75D301-20-R-67969 ALS Biorepository.doc

OLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

75D30120C08465

3. SOLICITATION NO.

75D301-20-R-67969

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

6. REQUISITION/PURCHASE NO.

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and handcarried, in the depository located in CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation. SEE SECTION L FOR DETAILED SUBMISSION INSTRUCTIONS.

10. FOR INFORMATION

CALL:

A. NAME

Eric A. Uhls

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2923

C. E-MAIL ADDRESS

kpy5@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

National ALS Registry Biorepository

The vendor shall provide Support to the National ALS Biorepository IAW the statement of work. This CLIN is for all contract functions except for post-mortem collection of specimens.

This is a severable line item.

This is a time and material line item

09/28/2020 - 09/27/2021

1 Job

National ALS Registry Biorepository

The vendor shall provide Support to the National ALS Biorepository IAW the statement of work. This CLIN is for all contract functions except for post-mortem collection of specimens.

This is a severable line item.

This is a time and material line item

09/28/2021 - 09/27/2022 1 Job

National ALS Registry Biorepository

The vendor shall provide Support to the National ALS Biorepository IAW the statement of work. This CLIN is for all contract functions except for post-mortem collection of specimens.

This is a severable line item.

This is a time and material line item

09/28/2022 - 09/27/2023 1 Job

National ALS Registry Biorepository

The vendor shall provide Support to the National ALS Biorepository IAW the statement of work. This CLIN is for all contract functions except for post-mortem collection of specimens.

This is a severable line item.

This is a time and material line item

09/28/2023 - 09/27/2024 1 Job

National ALS Registry Biorepository

The vendor shall provide Support to the National ALS Biorepository IAW the statement of work. This CLIN is for all contract functions except for post-mortem collection of specimens.

This is a severable line item.

This is a time and material line item

09/28/2024 - 09/27/2025 1 Job

National ALS Registry - Postmortem

This line item provides for the collection of post-mortem samples upon the death of the designated participant (Task 4), and may be exercised up to fifty (50) times during the contract period. Each exercise of this line item will result in the creation of a sub-CLIN for the post-mortem collection of one program participant.

Each sub-CLIN created by exercising this option shall be a non-severable, fixed price line item, and shall terminate on the expiration of the contract.

When exercised – 9/27/2025

NSP

This line item provides for travel related to each exercise of CLIN 0002, and may be exercised up to fifty (50) times during the contract period. Each exercise of this line item will result in the creation of a sub-CLIN for the travel related costs of the post-mortem collection of one program participant.

Each sub-CLIN created by exercising this option shall be a non-severable, time and material line item, and shall terminate on the expiration of the contract.

NSP

National ALS Registry – Contract Transition

This line is reserved for Contract Transition in the event that it is required. This Line item will be funded at the time of exercise.

Period of Performance: Determined at date of exercise. Not to exceed six months. Performance shall terminate on 9/27/2025.

This is a severable line item.

This is a time and materials line item.

B.1 Optional Task 4 (Line Item 0002) The Government may require the delivery of the numbered line item 0002 identified in the Schedule as an option item, in whole or in part, up to the price stated in the Schedule. Exercise of this option will result in the creation of a sub-CLIN to the corresponding line item, which will reduce the total CLIN price by the amount of the exercise. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days of the applicable start date. A written unilateral modification will be sent to the contractor. The Government may decide to issue a bilateral modification. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

Section C - Description/Specification/Work Statement

PERFORMANCE WORK STATEMENT

Title of Project: Research and Program Support of the National Amyotrophic Lateral Sclerosis’ (ALS) Biorepository in support of the ALS Registry Act

C.1 Background and Need The ALS Registry Act (H.R. 2295) was passed on October 16, 2008. The ALS Registry Act amends the Public Health Service Act to require the Secretary of DHHS, acting through the Director of CDC/ATSDR, to (1) develop a system to collect data on amyotrophic lateral sclerosis (ALS); and (2) establish a national registry for the collection and storage of ALS data.

In October, 2010, ATSDR officially launched the National ALS Registry. The purpose of the ALS Registry is to better describe the incidence and prevalence of ALS in the United States; examine factors, such as environmental and occupational, that might be associated with the disease; better outline key demographic factors (such as age, race or ethnicity, gender, and family history of individuals who are diagnosed with the disease) associated with the disease; and facilitate examination of the connection between ALS and other motor neuron disorders that can be confused with ALS, misdiagnosed as ALS, and in some cases progress to ALS.

In November 2018, ATSDR released its most current National ALS Registry prevalence report for 2015 which showed 16,583 cases for a prevalence rate of 5.2 cases of ALS per 100,000 persons in the U.S. general population. In addition to tracking new ALS cases, ATSDR is now engaging in a series of activities to further enhance the National ALS Registry. Examples already underway include launching new survey modules to help identify potential risk factors for ALS, funding investigator intiated R01 grants, connecting patients with clinical trials and epidemiological studies, and using comprehensive surveillance activities in select states and large metropolitan areas to help test the completeness of the Registry.

Because little is known about the role genetics plays in ALS, ATSDR conducted a pilot study to determine the feasibility of establishing a biorepository of samples from persons with ALS. Samples from approximately 330 patients have been collected, including blood, urine, hair, and nails samples, as well as post-mortem specimens from up to 30 patients, such as whole brains, spinal cords, and cerebrospinal fluid. The findings of that pilot study indeed support the creation of a biorepository.

C.2 Project Objective The purpose of this contract is to maintain and continue a national biorepository of specimens from persons with ALS enrolled in the National ALS Registry.

ATSDR is particularly interested in samples such as blood, urine, saliva, hair, and nails, in addition to port-mortem specimens such as bone, muscle, skin, whole brains, spinal cords, and cerebrospinal fluid (CSF). Note, these speciments are subject to change. Collected samples (already collected and future collections) may be used for the purpose of creating cell lines. While there are other biorepositories currently in existence that contain specimens from persons with ALS, these biorepositories are often limited and target select groups (e.g., military veterans with ALS). Additionally, these biorepositories do not necessarily collect epidemiological/risk factor data from the patients who contribute specimens (e.g., occupational, residential, and military history). Submission of specimens for this biorepository would be open to all persons with ALS enrolled in the congressionally mandated National ALS Registry. The ability to connect the biological material to information about risk factors and data about medical treatment will make the biorepository unique and especially valuable to ALS researchers.

This contract will provide funding for the operation, collection, transport, maintenance, cataloging, logistics, and ongoing analyses as directed by ATSDR of sample supply and demand of an existing biorepository of specimens from persons with ALS enrolled in the National ALS Registry.

C.3 Scope of Work The successful Contractor shall provide technical assistance support to a biorepository based on the existing protocol which was created by subject matter experts in registries, surveillance, and/or neurological diseases. Samples such as blood, urine, saliva, hair, and nails, in addition to post-mortem specimens such as whole brains, spinal cords, and CSF has been and may be collected, stored, and disseminated to qualified researchers requesting biospecimens.

C.4 Work Requirements/Tasks The Contractor shall perform the work requirements/tasks as described in Section C and in conformance with all other terms, conditions, and sections of the contract, whether printed in full text or incorporated by reference into the contract.

The contractor shall, as an independent organization and not as part of the Government, furnish all necessary services, facilities, equipment, qualified personnel, and material (except for those to be furnished by the ATSDR as specified elsewhere in this award) to perform the services required by the Performance Work Statement (PWS) as set forth below. The Contractor shall use its best efforts to optimize achievement of the Performance Requirements and Performance Standards listed below.

C.5 General Requirement:

The Contractor shall be responsible for the following:

1. The Contractor shall maintain and support an Office of Management and Budget and Institutional Review Board (OMB/IRB) approved biorepository linked to persons with ALS who are enrolled in the National ALS Registry, according to the specifications below:

Biorepository Biospecimen collection

a. Biospecimens shall be collected from up to 250 National ALS Registry enrollees per year. The collection number is subject to change as directed by ATSDR.

b. For each biospecimen collected, the collection may include up to 70 ml blood, nail clippings, hair clippings and urine. Blood tubes will be considered for: 1 tube Whole-Blood (Metal Free), 1 tube Whole-blood, 1 tube EDTA for DNA, 1 tube plasma, 1 tube serum, 2 tubes for RNA, and in a portion of particpants 1 tube for the creation of cell lines. Saliva will be collected only if blood draw is unsuccessful and if PALS requests it in lieu of blood sample.

c. Plasma and serum will be processed and stored in an appropriate facility in a way that will enable future analysis of DNA, RNA, chemicals, and metals.

d. Biospecimens will be stored for a period of time determined by the contract award.

e. Biospecimens will be transferred to a facility designated by COR at the end of the contract period, if applicable.

Biorepository Post-Mortem Specimen collection

a. Post-mortem biospecimens will be collected from up to 10 ALS Registry enrollees per year from various locations. The collection number is subject to change as directed by ATSDR.

b. Post-mortem biospecimens collected will include whole brain and spinal cords, cerebrospinal fluid (CSF), bone, muscle, and skin.

c. Brain and spinal cord tissue, CSF, bone, and muscle will be processed and transported to an identified facility that is to be determined by the COR. Skin will be stored by the COR approved contractor’s facility along with the other specimens.

2. In addition to biospecimens that will be collected prospectively, the Contractor shall receive, store, transport, and maintain the samples collected from the current inventory mentioned below as well as all new samples collected. In addition, the Contractor with input from the government shall determine adequate storage supply/demand of specimens. This may include obtaining new consent forms from existing participants and facilitating the necessary and appropriate IRB approvals.

3. The Contractor shall maintain an error free system for matching biospecimens IDs to those of National ALS Registry participants so that specimens and epidemiological data are linked.

4. The Contractor shall guarantee the security of Personal Identifiable Information (PII) during the custody chain. The Contractor shall transfer all PII to the Government prior to the end of the contract.

5. The Contractor shall work closely with the Veterans Administration (VA) to determine how Registry enrollees with military experience can become part of the VA’s Brain Banking program, if applicable. PALS with no military experience will be handled by the National ALS Registry’s biorepository.

6. The Contractor shall identify with approval from the COR an appropriate facility(ies) for the storage the repository specimens, according to panel recommendations.

7. The Contractor shall provide the COR with quality assessment/quality control analysis procedures for all sample collections.

8. The Contractor shall determine specimen demand for sample requests as well as plan to market and promote the repository.

C.6 Technical Requirements

In addition to the General Requirements, the following are specific tasks to this project.

In performing this contract, the contractor shall:

Task 1: IRB & OMB Support

Support the National ALS Registry with relevant IRB and OMB-PRA package materials. The contractor shall prepare, deliver, be familiar with, and have knowledge of all necessary internal/external clearances documents (e-Clearance, IRB, OMB).

Task 2: Participation Recruitment

Select and recruit participants enrollees, with input from Registry staff, in the National ALS Registry. The contractor shall use an appropriate sampling scheme for choosing enrollees, so that samples are as nationally representative as possible.

Task 3: Consent and Scheduling Collection

Conduct informed consent in accordance with an established ALS protocols and schedule collections.

Task 4: Conduct Collection and Logistics Conduct collections and facilitate the logistics for enrollees to be sampled according to a geographical representative sampling scheme. The contractor shall provide all materials needed for the collections.

Task 5: Process and Store Specimens

Process and store specimens (according to existing protocol). Ensure all samples are stored properly and in an approved facility. The specimens and quantities below are currently in our inventory:

Specimen Inventory as of April 30, 2020 Premortem (In-Home)

Postmortem

*note: whole blood collected metals free

Blood and Saliva counts may not be current because they are sent for DNA and RNA processing on a monthly basis.

**Due to Coronavirus, some Pre-Mortem collections have been suspended until further notice, although Post Mortem is ongoing. Note that they will commence again once we can ensure the safety of our pALS.

Task 6: Specimen Request Process Support ATSDR in the ALS Specimen Request Process by implementing and existing approved plan for releasing specimens to qualified scientists/researchers. This includes facilitating data review to ensure scientific merit, recovering costs for specimen request, and managing distribution. The Government anticipates up to 10 requests per year.

Task 7: Marketing Plan and Specimen Supply/Demand The contractor shall develop and implement an approved plan to market availability of specimens in the National ALS Biorepository to scientists/researchers, domestically and internationally. The contractor shall also conduct an analysis of the types of specimens that may be requested and collected as well as documentation of specimens distributed throughout the year.

Task 8: Development of Publications

Support development of publications related to the National ALS Registry/Biorepository. Should scientific publications be developed based on the work, the contractor shall comply with ATSDR and CDC requirements for pre-submission review, co-authorship, and clearance of scientific documents.

(OPTIONAL) Task 9: Contract Transition

a) The contractor shall develop a written plan, subject to COR approval, to ensure the orderly transfer of all contract-generated data, documents and other materials to the Government and/or a successor contractor.

b) For the specimen samples, obtain disposition instructions from the Government regarding specimen samples and other related data.

c) Conduct a smooth transfer of all databases, data/information and other files, documents, and materials required under the contract to the Government and/or the successor contractor within 6 month of date of exercise of this option or by September 27, 2025, whichever occurs earlier.

In the event of transition, the current specimens and samples will be shipped/transferred to the specificed location as instructed by the COR with no loss of sample integrity. Samples are being stored in the city and states below. The exact location will be released to the contractor upon award.

Post- Mortem: Jamaica Plains, MA and Bedford, MA

Pre-Mortem: Rockville, MD iPSCs (from Skin fibroblasts): Research Triangle Park, NC

C.7 Reporting Schedule

A. Monthly Progress Reports

Monthly Progress Report shall be submitted to the Contracting Officer and the Contracting Officer’s Representative (COR) within 3 days of the submission of the contractor’s invoice. Stardard operating information should be included as such:

· Person hours of time and dollars expended on each project/site for the present reporting period and year to date by individual name and type of personnel utilized (clerical, professional, managerial).

· Cost, other than personnel, for each project/site including projected expenditures for the next month or reporting period as designated by the ATSDR CORs.

· The number of contacts made with interested registry enrollees, number of consents, number of collections completed or failed, number of specimens distributed, and any other contract activities that have occurred within the reporting month.

B. Meeting Minutes

A report summarizing the minutes from a monthly progress call to report or discuss the findings and efforts from the previous month shall be submitted within 10 days to the COR. The contractor shall keep minutes of all monthly conference call meetings, and any other decision making meetings with the COR. The minutes shall include the contract number, project director, a list of attendees, a description of the issues discussed, action items, assignments and due dates.

C. Specimen Inventory Reports

A report summarizing the exact number and type of specimens that are in storage as of the date the report is submitted to the COR. This will include all specimens independent of their location with the exception of the post-mortem collection of the Brain, Spinal Cord, and CSF.

D. Monthly Conference Calls

The Contractor and the Government will conduct monthly progress calls to discuss the performance and financial status of the project. The contractor shall submit an agenda, and any materials to be used for discussion, three working days in advance of the meetings. The participants in the meetings may include the COR and other Agency staff as deemed appropriate by the COR, the Project Director, and relevant project staff as selected by the Contractor with the COR’s acceptance.

Progress will be reviewed, milestones discussed, problems examined, solutions explored, and short-range and long-range plans made. Action items and minutes resulting from this meeting shall be prepared by the Contractor and submitted electronically to the COR within ten days after completion of the meeting. If corrections are necessary, revised replacement minutes shall be submitted within two (2) days after receipt of the COR’s comments.

E. Notification of 75% Completion Report

In a separate report, Contractor shall provide written notification to COR and Contracting Officer when project work has reached 75% of the not-to-exceed amountt awarded for the applicable base or option period of performance.

F. Financial Reports

Financial Reports detailing current status of each project/site under the contract shall be provided by the Contactor. Financial reports should demonstrate actual costs to budgeted costs as a whole. The contractor shall send one copy of the Financial Report to the COR, End User, and the Contracting Officer. Financial reports will be required when the Contractor invoices the Government.

C.8 Deliverables Delivery Schedule: Please submit electronically to the Contracting Officer’s Representative (COR) with a duplicate copy to Contracting Officer (CO).

Deliverable Schedule

C.10 Government Quality Assurance

Quality assurance will be performed by the Government during the contract at regular intervals. Methods may include visual survey and review of Contractor quality control documents. Deduction for work may include rework at no cost to the Government or Government acceptance with price reduction.

Exercise of Option

Exercise of Option

Exercise of Option

Exercise of Option

Participants are confirmed via DNA sex matches to the known sex of the participant.

Annual audits and inspections of lab facilities.

The specimens are transported, kept and stored at a constant temperature and the integrity of the sample is preserved.

All incoming and outgoing specimens are documented accurately.

Exercise of Option

(2) Reports comply with PWS and Federal regulations

(3) Timely submission

Exercise of Option

C.11 Quality Control

The contractor shall develop a quality control plan that provides details of how quality control will be addressed for all major deliverables and tasks. The plan shall detail how they shall monitor and control the services provided in terms of: timeliness, accuracy, relevance, accessibility, cost-effectiveness, technical requirements and contract provisions.

This plan shall identify which quality standards are relevant to the project and determine how to satisfy them. The contractor will apply the quality control activities identified in the plan and monitor specific project results to determine whether they comply with relevant quality standards. The contractor will identify ways to eliminate causes of unsatisfactory performance. At a minimum this plan shall address:

* Overall project quality control including any proposed evaluations addressing efforts to reduce errors, data collection specialist, abstractor and monitoring, training and retraining of staff, change control process, planning for cyclical changes in staffing and workload.

* Identification of major data quality indicators that require weekly monitoring during data collection (missing data, response rate)

* Data capture instrument change - question development, programming, if needed, testing and evaluation

* Version control for documentation, forms, and memos, and design changes

* A check list of items to be verified for all data deliverables (is the number of records correct, has benchmarking been completed and if so, what were the results of the benchmarking), has the documentation and cover memo been checked for accuracy)

* Adequate and timely documentation to assure repeatability of all data capture activities

* The development and maintenance of decision logs and procedural manuals for all data coding, data entry, data collection, data editing, data abstraction, and verification activities

* Setting up a structure in which responses to ATSDR Peer Reviews within one month of receipt.

* Supervisor related QC activities

C.12 Special Considerations

RECORDS RETENTION

· All data created during the course of this contract must be retained, stored and disposed of in accordance with the appropriate CDC Records Control Schedule.

DATA RIGHTS

· In accordance with FAR 52.227-14, Rights in Data-General, The Government has unlimited rights to all documents/material or other products produced under this contract. All documents, materials or other products, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Section 508:

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

503 Applications

504 Authoring Tools

602 Support Documentation

603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

(End of provision) Government Information Processed on GOCO or COCO Systems

A. Security Requirements for GOCO and COCO Resources

1) Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal directives that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P), the CDC Protection of Information Resources policy; Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

2) Security Assessment and Authorization (SA&A). A valid authority to operate (ATO) certifies that the Contractor’s information system meets the contract’s requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO prior to any use of the system in a production capacity, i.e., its intended users able to collect, store, process or transmit data to fulfill the system’s function. The Contractor shall conduct the SA&A requirements in accordance with HHS IS2P/ CDC Protection of Information Resources; the CDC IT Security Program Implementation Standards; the CDC Security Assessment and Authorization (SA&A) Standard Operating Procedure; and NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

CDC acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the system security and privacy controls are implemented and operating effectively.

a. SA&A Package Deliverables - The Contractor (and/or any subcontractor) shall provide an SA&A package to the C/I/O Information System Security Officer (ISSO) in accordance with the timeline, process and formats proscribed for a Full system authorization in the CDC Security Assessment and Authorization Standard Operating Procedure (CDC SA&A SOP). The following SA&A deliverables are required to complete the SA&A package:

· Baseline System Information (BSI) – The Contractor will document a system overview, in accordance with the timeline, process and formats described in the CDC SA&A SOP. The BSI will include information concerning: system identification and ownership; system data, information types, impact levels and system categorization; system functional description / general purpose; system authorization boundary and environment; system user descriptions; and system interconnections and dependencies. The Contractor shall update the BSI at least annually thereafter.

· Privacy Threshold Analysis / Privacy Impact Analysis – The Contractor (and/or any subcontractor) shall provide a PTA/PIA (as appropriate), in accordance with the timeline, process and formats described in the CDC SA&A SOP, if applicable. Also see the sections of this contract concerning “Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)” and “Requirements for Procurements Involving Privacy Act Records.”

NOTE: If social security numbers (SSN) are expected to be handled by the system, the program and Contractor must include a SSN Elimination or Usage Approval Request along with the PTA/PIA. That request will be processed in accordance with the OCISO Standard for Limiting the Use of Social Security Numbers in CDC Information Systems.

· System Security Plan (SSP) – The SSP must be provided in a digital format supporting copy or export of all content into the HHS/CDC automated SA&A tool. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and CDC policies and other guidance. The SSP shall be consistent with and detail the approach to IT security contained in the Contractor’s bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment (including an inventory of all devices and software contained within the system boundary) and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

· Risk Assessment Report (RAR) The initial security assessment shall be conducted by the Contractor in conjunction with the program’s Information System Security Officer, consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and CDC policies. The assessor will document and submit the assessment results in the RAR, in accordance with the process and formats described in the CDC SA&A SOP. The Contractor shall address all “High” deficiencies before submitting the package to the Government for acceptance. All remaining deficiencies must be documented in a system Plan of Actions and Milestones (POA&M) for CDC OCISO approval in accordance with the CDC SA&A SOP. Thereafter, the Contractor, in coordination with CDC shall conduct an assessment of the security controls and update the RAR within 365 days.

POA&M –The POA&M shall be documented consistent with the HHS Standard for Plan of Action and Milestones and CDC policies. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the Security Assessment Report (SAR), shall be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, CDC may require designated POAM weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M shall be updated at least quarterly.

· Contingency Plan and Contingency Plan Test –The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS and CDC policies. Upon acceptance by the System Owner, the Contractor, in coordination with the System Owner, shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. Thereafter, the Contractor shall update and test the Contingency Plan at least annually.

· E-Authentication Assessment – The contractor (and/or any subcontractor) shall collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods shall follow OMB 04-04; NIST SP 800-63, Digital Identity Guidelines; the OCISO Standard for Electronic Authentication (E-Authentication); and the CDC SA&A SOP.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

b. Information Security Continuous Monitoring. Upon the government issuance of an Authority to Operate (ATO), the Contractor (and/or subcontractor)-owned/operated systems that input, store, process, output, and/or transmit government information, shall meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, and HHS IS2P. The following are the minimum requirements for ISCM:

· Annual Assessment/Pen Test - Assess the system security and privacy controls (or ensure an assessment of the controls is conducted) at least annually to determine the implemented security and privacy controls are operating as intended and producing the desired results (this may involve penetration testing conducted by the agency or independent third-party). In addition, review all relevant SA&A documentation (SSP, POA&M, Contingency Plan, etc.) and provide updates by specified due date.

· Asset Management - Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS-owned information/data. It is anticipated that this inventory information will be required to be produced at least annually. IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

· Configuration Management - Use available SCAP-compliant automated tools, per NIST IR 7511, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard HHS and government configuration baselines at least annually. The contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

· Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST-specified SCAP standards for vulnerability identification and management. The contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP-compliant automated tools and report to the agency at least annually.

· Patching and Vulnerability Remediation - Install vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within vendor and agency specified timeline per OCISO Vulnerability Remediation Framework Standard.

· Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

· Boundary Protection - The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities is routed through a Trusted Internet Connection (TIC).

1) Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor’s facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

a. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government’s direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract.

The Government includes but is not limited to the U.S. Department of Justice, U.S. Government Accountability Office, and the HHS Office of the Inspector General (OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross-site scripting vulnerabilities, SQL injection vulnerabilities, and any other known vulnerabilities.

b. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity.