals working or aspiring to work on the development and implementation of effective and appropriate disaster preparedness, response, and recovery initiatives related to health care system emergency preparedness. Examples of such initiatives include National Incident Management System (NIMS) compliant disaster, medical and healthcare recovery plans, crisis standards of care plans, disaster or emergency response structures, and appropriate medical, public health, and medical evidence-based practices and services. Consultation shall be provided through a toll-free line, an email address, and an online, web form, which will serve as a point of contact for information, materials, and technical assistance from the Contractor. Consultation shall also be arranged with subject matter experts as necessary. Types of consultation by phone should include consultation regarding literature and resources available from the resource collection, discussion of technical assistance resources, and assistance in planning, disaster response, and evaluation.

6.2.7. Technical Assistance Special Projects

A. The Contractor shall develop and conduct technical assistance activities within various areas of disaster medical, healthcare, and public health. The Contractor shall maintain updated and accurate resources and messaging based upon emerging disaster incidents for state and local dissemination, as requested and approved by the ASPR TRACIE COR. The Contractor shall also arrange for either off-site (virtual) or on-site technical assistance to selected medical, healthcare, public health service providers, administrators, and planners as directed by the ASPR TRACIE COR and as the budget allows based on ASPR TRACIE COR prioritization.

B. As requested and approved by the ASPR TRACIE COR, rapidly develop resources and technical assistance products in response to disasters and Public Health Emergencies for ASPR stakeholders.

6.2.8. Subcontracts

A. The Contractor shall develop the necessary subcontract to provide the services and support of the ASPR TRACIE Senior Editor. The Senior Editor provides subject matter expertise to the ASPR TRACIE Program Director and contract team and works with the team on resource development, outreach activities, and the continued development of ASPR TRACIE.

B. The Contractor shall develop the necessary subcontracts to maintain and continue to develop the ASPR TRACIE products housed on partner websites.

6.2.9. Transition Out

A. By the 8th month of the final performance period, the Contractor shall provide three (3) copies of plans for transfer of the project to either the government or a new contractor (as applicable). If necessary, the Contractor shall initiate transition activities 60 calendar days prior to the expiration of this task order.

B. At the Contracting Officer’s discretion, the Contractor shall participate in five (5) or more meetings with the new contractor to affect a smooth transition and to provide detailed information on the operation of this task order.

C. The Contractor shall design, develop, implement, maintain, and if required, migrate and transition all ASPR TRACIE items from the Contractor’s possession to the ASPR server along with all relevant materials, products, and technologies. The Migration and Transition Plan should include functional, technical, operational, and other requirements. The draft plan should also include major technical milestones and implementation dates of the project, including the migration and transition phase. One (1) electronic copy of the draft plan shall be submitted to the ASPR TRACIE COR for review and approval within the 8th month of the final performance period. The final Migration and Transition Plan that includes feedback comments from ASPR TRACIE COR shall be submitted as a deliverable within the 6th month of the final performance period, one electronic copy, to the ASPR TRACIE COR.

6.4. Key Personnel

The contractor shall provide the following staff to fulfill the requirements outlined in this SOW:

6.4.1 Program Manager

· 7 years of experience managing or assisting with the management of a technical assistance center contract for federal health clients

· Over 5 years managing engagement of multiple organizations within ASPR, including support to various ASPR offices and programs such as the Office of Health Care Readiness, Hospital Preparedness Program (HPP), Office of Critical Infrastructure Protection, Medical Reserve Corps, Strategic National Stockpile, National Disaster Medical System (NDMS), Office of Regional Response, Office of Community Mitigation and Recovery, and the Biomedical Advanced Research and Development Authority (BARDA)

· Experience working directly with ASPR programmatic data sets

· Experience working directly with ASPR stakeholders including HPP recipients and subrecipients (e.g., health care coalitions), national associations, and interagency partners

· Experience providing support to the 18 provider and supplier types as defined by CMS

6.4.2 Deputy Program Manager and Communications Manager

· 7 years managing a complex database of emergency preparedness resources for public use.

· 7 years of experience supporting communications for technical assistance centers for federal health clients.

6.4.3 Information Technology Manager

· Over 10 years of experience providing overall direction and leadership for website development, hosting solutions, website management, and other information technology services for federal health clients.

· Over 7 years of experience managing the Authority to Operate process for moderate and/or low risk technology solutions for HHS.

In addition, the contractor shall provide staff as appropriate to support the tasks specified in the SOW. The offeror shall provide a resume for each person proposed for the project. All staff for which resumes are submitted will be considered key staff and dedicated to this project if a contract is awarded. Individual resumes shall be no more than 3 pages in length. Resumes will not count in the overall page limits.

7. GOVERNMENT FURNISHED RESOURCES AND INFORMATION

The Government will issue HHS PIV card badges, laptops, and cell phones to the project team.

8. REQUIREMENTS FOR HANDLING SENSITIVE/PROPRIETARY INFORMATION

The Offeror shall guarantee strict confidentiality of the information/data that is provided by the Government during the performance of the contract. The Government has determined that the information/data the Offeror will be provided during performance of the contract is of a sensitive nature and cannot be disclosed in any manner.

Disclosure of this information/data, in whole or in part, by the Offeror can only be made after the Offeror receives advanced written approval from the Contracting Officer. Whenever the Offeror is uncertain with regard to the proper handling of information/data under this contract, the Offeror shall request and obtain a written determination from the Contracting Officer before taking action.

The offeror will also adhere to all Records Management requirements and Systems of Records Notifications that apply to the ASPR TRACIE data sets.

9. DELIVERABLES

The contractor shall submit the following major types of final deliverables for task orders. The vast majority of the tasks contained within this SOW are required on an ongoing basis and the demand for these services may vary at times. Because each task will be different, deliverables and timeframes will be determined by the ASPR TRACIE Contracting Officer’s Technical Representative (COR) but will fall generally into these categories.

· ASPR TRACIE website (https://asprtracie.hhs.gov/) must be open and available 24/7/365. The website must maintain all required security controls and maintain an approved Authority to Operate (ATO). This will include responding to just in time data calls from the HHS Office of the Chief Information Officer (OCIO) and Chief Information Security Officer (CISO). This includes all ATO and Enterprise Performance Life Cycle (EPLC) required documentation.

· The ASPR TRACIE Assistance Center must have phone, webform, and email access during federal business day working hours.

· Reports/White Papers. The contractor shall summarize all work performed under each task order in a draft final report. The ASPR TRACIE COR will review the draft final report, assisted by any other reviewers that the COR designates to revie the report (such as panels of subject matter experts (SMEs). The contractor shall send electronic copies to the COR on the agreed upon deadline.

· Briefings. When required, the project director or other designated contractor staff member shall provide written or oral briefings to the COR and other ASPR staff on the progress of work under the task order. The ASPR TRACIE COR will determine the method of briefing. The contractor shall conduct most briefings by telephone, but some briefings may be required on site. Unless otherwise indicated, the contractor shall provide appropriate materials for the briefing (e.g., report summaries, PowerPoint slide deck).

· Results of Intermediate Data Analyses. To assess the progress of work under each task the ASPR TRACIE COR may request that the contractor provide results of critical analyses for review. The ASPR TRACIE COR will specify these analyses and the timelines for delivery in the task order. Narrative reports, other than brief explanatory notes shall not be required with the analysis results.

· Graphics, dissemination plans, and other communication products. The contractor shall produce charts, slides, or other required visuals to supplement the reports under some task orders. The need for graphics will be specified at the time the assignment is given.

· Audio or Video Products. The products will vary, but may include webinars, podcasts, or other recordings, including live action or animated video or other creative approaches to deliver information. The contractor shall produce the deliverables in a creative manner, using the latest technical approaches to design and sound.

Within 10 days of execution of the Task Order.

Updated drafts as needed Electronically to the COR

10. PERFORMANCE/DELIVERY PERIOD

The period of performance will be one 12-month base period with one 12-month option period followed by one 10-month option period.

11. PLACE/LOCATION OF PERFORMANCE/DELIVERY

The majority of the work for this contract will be done off-site at the contractor’s facilities. However, contract staff may be required to travel to meetings and conferences for presentation purposes or attend meetings or webinars HHS, ASPR, or other office buildings.

12. TRAVEL REQUIREMENTS

Contractor personnel may be required to travel to accomplish work under the awarded contract. All travel must be pre-approved in writing by the CO/CS and must be in accordance with the Federal Travel Regulations (41 CFR 300-304). The contractor shall not be reimbursed for any unauthorized travel. The Government will reimburse the contractor only for travel and costs within per-diem in the performance of the awarded contract. Reimbursement will be at cost only and in accordance with the Federal Travel Regulations. The contractor shall provide receipts for all travel expenses. The Government will not reimburse the contractor for travel costs incurred in the replacement of personnel when such replacement is accomplished for the contractor’s or employee’s convenience.

Travel within a 50-mile radius from the contractor’s facility is considered Local Travel. Local Travel is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the contractor’s facility will not be reimbursed.

The contractor shall not be reimbursed for any unauthorized travel. The Government will reimburse the contractor only for travel and per diem costs incurred as order on each individual task order. The Contracting Officer will not reimburse local travel costs on a time-and-material basis. The Government will not reimburse the contractor for travel costs incurred in the replacement of personnel when such replacement is accomplished for the contractor's or contractor's employee's convenience. All travel shall be approved in advanced. A Contracting Officer's Approval (COA) will be issued if the travel is approved.

13. OTHER DIRECT COSTS

If the contractor furnishes materials that meet the definition of a Commercial Item at FAR 2.101, the price to be paid for such materials shall be the contractor's established catalog or market price, adjusted to reflect the quantities being acquired and any modifications necessary because of contract requirements.

The contractor shall: (1) obtain materials at the most advantageous prices available with due regard to securing prompt delivery of satisfactory materials; and give credit to the Government for cash and trade discounts, rebates, scrap, commissions, and other amounts that are identifiable to the contract; (2) for indirect costs (Material Handling, Subcontract Administration, etc.), the Government will not reimburse the contractor for indirect costs. Any indirect costs associated with providing materials shall be included in the price of materials.

14. OBSERVANCE OF LEGAL HOLIDAYS AND ADMINISTRATIVE LEAVE

For work to be performed at Government site(s), the Contractor shall establish a standard holiday schedule that coincides exactly with the Government's schedule for employees working on a Government site. Holidays observed are listed below. For Government site work, holidays and other non-workdays are not billable unless work is specifically requested by the Government and productive hours are performed on those days. The following is a list of the official Federal Government holidays:

(4) Memorial Day (10) Thanksgiving Day

(5) Juneteenth (11) Christmas Day

(6) Independence Day

In addition to the days designated as holidays, the Government observes the following days:

· Any other day designated by Federal Statute.

· Any other day designated by Executive Order.

· Any other day designated by the President's Proclamation

No work shall be performed by Contractor personnel at Government facilities on Federal holidays or other nonwork days without prior written approval of the CO.

It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the Contractor's personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked. This provision does not preclude reimbursement for authorized overtime work if applicable to this contract.

When the Federal and governmental entities grant excused absence to its employees, assigned Contractor personnel may also be dismissed. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and shall be guided by the instructions issued by the CO or the COR.

Nothing in this clause abrogates the rights and responsibilities of the parties relating to stop work provisions as cited in other sections of this contract.

Contractor personnel that can continue contract performance (either on-site or at a site other than their normal workstation) shall continue to work and the contract price shall not be reduced or increased.

Contractor personnel that are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort.

15. INVOICES

Invoices shall be submitted via email. When submitting via email, send to www.ipp.gov or any successor site. The contractor shall submit one consolidated invoice each month. Invoices should be delivered electronically to the Contracting Officer (CO), the Contracting Officer's Representative (COR) and www.ipp.gov simultaneously.

Unless further changes are required, the Department of Health and Human Services shall notify the Contractor of the effective date of the clause at HHSAR 352.232-71 Electronic Submission of Payment Requests by providing written notice to the Contractor within thirty (30) days of implementing the HHS Electronic Invoicing Implementation Project (E-Invoicing) and within thirty (30) days of the anticipated finalization of the clause at HHSAR 352.232-71 Electronic Submission of Payment Requests, via public special notice issued through the SAM.gov portal. However, for purposes of this award, the effective date shall be the date signed by the parties.

15. GOVERNMENT POINTS OF CONTACT

Administration for Strategic Preparedness and Response 400 7th St SW Washington, DC 20024

Contracting Issues: Contractor Officer (CO) Technical Issues: Contracting Officer's Representative (COR)

16. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The Contracting Officer may designate Government personnel to act as the Contracting Officer's Representative (COR) to perform functions under the contract such as review or inspection and acceptance of supplies, services, including construction, and other functions of a technical nature. The Contracting Officer will provide a written notice of such designation to the Contractor within fifteen (15) working days after contract award or for construction, not less than five working days prior to giving the contractor the notice to proceed. The designation letter will set forth the authorities and limitations of the COR under the contract. The COR or any other representative shall not sign documents, such as contracts, contract modifications, etc., that require the signature of the Contracting Officer.

17. SPECIAL REQUIREMENTS

17.1 508 Compliance Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-andstandards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standardsand-guidelines. All ASPR TRACIE final products both posted to the ASPR TRACIE website and utilized internally, must be made compliant with Section 508 of the Americans with Disabilities Act and in accordance with requirements put forth by HHS specifically.

18. SECURITY AND BUILDING ACCESS REQUIREMENTS

A. HHS Badges. Parts 1400 and 731 of Title 5, Code of Federal Regulations establish the requirements for agencies to evaluate relevant covered positions for a position sensitivity and position risk designation commensurate with the duties and responsibilities of those positions. Specifically, section 1400.101(d) (external link) states, “All contract staff positions are evaluated for a position sensitivity designation commensurate with the responsibilities and assignments of the position as they relate to the impact on the national security, including but not limited to eligibility for access to classified information.” Section 731.106(a) (external link) of Title 5, Code of Federal Regulations states, "agency heads must designate every covered position within the agency at a high, moderate, or low risk level as determined by the position's potential for adverse impact to the efficiency or integrity of the service." Pursuant to sections 1400.201(c) and (d), and section 731.106(c)(2), the contract staff duties required have been evaluated and categorized as non-sensitive, low risk, Tier 1. Position designation records (PDAT’s) will be completed for each contract staff member by the ASPR TRACIE Program Director/System Owner. The duties performed by the contract staff do not involve national security; are categorized as government service delivery (to include customer service or public liaison duties), and only affect one agency (HHS).

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. In accordance with NIST FIPS 201-2 Approved Identity Documents for HSPD-12 PIV are submitted and contract staff are issued HHS PIV Badges and must have access to HHS email accounts.

B. Training Requirements.

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/ASPR Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Training Records. The Contractor must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior.

a. The Contractor must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and applicable ASPR policies.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual ASPR Information Security Awareness Training.

D. Incident Response.

a. The Contractor must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/ASPR] IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send ASPR COR/System Owner notifications so it can be coordinated with appropriated ISSO and HHS OS OCIO representatives.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the ASPR TRACIE System Owner, COR, CO, and ISSO, and other stakeholders outlined in the ASPR TRACIE SOP, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable ASPR and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

1. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

2. Not include any sensitive information in the subject or body of any reporting e-mail; and

3. Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/ASPR privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Privacy Act. Comply with the Privacy Act requirements.

F. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below.

G. Information Technology.

Pursuant to HHS Policy for Information Technology Procurements, Appendix B, the following applies to ASPR TRACIE. ASPR TRACIE is a contractor-owned-contractor operated system. The contractor operates the system and information technology containing data that supports the HHS mission. The contractor uses its own "information technology" (IT) defined by the Federal Acquisition Regulation (FAR) Subpart 2.1.

An annual Security Controls Annual Assessment must be completed, uploaded into ARCHER or any successor site, and approved. The TRACIE system must meet all the requirements in accordance with the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-18, Revision 1 and, utilize the controls articulated in NIST SP 800-53, Revision 5 for Federal Information Systems and Organizations. The ASPR TRACIE Systems Security Plan must be created in accordance with NIST guidance. The ASPR TRACIE Information System is deemed a Federal Information Security Modernization Act (FISMA) low impact system.

Titles II and III of the E-Government Act requires that agencies evaluate systems that collect personally identifiable information (PII) and determine whether the privacy of that PII is adequately protected. All government information and information systems must be protected in accordance with HHS/OS/ASPR policies and level of risk. At a minimum, the Contractor must protect the:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

Agencies perform this evaluation through a privacy impact assessment (PIA). HHS policy states that operating divisions are responsible for completing and maintaining PIAs on all systems (developmental and operational). Upon completion of each assessment, agencies are required to make that PIA publicly available.