PR_33429_-_Professional_Services_RFQ.pdf

REQUEST FOR QUOTATIONS

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE.

PAGE OF PAGES

1 22

1. REQUEST NO.

75D301-19-Q-69981

2. DATE ISSUED

04/15/2019

3. REQUISITION/PURCHASE REQUEST NO.

00HCPNB1-2019-33429

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY

Centers for Disease Control and Prevention

Office of Acquisition Services (OAS)

2920 Brandywine Rd, RM 3000

Atlanta GA 303415539

6. DELIVERY BY (Date)

5b. FOR INFORMATION CALL (No collect calls)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

Keeshia L. Pettis (770) 729-4280 x

8. TO: 9. DESTINATION

a. NAME b. COMPANY a. NAME OF CONSIGNEE

c. STREET ADDRESS b. STREET ADDRESS

c. CITY

d. CITY e. STATE f. ZIP CODE d. STATE e. ZIP CODE

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

For any additional information please contact Keeshia Pettis @ 770-729-4280

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS

b. 20 CALENDAR DAYS

c. 30 CALENDAR DAYS

d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER 14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF

QUOTATION

a. NAME OF QUOTER

b. STREET ADDRESS 16. SIGNER

a. NAME (Type or print) b. TELEPHONE

c. COUNTY AREA CODE

d. CITY e. STATE f. ZIP CODE c. TITLE (Type or print) NUMBER

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (REV. 6-95)

Previous edition not usable Prescribed by GSA FAR (48 CFR) 53.215-1(a)

7. DELIVERY

FOB

DESTINATION

OTHER

(See Schedule)

Line Items

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Professional Services Services provided as set forth in approved project SOW & onsite training based on existing CDC system configuration, 3 days training and 2 days for prep. One day equates to 8 hours.

Period of Performance: 04/15/19 - 04/14/20

Ref quote no.: CLINs paid QUARTERLY in the arrears

4 Quarter (Time)

Option 1 Year 2 Items:

1001 Professional Services Services provided as set forth in approved project SOW & onsite training based on existing CDC system configuration, 3 days training and 2 days for prep. One day equates to 8 hours.

Period of Performance: 04/15/20 - 04/14/21

Ref quote no.: CLINs paid QUARTERLY in the arrears

Option 2 Year 3 Items:

2001 Professional Services Services provided as set forth in approved project SOW & onsite training based on existing CDC system configuration, 3 days training and 2 days for prep. One day equates to 8 hours.

Period of Performance: 04/15/21 - 04/14/22

Ref quote no.: CLINs paid QUARTERLY in the arrears

Statement of Work

Introduction

1. Background

The Centers for Disease Control and Prevention (CDC) and the Agency for Toxic Substances and Disease Registry (ATSDR) currently supports public health programs through its biorepository activities. The Informatics and Data Science Branch (IDSB) within the Division of Laboratory Systems (DLS) operates the CDC Biorepository (CBR) located in Lawrenceville, Georgia. CBR’s mission is to preserve CDC’s valuable samples and facilitate CDC program activities that are fundamental to public health surveillance, research, and outbreak response.

There are approximately 6 million biological and environmental samples maintained by the biorepository. Consistent with CBR’s vision to achieve excellence in biorepository science and to align with continual improvement efforts, CBR is enhancing its Sample Inventory management System – LabVantage (SIMS-LV) to support sample collection integrity and management.

The CDC Biorepository has stewardship responsibility for the sample collections for CDC programs and collaborators. These samples are collected by CDC programs and sample information and data is transferred to CBR for accessioning into SIMS-LV. This data is most commonly provided in csv or excel files and is imported into SIMS-LV. Standardized CDC Identifiers, known as the CDC Sample Identifier (CSID) and CDC Unique Identifier (CUID) must be associated with these samples and any aliquots or derivatives created. These identifiers must be contained in separate, dedicated fields and have the capability of being generated within SIMS-LV. Other sample identifiers provided by program sample identifiers must be captured appropriately to facilitate querying. New CDC sample-related policies requires CBR to incorporate new data and information to be associated both at the sample and collection level (e.g. collection type, CDC Identifiers, biosafety, disposition, program affiliation). All CBR sample collections must be reviewed on an annual basis to allow affiliated programs to review their information and provide for an opportunity for updates and changes to be made to existing data at the sample and/or collection level. The SIMS-LV must be able to edit or add new information to existing records by importing new data if necessary.

The Contractor, as an independent organization, and not as an agent of the government, shall provide professional services required to execute and operate the SIMS-LV according to CDC and CBR regulations, policies, processes, procedures, established standards, and best practices.

The Contractor, as detailed in this Statement of Work (SOW), shall ensure that SIMS-LV can appropriate handle the CBR sample collections (and associated documentation, information, and data) throughout all aspects of sample inventory management (e.g. processing, accessioning, querying, importing, preparing shipments, reporting). While the majority of activities take place for CBR, other CDC Programs utilize SIMS-LV for their laboratory sample management needs.

The Contractor shall also ensure that all enhancements and changes made to SIMS-LV will provide continued operability for these programs. All Contractor requirements should be accomplished in the most highly efficient, rapid, secure, and cost-effective manner to serve the main objective of supporting the CDC Biorepository in its core activities. Core activities include sample collection management, IT and data management, and quality management.

2. Purpose

The CDC Biorepository has stewardship responsibility for the integrity, management, disposition, and security of sample collections for CDC programs and collaborators. These samples managed by CBR have been collected by CDC programs and are not associated with any personally identifiable information (PII). The CBR maintains the goals of providing expertise to assist CDC programs with all aspects of sample management and working with programs to facilitate compliance with CDC sample-related policies. This facilitates traceability and tracking across the agency while maintaining parent-child relationships. It is the role of CBR to make recommendations that will ensure compliance with CDC sample-related policies.

The CBR serves as the block administrator for the issuance of CDC Identifiers (CSIDs and CUIDs) to all programs at the CDC, which can take place at the time of accessioning into SIMS-

LV.

The Contractor, as an independent organization, and not as an agent of the government, shall provide all labor, materials, equipment, and supplies (that are not furnished by the Government) and shall perform all services required to execute the CBR operations and activities according to CDC and CBR regulations, policies, processes, procedures, established standards, and best practices. The Contractor, as detailed in this Statement of Work (SOW), shall provide support to the CDC Biorepository (CBR) and the CDC Full Time Equivalent (FTE) staff designated as System Administrators supporting SIMS-LV. The support shall ensure that CBR sample collection information, data, and associated documentation obtained by CDC program and collaborators are capable of being accessioned and managed in accordance with CBR and CDC workflows, procedures, and policies. Activities in this SOW describe the work needed to accomplish needed system enhancements and training necessary for CBR staff to operate SIMS- LV. Once the necessary changes and enhancements to SIMS-LV are completed, the Contractor shall provide user training to ensure that CBR staff can appropriately perform all workflows.

3. Scope of Work

The tasks and associated deliverables from the Contractor, as required by DLS, are in support of the CDC Biorepository’s programmatic mission and vision related to stewardship of CDC’s valuable collections, data, and align with the goal and objectives of DLS, CSELS, and CDC. To help accomplish this, CDC requires the Contractor’s independent advice, guidance, assistance, and support services. The Contractor shall provide a dedicated technical engineer\developer that can perform both onsite and remotely for the Information Technology (IT) support needed for the SIMS-LV configured at the Centers for Disease Control and Prevention. This individual must address needs that are not provided or supported through the standard Support and Maintenance Plan (SMP).

This project will include:

• Updating LabVantage 8.x and JBoss 6.4 software

• Configuring LabVantage 8.x to correspond to CBR workflows

• Addition of new customized fields that are unique to CBR workflows (e.g. CSID)

• Providing user-specific training for all roles of CBR’s SIMS-LV

4. Tasks

4.1 Data field Integration. Contractor professional services related to the creation, deletion, and arrangement of data fields that the CBR has identified as required by CDC policies and CBR sample collection workflows. The Contractor shall provide guidance, technical consultation, and implementation of data fields in a way that facilitates sample collection workflows. In collaboration with CBR, LabVantage will perform all planning requirements necessary for the troubleshooting and validation of this integration. CBR will provide a data dictionary and workflows when the contract is awarded.

4.2 Upgrade Issue Resolution. Technical services to address several outstanding issues that still require attention and need addressing from the upgrade from LabVantage 6.x to the version 8.x.

The outstanding issues that have been identified have been brought to the attention of LabVantage and the engineers.

4.3 Location Issue Resolution. CBR requires the ability to perform quality assurance as it relates to shipments. Additionally, there are problems modifying sample locations when they are returned, and placed back into CBR. LabVantage shall provide technical support to create the needed functionality. LabVantage is to assist with the validation and documentation while verifying the sample quality assurance is fully functional.

4.4 Training on LabVantage 8.3x. After the integration of added field types, CBR staff and CBR contractor’s will require training to ensure efficiency when importing and processing samples. LabVantage will provide five days or 40 hours of guidance and “Train the Trainer” training on how to perform specific tasks including but not limited to: Creation and validation of sample reporting templates, sample allocation, sample accessioning, CDC/CBR sample imports, sample storage, sample shipping. LabVantage will collaborate with CBR to create a training that aligns with CBR’s unique workflows and highlights the new features of the application.

4.5 Project Status Reporting. LabVantage shall provide Project Management Professional Services. Activities to include weekly status reporting of the time spent against each item;

coordination and scheduling of the LabVantage resources.

Optional Tasks

Optional Task 1: LabVantage will work with CBR to perform necessary system upgrades as required when security vulnerabilities are detected with any underlying LabVantage technologies or system & technology enhancements dictate a need.

5. Deliverables

Task

Number

Deliverable Description Qty/No. Delivery

Method

Due Date

Meetings

Contract Kick-off Meeting

Contractor, COR, and CBR will have a formal meeting to review and discuss all components of the Contract Project Work Plan

1 Skype/Ready Talk

1 hour meeting shall be held no later than 5 work days after the start date of the contract period of performance.

Weekly Contractor, COR, and CBR will 1 per day Skype/Ready Meeting shall end

Meeting review progress and discuss project progress, goals, activities, address issues, etc. to take place next.

or as needed

Talk no later than 3:30 pm EST.

Plans

Contract Project Work Plan

Formal plan for the work covered under this contract, including overview, communication plan, outcomes, and schedule of known deliverables (may be modified as changes are needed).

1 Electronic The draft plan will be submitted to COR within 5 days of contract award for COR and CBR approval or revisions.

Contractor will submit Final Draft plan within 10 days of contract award for final approval.

Once the COR provides final approval of the plan, it will be active and will be updated as needed.

Training Plan

Develop and submit a plan describing how the contract will provide training & materials specific to CBR SIMS-LV

Email Criteria for CBR SIMS-LV training will be provided prior within 20 days of contract award.

Reports

Report Reports detailing issues reported and plans to resolve, and how it was resolved. Reports will be submitted to the COR and CDC CBR project manager

Email Contractor will submit weekly

Contract Status Reporting

All reporting requirements and written deliverables as part of this contract will be supplied to the project Contracting Officer Representative (COR). Acceptance of any written deliverables is pending CDC COR review and correction to any resulting comments, to be confirmed in writing and documented in the closest following monthly report. Any schedule of interim deliverables may be revised according to CDC acceptance of an updated written work plan by the COR during the project with the restriction that these changes must not impact the overall period of performance, scope, or specifications of the award, or otherwise impinge on the authority of the contracting officer. It is the responsibility of the Contractor to fully understand what changes require contracting officer approval. Reports will be submitted electronically in MS compatible format that meets CDC security and standards and is readily available at CDC (e.g. MS Office Word, Excel, and PowerPoint). The Contractor shall submit a draft of the report by the last day of each calendar month, providing CBR with the opportunity to review prior to submission for formal acceptance. Changes to the report template may be required at any time. The COR will communicate required changes to the template. Changes requested by the Contractor will require final written approval/acceptance by the COR.

• The Contractor shall meet and comply with all defined requirements as approved by the

COR and Technical Monitor. All required tasks will be executed and performed according to the agreed-upon schedule specified in the Work Plan. No deviations will occur without notifying CBR and the COR.

• The Contractor shall hold weekly meetings with the COR and CBR Team to provide status updates on all contract activities occurring at that time. LabVantage attendance at meetings should include the appropriate staff to effectively address issues and answer questions. Agendas will be prepared by the COR and submitted in advance to allow time to prepare.

• The Contractor will communicate in a timely manner to ensure established timelines to be maintained. Acknowledgement response time for communication shall be within 1 hour by email or by phone.

Failure to perform tasks outlined in this Statement of Work will result in an unfavorable performance evaluation.

6. Performance Period

The Base Year performance period for the Professional Services Project shall be from 4/15/2019 through 4/14/2020. Task 4.1- 4.3 will require 20 days or 160 man hours of Professional Services

Option year 1 performance period for the Professional Services Project shall be from 4/15/2020 through 4/14/2021.

Option year 2 performance period for the Professional Services Project shall be from 4/15/2021 through 4/14/2022.

7. Security and Compliance

HHSAR Provision, 352.239-74: Electronic and Information Technology Accessibility Notice

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, or maintained under this contract or order must comply with the "Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards" set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access Board") in 36 CFR part 1194. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(b) The Section 508 accessibility standards applicable to this contract or order are identified in the Statement of Work or Specification or Performance Work Statement. The contractor must provide any necessary updates to the submitted HHS Product Assessment Template(s) at the end of each contract or order exceeding the simplified acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

(d) In the event of a modification(s) to this contract or order, which adds new EIT supplies or services or revises the type of, or specifications for, supplies or services, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found under Section 508 policy on the HHS Web site:

(http://hhs.gov/web/508). If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) If this is an Indefinite Delivery contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include EIT supplies or services will define the specifications and accessibility standards for the order. In those cases, the Contractor may be required to provide a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards.

Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found at http://hhs.gov/web/508. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

POLICIES, PROCESSES, AND PROCEDURES

The Contractor must comply with all applicable federal regulations, HHS and CDC policies.

This includes:

• CDC Biorepository Management Policy (CDC-SM-2018-01)

• CDC Management of and Access to Scientific Specimen Collections Policy (CDC-SM- 2016-01)

• CDC Sample Management Policy (CDC-GA-2013-02)

CDC may develop additional or update policies, processes, and procedures during the course of this contract. The contractor shall comply with all policies, processes, and procedures.

The below information complies with HHSA Security compliance requirements for the

Security Compliance

This Statement of Work (SOW) requires the offeror to have the ability to maintain a system for data collection, management, use, and reporting to support activities funded by the federal government.

The EGovernment Act of 2002, (Federal Information Management Act) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system.

Appendix III of Circular A-130, entitled “Security of Federal Automated Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) (http://csrc.nist.gov/policies/FISMA-final.pdf) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, offeror (including sub-offeror), or other source. The

National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

• FIPS Publication 200, Minimum Security Requirements for Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

• FIPS Publication 199, Standards for Security Categorization of Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)

• NIST Special Publication 800-18, Guide to Developing Security Plans for Federal

Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-

Rev1-final.pdf)

• NIST Special Publication 800-60, Guide for Mapping Types of Information and

Information Systems to Security Categories Vol. 1

(http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf) and

Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf).

• NIST Special Publication 800-53, Recommended Security Controls for Federal

Information Systems and Organizations (http://csrc.nist.gov/publications/nistpubs/800-

53-Rev3/sp800-53-rev3-final-errata.pdf).

• NIST Special Publication 800-63, Electronic Authentication Guideline

(http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf)

The successful Offeror is responsible for providing pertinent security information to the CSELS ISSO and Security Staff and assisting in completing the below CDC Certification and Accreditation documents. Appropriate security templates will be provided to the successful Offeror by the CSELS Security Staff. Completed documents will be sent to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

• Baseline System Information (BSI)

• Privacy Impact Assessment (PIA)

• System Security Plan (SSP)

• Business Continuity Plan (BCP)

• Risk Assessment Report (RAR)

The Offeror shall abide by the following seven security–associated requirements:

(1) Position Sensitivity Designations

CDC requires a Public Trust Level 5 for the following

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation

(LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-offeror staff) working under the contract that will have the ability to access sensitive CSELS information from the system. The roster shall be submitted to the Project Officer/technical monitor, with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract.

Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer shall notify the licensor of the appropriate level of suitability investigations to be performed, but Licensor employees and subcontractors who have met investigative requirements within the last five years may only require an updated or upgraded investigation. An electronic template, “Roster of Employees Requiring Suitability Investigations,” is available for offeror use at: http://ais.nci.nih.gov/forms/Suitability-roster.xls.

Upon receipt of the Government’s notification of applicable suitability investigations required, the Licensor shall complete and submit the required forms within 30 days of the notification.

Non-Disclosure Agreements

The Offeror and any sub-Offerors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Offeror's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and offeror, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Offeror’s Official Responsible for Information Security

The offeror shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the offeror be selected for an award.

(4) Rules of Behavior

The offeror’s employees and subcontractors shall comply with the HHS Information Technology General Rules of Behavior.

(5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The successful offeror shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Offeror's expense and would be the Offeror's responsibility to plan and arrange.

The successful offeror shall maintain a listing of all individuals who have completed this training and shall submit this listing to the project officer.

(6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity

Verification.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain sensitive CDC- data shall be encrypted using FIPS 140-2 compliant algorithms.

The Paperwork Reduction Act of 1995 (PRA) Offerors are advised that any activities involving information collections (i.e., surveys, questionnaires, applications, audits, data requests, reporting, recordkeeping and disclosure requirements, etc.) from 10 or more non-Federal entities, including State and local governmental agencies, are subject to the conditions of the PRA. Under the PRA, a Federal agency sponsoring a standardized data collection or directly obtaining standardized or substantially similar information from ten or more persons or entities (other than Federal employees within the scope of their employment) in any 12-month period must obtain advance written approval from the Office of Management and Budget (OMB).” Regardless of form or format (oral, written, or electronically transmitted), responses of opinion or fact requested or required by or for CDC, except those specifically exempted or excluded, are subject to the provisions of the PRA and its implementing regulation, 5 CFR 1320 (Controlling Paperwork Burdens on the Public).”

Clauses

FAR SOURCE TITLE AND DATE

52.204-13 System for Award Management Maintenance (Oct 2016)

52.204-18 Commercial and Government Entity Code Maintenance (October 2018)

52.212-4 Contract Terms and Conditions- Commercial Items (October 2018)

52.232-39

52.232-40

352.222-70

Unenforceability of Unauthorized Obligations (Jun 2013)

Providing Accelerated Payments to Small Business Contractors (Dec 2013)

Contractor Cooperation in Equal Employment Opportunity Investigations (Dec 2015)

FAR 52.252-2 -- CLAUSES INCORPORATED BY REFERENCE. (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/far1toc.htm http://www.hhs.gov/policies/hhsar/subpart301-1.html

(End of Clause)

52.212-5 -Contract Terms and Conditions Required to Implement Statutes or Executive Orders --

Commercial Items (Jan 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab a(2) nd Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

_X_ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Oct 2016) (Pub.

L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) [Reserved]

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved]

___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (August 2018) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Nov 2016) of 52.219-9.

___ (iii) Alternate II (Nov 2016) of 52.219-9.

___ (iv) Alternate III (Nov 2016) of 52.219-9.

___ (v) Alternate IV (August 2018) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

_X_ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

_X_ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (January 2018) (E.O.

13126).

_X_ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (28) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

___ (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

_X_ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

___ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

___ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (33) (i) 52.222-50, Combating Trafficking in Persons (JAN 2019) (22 U.S.C. chapter 78 and E.O.

13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O.13693).

___ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

___ (38) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514

___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (39) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

___ (41) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

_X_ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

___ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

___ (44) 52.223-21, Foams (Jun 2016) (E.O. 13696).

___ (45) (i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

___ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (46) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

___ (47) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C.

chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L.

103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112- 43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

___ (48) 52.225-5, Trade Agreements (Aug 2018) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X_ (49) 52.225-13, Restrictions on Certain Foreign Purchases (Jun 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (50) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (51) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

___ (52) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (53) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505), 10 U.S.C. 2307(f)).

___ (54) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C.

2307(f)).

_X_ (55) 52.232-33, Payment by Electronic Funds Transfer— System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (56) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (57) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

___ (58) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

___ (59) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(12)).

___ (60) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Feb 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495)

___ (2) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67.).

___ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C.206 and 41 U.S.C. chapter 67).

___ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015) (E.O. 13658).

___ (9) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

___ (10) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C.

1792).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph

(d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c) and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Jan 2019) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115- 91).

(iv) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(v) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(vi) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(vii) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

(viii) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222- 40.

(xii) 52.222-41, Service Contract Labor Standards (Aug 2018), (41 U.S.C. chapter 67).

(xiii) (A) 52.222-50, Combating Trafficking in Persons (Jan 2019) (22 U.S.C. chapter 78 and E.O. 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67.)

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67)

(xvi) 52.222-54, Employment Eligibility Verification (Oct 2015) (E. O. 12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015).

(xviii) 52.222-62, Paid sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

(xix) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008;

10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately-Owned U.S. Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of Clause)

52.217-8 Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 5 days before the contract expires.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

As prescribed in 17.208(g), insert a clause substantially the same as the following:

OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 5 day before the contract expires; provided that the Government…