Laboratory_Combined_Synopsis-_Solicitation_2019.pdf

COMBINED SYNOPSIS/SOLICITATION FOR LABORATORY DECONTAMINATION

Solicitation Number: 75D301-19-Q-70095

SUBJECT: Laboratory Decontamination

SOLICITATION NUMBER: 75D301-19-Q-70095

RESPONSE DUE DATE/TIME: 01 May 2019/ Before 3:30 pm (1530) EASTERN TIME

SECTION A – DESCRIPTION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in

Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This solicitation is a Request for Proposal (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 05-40.

The associated North American Industrial Classification System (NAICS) code for this procurement is

541380 – Testing Laboratories; Small Business Size Standard is $15 million. THIS IS A TOTAL

SMALL BUSINESS SET-ASIDE.

This is a RFP for Laboratory Decontamination. This period of performance for this requirement will be one (1) 12-month year and four (4) 12-month option periods. The Government intends to award a Firm

Fixed-Price contract as a result of this solicitation that will include the terms and conditions that are set forth herein.

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1. DESCRIPTION OF SUPPLIES & SERVICES

B.1.1. The Office of Laboratory Science and Safety has a requirement for laboratory decontamination services for the laboratories at CDC Roybal campus. The requirement requires the contractor to provide several tasks which are identified in the statement of work.

B.1.2. Contract Type is Firm-Fixed Price.

B.1.3. Pricing Terms - “CLIN defined by 0001 etc.” means contract line item that corresponds to each year. “UNIT PRICE” represents the amount to be paid to the contractor monthly.

Base Period of Performance: – 09/29/2019 – 09/28/2020 CLIN Description/Serial Number/Bldg.

Room

CU FT Quantity Unit

Price

Total

Price

0001 Laboratory Rooms- Contractor shall perform the work in accordance with the attached Statement of Work.

Period of Performance: 09/29/2019-

09/28/2020

1150 CU FT

96 $ $

0002 Laboratory Rooms- Contractor shall perform the work in accordance with the

1500 5 $ $

0003 Laboratory Rooms- Contractor shall

2 $ $

0004 Laboratory Rooms- Contractor shall

0005 Laboratory Rooms- Contractor shall

1 $ $

0006 Laboratory Rooms- Contractor shall

2900 1 $ $

0007 Laboratory Rooms- Contractor shall

2600 1 $ $

0008 Laboratory Rooms- Contractor shall

700 6 $ $

0009 Laboratory Rooms- Contractor shall

1100 2 $ $

0010 Laboratory Rooms- Contractor shall

1700 8 $ $

0011 Laboratory Rooms- Contractor shall

2500 3 $ $

0012 Laboratory Rooms- Contractor shall

3050 8 $ $

0013 Laboratory Rooms- Contractor shall

5300 1 $ $

0014 Laboratory Rooms- Contractor shall

6300 1 $ $

0015 Laboratory Rooms- Contractor shall

330 4 $ $

0016 Laboratory Rooms- Contractor shall

530 1 $ $

0017 Laboratory Rooms- Contractor shall

1000 1 $ $

09/28/2020

0018 Laboratory Rooms- Contractor shall

1200 2 $ $

0019 Laboratory Rooms- Contractor shall

1500 2 $ $

0020 Decontamination Room using Laboratory Rooms- Contractor shall

4700 1 $ $

0021 Laboratory Rooms- Contractor shall

6200 1 $ $

BASE TOTAL AGGREGATE AMOUNT: $_________________

Option Period 1 Period of Performance: – 09/29/2020 – 09/28/2021

Room

CU FT Quantity Unit

Price

Total

Price

1001 Laboratory Rooms- Contractor shall

Period of Performance: 09/29/2020-

09/28/2021

1002 Laboratory Rooms- Contractor shall

09/28/2021

1003 Laboratory Rooms- Contractor shall

1004 Laboratory Rooms- Contractor shall

1005 Laboratory Rooms- Contractor shall

1006 Laboratory Rooms- Contractor shall

2900 1 $ $

1007 Laboratory Rooms- Contractor shall

2600 1 $ $

1008 Laboratory Rooms- Contractor shall

700 6 $ $

1009 Laboratory Rooms- Contractor shall

1100 2 $ $

1010 Laboratory Rooms- Contractor shall

1700 8 $ $

1011 Laboratory Rooms- Contractor shall

2500 3 $ $

1012 Laboratory Rooms- Contractor shall

3050 8 $ $

1013 Laboratory Rooms- Contractor shall

5300 1 $ $

1014 Laboratory Rooms- Contractor shall

6300 1 $ $

1015 Laboratory Rooms- Contractor shall

330 4 $ $

1016 Laboratory Rooms- Contractor shall

530 1 $ $

1017 Laboratory Rooms- Contractor shall

1018 Laboratory Rooms- Contractor shall

1200 2 $ $

1019 Laboratory Rooms- Contractor shall

1500 2 $ $

1020 Decontamination Room using Laboratory Rooms- Contractor shall

4700 1 $ $

1021 Laboratory Rooms- Contractor shall

OPTION PERIOD 1 TOTAL AGGREGATE AMOUNT: $_________________

Option Period 2 Period of Performance: – 09/29/2021 – 09/28/2022

Room

CU FT Quantity Unit

Price

Total

Price

2001 Laboratory Rooms- Contractor shall

Period of Performance: 09/29/2021-

09/28/2022

2002 Laboratory Rooms- Contractor shall

2003 Laboratory Rooms- Contractor shall

2004 Laboratory Rooms- Contractor shall

2005 Laboratory Rooms- Contractor shall

2006 Laboratory Rooms- Contractor shall

2900 1 $ $

2007 Laboratory Rooms- Contractor shall

2600 1 $ $

2008 Laboratory Rooms- Contractor shall

700 6 $ $

2009 Laboratory Rooms- Contractor shall

1100 2 $ $

2010 Laboratory Rooms- Contractor shall

09/28/2022

2011 Laboratory Rooms- Contractor shall

2500 3 $ $

2012 Laboratory Rooms- Contractor shall

3050 8 $ $

2013 Laboratory Rooms- Contractor shall

5300 1 $ $

2014 Laboratory Rooms- Contractor shall

6300 1 $ $

2015 Laboratory Rooms- Contractor shall

330 4 $ $

2016 Laboratory Rooms- Contractor shall

530 1 $ $

2017 Laboratory Rooms- Contractor shall

1000 1 $ $

2018 Laboratory Rooms- Contractor shall perform the work in accordance with the

1200 2 $ $

2019 Laboratory Rooms- Contractor shall

1500 2 $ $

2020 Laboratory Rooms- Contractor shall

4700 1 $ $

2021 Laboratory Rooms- Contractor shall

OPTION PERIOD 2 TOTAL AGGREGATE AMOUNT: $_________________

Option Period 3 Period of Performance: – 09/29/2022 – 09/28/2023

Room

CU FT Quantity Unit

Price

Total

Price

3001 Laboratory Rooms- Contractor shall

Period of Performance: 09/29/2022-

09/28/2023

3002 Laboratory Rooms- Contractor shall

09/28/2023

3003 Laboratory Rooms- Contractor shall

3004 Laboratory Rooms- Contractor shall

3005 Laboratory Rooms- Contractor shall

3006 Laboratory Rooms- Contractor shall

2900 1 $ $

3007 Laboratory Rooms- Contractor shall

2600 1 $ $

3008 Laboratory Rooms- Contractor shall

700 6 $ $

3009 Laboratory Rooms- Contractor shall

1100 2 $ $

3010 Laboratory Rooms- Contractor shall

3011 Laboratory Rooms- Contractor shall

2500 3 $ $

3012 Laboratory Rooms- Contractor shall

3050 8 $ $

3013 Laboratory Rooms- Contractor shall

5300 1 $ $

3014 Laboratory Rooms- Contractor shall

6300 1 $ $

3015 Laboratory Rooms- Contractor shall

330 4 $ $

3016 Laboratory Rooms- Contractor shall

530 1 $ $

3017 Laboratory Rooms- Contractor shall

3018 Laboratory Rooms- Contractor shall 1200 2 $ $

3019 Laboratory Rooms- Contractor shall

3020 Decontamination Room using Laboratory Rooms- Contractor shall

4700 1 $ $

3021 Laboratory Rooms- Contractor shall

OPTION PERIOD 3 TOTAL AGGREGATE AMOUNT: $_________________

Option Period 4 Period of Performance: – 09/29/2023 – 09/28/2024

Room

CU FT Quantity Unit

Price

Total

Price

4001 Laboratory Rooms- Contractor shall

Period of Performance: 09/29/2023-

09/28/2024

4002 Laboratory Rooms- Contractor shall perform the work in accordance with the

4003 Laboratory Rooms- Contractor shall

4004 Laboratory Rooms- Contractor shall

4005 Laboratory Rooms- Contractor shall

4006 Laboratory Rooms- Contractor shall

2900 1 $ $

4007 Laboratory Rooms- Contractor shall

2600 1 $ $

4008 Laboratory Rooms- Contractor shall

700 6 $ $

4009 Laboratory Rooms- Contractor shall

1100 2 $ $

4010 Laboratory Rooms- Contractor shall

1700 8 $ $

4011 Laboratory Rooms- Contractor shall

2500 3 $ $

4012 Laboratory Rooms- Contractor shall

3050 8 $ $

4013 Laboratory Rooms- Contractor shall

5300 1 $ $

4014 Laboratory Rooms- Contractor shall

6300 1 $ $

4015 Laboratory Rooms- Contractor shall

330 4 $ $

4016 Laboratory Rooms- Contractor shall

Period of Performance: 09/29/2023

530 1 $ $

4017 Laboratory Rooms- Contractor shall

4018 Laboratory Rooms- Contractor shall

1200 2 $ $

4019 Laboratory Rooms- Contractor shall

4020 Decontamination Room using Laboratory Rooms- Contractor shall

4700 1 $ $

4021 Laboratory Rooms- Contractor shall

OPTION PERIOD 4 TOTAL AGGREGATE AMOUNT: $_________________

TOTAL AGGREGATE AMOUNT $________________________________

CONTRACT TYPE: FIRM-FIXED PRICE

SECTION C – DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

Statement of Work

Title: Roybal Laboratory Decontamination

SECTION 1 - BACKGROUND

The Centers for Disease Control and Prevention serve as the nation's public health agency. As part of that mission, research is undertaken to identify biological agents which can pose a hazard to the US population and identify potential vaccine contractors to mitigate that risk. In order to maintain our high containment research laboratories and protect potential vaccine candidates from contamination, many of our laboratories are routinely decontaminated prior to preventative maintenance or the introduction of new vaccine strains. The decontamination process has historically been undertaken internally by members of the Biosafety team, which has used a number of techniques to decontaminate the laboratories. Between the increased role the team has undertaken as an Agency resource, and the increased demand for decontamination services, it has become necessary to obtain contract resources to provide decontamination services.

SUBSECTION A- DEFINITIONS

BMBL- Biosafety in Microbiological and Biomedical Laboratories

CDC- Centers for Disease Control and Prevention

EMOSO- Engineering, Maintenance and Operations Support Office

NCEZID- National Center for Emerging and Zoonotic Infectious Diseases

NCIRD- National Center for Immunization and Respiratory Diseases

OLSS- Office of Laboratory Science and Safety VHP- Vapor Phase Hydrogen Peroxide

SECTION 2 - PURPOSE

The purpose of this work is to provide decontamination services for research laboratories at the

CDC Roybal campus, 1600 Clifton Road, Atlanta, GA. The contractor will be responsible for coordinating services with various offices within the CDC, including program offices (NCIRD and NCEZID), the Agency laboratory safety office (OLSS) and facilities services (EMOSO) to ensure decontaminations of target laboratories take place as scheduled with a minimum of disruption to normal operation. The contractor will need to ensure their staff have the requisite training to work safely with hazardous chemicals in an environment which may contain hazardous biological agents (the laboratories utilize the BMBL containment laboratory rating scheme and will be rated as BSL2, BSL3, ABSL2, and ABSL3).

SECTION 3 - SCOPE OF WORK

The contractor will safely work with vapor phase hydrogen peroxide (VHP) to decontaminate research laboratories or spray a peracetic acid (1:99 dilution of SporKlenz concentrate) solution to achieve the same effect. The rooms to be decontaminated, the type of decontamination process required, and the frequency of decontamination is provided in Table 1. Note that not all laboratories are candidates for use of VHP, and will need to be decontaminated via spraying with peracetic acid. Also note that the frequency of decontamination will vary depending on the laboratory program requirements. It will not be feasible for the contractor to schedule all decontaminations for a single block of time.

No less than 72 hr advance notification will be provided to the contractor that a routine room decontamination is required. The contractor will be required to come to the room with all equipment, supplies and solutions needed, have their staff gown appropriately for access to

BSL2 or BSL3 areas.

The contractor shall supply a 24 hr. telephone number to allow CDC to schedule emergency services at all times.

For laboratories being decontaminated using peracetic acid, the contractor will enter the area, set spore strips in the lab to document decontamination and then spray all surfaces within the laboratory (including all walls, the ceiling and floor, and all work surfaces and equipment in the laboratory). The contractor will retrieve the spore strips after the spray decontamination is complete. After doffing PPE, the contractor will collect all materials, post the room as under decontamination, and leave the area. The contractor will then incubate the spore strips for 24 h, and report the results to their technical representative.

For laboratories being decontaminated using VHP, the contractor will enter the area with the

VHP unit and spore discs, place the spore discs within the lab to validate decontamination and exit the lab. After doffing PPE, the contractor will verify that supply and exhaust dampers are closed. The contractor will post decontamination signage and start the VHP unit(s) and allow them to run a complete decon cycle. The contractor will monitor the adjacent areas not associated with the area to be decontaminated for VHP leakage. After the aeration cycle is complete, the contractor will don PPE, enter the area, retrieve the spore discs, exit the area, doff

PPE. Contractor will incubate spore disc for 24 hours and report results to the technical representative.

Staff must be medically cleared to perform work using a Powered Air Purifying Respirator

(PAPR) and have vaccinations as determined in advance by CDC.

N.B. - This SOW EXCLUDES the following rooms and tasks: All Biosafety Level 4 laboratories and, all work with PALL filters and APR door "Lunchbox" filters, and HEPA filter housings.

There are approximately 44 PALL filters, 160 APR door filters, and 200 HEPA housings. This contract also does not include any decontaminations of BSCs (required if internal plenums are to be opened) or "Biobubbles" containing small pieces of equipment needing decontamination

(approximately 12 sessions of biobubble decontaminations are performed per year).

The number of laboratory spaces, approximate size in cubic feet, frequency of decontamination and method of decontamination is provided below:

# of spaces Cubic feet frequency method

48 1150 2 x year Peracetic acid

5 1500 1 x year Peracetic acid

2 1750 1 x year VHP

2 3800 I x year VHP

5200 1 x year Peracetic acid

2900 1 x year Peracetic acid

2600 1 x year VHP

6 700 1 x year VHP

2 1100 I x year VHP

8 1700 1 x year VHP

3 2500 1 x year VHP

8 3050 1 xyear VHP

1 5300 1 x year VHP

6300 1 xyear VHP

4 330 1 x year VHP

1 530 1 x year VHP

1 1000 1 x year VHP

2 1200 1 xyear VHP

2 1500 1 xyear VHP

1 4700 1 x year VHP

6200 1 xyear VHP

The table is for illustration and is to provide an applicant an estimate of the number of rooms, size of rooms and frequency and means of decontamination. It is possible that additional decontaminations, or fewer, will be requested during the contract period.

SECTION 4 - TASKS TO BE PERFORMED

The contractor will undertake the following tasks:

Generate schedule of room decontaminations with stakeholders.

Provide and generate working solutions of hydrogen peroxide or peracetic acid decontamination solutions. Transport needed equipment to and from laboratories to storage area.

Operate Bioquell VHP equipment or use sprayer to spray peracetic acid on all surfaces in laboratory. Process Sporex (Mesa Labs; combined Bacillus atrophaeus and Geobacillus stearothermophilus spore strips; used with peracetic acid) or Geobacillus stearothermophilus spore discs (Mesa Labs; used with VHP) and incubate for 24 hrs in Releasat culture medium

(Mesa Labs).

Complete documentation regarding decontamination for submission to OLSS Technical

Representative.

Generate work SOPs for approval by OLSS Technical Representative to allow work to proceed safely and with demonstrated quality.

Provide OLSS a safety plan demonstrating an understanding of the risks involved in the work to be undertaken.

Provide a trained working staff capable of wearing all required personal protective equipment, including respirators.

Stock and maintain a supply of personal protective equipment and decontamination chemicals and spore strips/disks sufficient for continuous use.

Strict adherence to CDC policies is required at all times. The routine services are anticipated to take place during normal weekday business hours of 7 am to 5 pm, excepting Federal holidays.

SECTION 5 - GOVERNMENT FURNISHED MATERIALS

The government will provide and maintain the Bioquell VHP generators needed to provide space decontamination and will provide laboratory space, a Class II biological safety cabinet, and incubator for the growth of spore strips/discs.

SECTION 6 - PERIOD OF PERFORMANCE

The period of performance is base year+ 4 options

SECTION 7 - DELIVERABLES/REPORTING SCHEDULE

The contractor shall provide a report for each decontamination, noting the specific laboratory decontaminated, the lot numbers and concentration of disinfectant used and the duration of decontamination, as well as the results of the incubation of the biological indicators (including lot numbers), indicating success in decontamination. Any failures are to be reported, as well as the remedial actions taken to ensure a successful decontamination of the laboratory. The following specific information is required:

I. Campus, Bldg/Rm decontaminated

2. Biological safety level of room decontaminated

3. Name of Requestor

4. Request date

5. Decontamination date

6. Name of person performing decontamination

7. Decontamination agent, concentration/dilution, lot#, expiration date

8. Method of application

9. Contact time

10. BI used, location of BI, lot#, exp. Date; location in room where placed

11. Media lot#, exp. date, incubation time, incubation temperature

12. Result (Positive/Negative, Pass/Fail), to include a photograph of controls and samples

13. Name and signature of those conducting decontamination

14. Name and signature of supervisor

A copy is to be provided to the laboratory requesting the decontamination and the Technical

Representative.

Any accidents or breaches in protocol are to be reported immediately, as are any potential exposures of the workers to either the chemical decontamination agents or biological agents handled in the laboratory.

A monthly summary of the decontamination services provided is to be submitted to the

Contracting Officer Representative (COR).

SECTION 8 - REFERENCE MATERIALS

1. The contractor must maintain full compliance with all applicable federal, state and local regulations during this work. Strick adherence to CDC policies and U.S. Department of Labor 29

CFR Part 1910 OSHA General Industry Standards and applicable local codes and national consensus standards.is required at all times. Also, to include 29 CFR Section 1910.147 Control of Hazardous Energy/ Lockout/Taguot

2. . The Contractor shall assume full responsibility and liability for compliance with all applicable regulations pertaining to the health and safety of personnel during the execution of work, and shall hold the Government harmless for any action or lack of action by the Contractor or by any of the Contractor's employees or subcontractors, which results in illness, injury or death.

3. The Contractor shall provide to the Contracting Officer or Project Officer a written

Comprehensive Health and Safety Plan (CHSP) for the specific work under this contract for review by the OHSO. The Contractor shall not be allowed to commence work on site until the

CHSP has been approved by both OHSO and the Contracting Officer. The Contractor must receive written confirmation that OHSO has reviewed and approved the plan prior to commencing work.

The following OSHA regulations are of particular importance to these tasks:

29 CFR Section 1910.132 Lab coats, gloves 29 CFR Section 1910.133 Eye protection

29 CFR Section 1910.134 Respirator and pulmonary function 29 CFR Section 1910.1200

Hazard Communication standard

The OLSS has generated a guidance document for decontamination process, which is reproduced below:

Guidance for Laboratory Space Decontamination at CDC Facilities

Purpose: The primary objective of decontamination is to reduce the level of microbial contamination so that the risk of infection is eliminated (BMBL 5th edition, page 329). Periodic laboratory decontamination is an effective way to reduce risk to staff from potential laboratory acquired infection. Some laboratories have design features that facilitate surface and space decontamination, such as impermeable surfaces and sealed penetrations into walls and ceiling.

The purpose of this document is to provide specific information and recommendations for conducting laboratory decontamination at CDC facilities.

Guidance:

Safety

• Hazards. Conducting laboratory decontamination involves multiple hazards, to include the agents used and stored in the laboratory, the chemicals being applied as decontaminants, and any physical hazards that may be present in the space. A risk assessment should be conducted before performing a decontamination procedure. Always consult with the safety staff at your location when planning decontamination of a laboratory.

• Biological. As part of the preparation process for laboratory decontamination, all handling and cultivation of pathogens must cease, all hazards are to be stored properly, and all waste autoclaved or otherwise properly removed. Check for any specific entry requirements for the laboratory well in advance.

o Chemical. All substances used for decontamination and disinfection are hazardous to the staff, equipment, and/or materials present in the laboratory. Some disinfectants may react with chemicals used or stored in the laboratory. Before use, all staff performing laboratory decontamination must become familiar with the safety data sheet (SDS) for the chemical being used. Some disinfectants may present hazards to electrical and computer equipment, and may have specific activity against metal, rubber, or other materials.

o Physical. There may be other hazards present in the laboratory, such as liquid nitrogen, heating instruments, lasers, radioactive material, and electrical hazards. The risks posed must be identified and mitigated before proceeding with decontamination. In addition, boxes and other items must not block hallways and exits.

• Personal Protective Equipment (PPE). All potential hazards must be taken into account when selecting the specific type of PPE to be worn by personnel conducting the decontamination, to include eye/face protection, respiratory protection, hoods, tyvek (coveralls), gown, gloves, and shoe covers. CDC provides PPE at no cost to staff. PPE guidance is available at this link: http://intranet.cdc.gov/ossam/workplace-safety/safety-practices/personal-protective equipment/index.html. A tool is available for selecting appropriate PPE:

http://intranet.cdc.gov/ossam/workplace-safety/safety-practices/personal-protective equipment/Personal-Protective-Equipment.pdf. Wearing of PPE requires training and evaluation.

Respiratory protection requires participation in medical surveillance to include a medical evaluation, training, and fit testing.

• Disposal of hazardous waste. The decontamination procedure may generate hazardous waste. All disposable PPE must be properly discarded and reusable PPE must be cleaned, inspected and stored. Before disposing of any liquid waste generated please consult the CDC wastewater disposal guide: http://intranet.cdc.gov/ossam/workplace-safety/waste-disposal/wastewater/ Methods used at CDC

• Surface decontamination. Liquid disinfectants (such as peracetic acid) may be applied using sprayers to decontaminate exposed surfaces, such as counters, the exterior of cabinets, walls, and floors. This method will result in uneven application of disinfectants and will miss hard to reach areas under and between pieces of equipment. However, for laboratory spaces that lack HVAC dampers and therefore cannot be isolated this is the best practical method of decontamination.

• Space decontamination. Disinfectants such as hydrogen peroxide and chlorine dioxide may also be applied either as a gas or a vapor. This method has the advantage of a more even distribution of chemical within a laboratory. However, instrumentation (such as gas/vapor generators) is required to disperse the gas or vapor which may increase initial cost. This method also requires isolation of the laboratory from adjacent laboratories, maintenance spaces, and the

HVAC to prevent inadvertent exposure to staff or the environment.

• Disinfectants used at CDC. The performance of any disinfectant will be affected by a number of factors, to include contact time, concentration, presence of organic matter, pH, humidity, and temperature. Therefore one must carefully consider all these factors in selecting the best option for the specific application. For a list of EPA approved disinfectants please consult their website: https://www.epa.gov/pesticide-registration/selected-epa-registered-disinfectants

• Peracetic acid. A colorless and very corrosive organic compound. Strong oxidizing agent and irritant. Exposure may cause irritation to the skin, respiratory system, and eyes. As a disinfectant it is broadly effective against microorganisms by oxidizing their outer cell membranes. It is effective against bacteria, mycobacteria, viruses, fungi, and spores. After application it breaks down to acetic acid and hydrogen peroxide. It is known to corrode multiple types of metal, to include brass, copper, steel, and bronze. Due to the corrosive nature of this chemical, all computer and other sensitive electronic equipment must be covered and protected before decontamination begins. For further information please consult the Safety Data Sheet

(SDS) for the specific product provided by the vendor. At CDC peracetic acid is normally used for surface decontamination using a sprayer in BSL2 and BSL3 labs that lack dampers in the

HVAC.

• Hydrogen Peroxide. A naturally occurring clear colorless inorganic compound used as an oxidizer and disinfectant. Exposure may cause irritation to the skin, respiratory system, and eyes.

Applications include surface decontamination as well as room decontamination (as a vapor).

Produces free radicals that attack cell membranes and DNA. It is effective against bacteria, mycobacteria, viruses, fungi, and spores. Decomposes to water and oxygen. For further information, please consult the SDS for the specific product provided by the vendor. At CDC, hydrogen peroxide is normally used for space decontamination as a vapor in BSL3 and BSL4 labs fitted with dampers in the HVAC supply and exhaust.

• Other methods. BSL2 labs may be surface decontaminated using the OLSS-approved disinfectant for that space. For further information, please consult the SDS for the specific product provided by the vendor.

Quality Control

• Documentation. Records of decontaminations should include names of chemicals used, location, dates, name(s) of staff member conducting the procedure, type of laboratory, results, and lot numbers and expiration dates of all reagents used.

• Training and Proficiency. Records should document that staff conducting the decontamination have been trained and found to be proficient in the procedure. In addition, staff must be trained in the use of the appropriate PPE and fit tested (if applicable).

• Use of Biological indicators. The success of a decontamination procedure should be documented by the use of a biological indicator that is appropriate for the disinfectant and the method being used. Biological indicators must be distributed in the area to be decontaminated, exposed for the appropriate contact time, and incubated at the specified conditions, such as temperature and time. Always include controls such as an unexposed control. An easy and practical way to document results of biological indicators (along with BI locations, dates, and lot numbers) is to take a digital photograph of culture tubes after incubation (normally 24-72 hours).

• When to conduct a laboratory decontamination

• Before repairs or remediation. Occasionally laboratories will experience damage due to equipment malfunction or natural causes. Before repair and remediation personnel are permitted to enter the space, the laboratory should be decontaminated using a disinfectant that is appropriate for the organisms or agents being used in the space. Only after a successful decontamination can repairs and remediation begin.

• Annually, for preventive maintenance. The multiple systems present in the laboratory, such as engineering controls, facility features, and research equipment, will require regular scheduled maintenance. It is advisable that every BSL3 and BSL4 laboratory has a scheduled shutdown and decontamination on an annual or semiannual basis to allow maintenance staff to enter the space. BSL2 labs should be decontaminated as needed.

• Decommissioning/decertification. When a group stops using a laboratory space, usually due to a relocation or a change in mission requirements, the laboratory must be decontaminated and made available to the next occupants in a clean condition free of pathogens or other hazards.

This is normally followed by an inspection by laboratory safety staff.

• Other non-safety reasons. There may be other reasons for which a laboratory decontamination is desired, such as quality management and good manufacturing practices. In such cases the timing and frequency of laboratory decontamination will be governed by other factors and regulated by other agencies.

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the

Workforce Investment Act of 1998 and the Architectural and Transportation Barriers

Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part

1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section

508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS

EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

504 Authoring Tools

602 Support Documentation

603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product

Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the

Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html.

Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

(End of provision)

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order

(hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition

Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy

(IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed..

3) Information Security Categorization. In accordance with FIPS 199 and National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II:

Appendices to Guide for Mapping Types of Information and Information Systems to Security

Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ ] Moderate [ X ] High

Integrity: [ ] Low [ ] Moderate [ X ] High

Availability: [ X ] Low [ ] Moderate [ ] High

Overall Risk Level: [ ] Low [ ] Moderate [ X ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget

(OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following:

social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with

Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for

Federal Information Systems and Organizations applicable baseline if handled by a

Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting

Controlled Unclassified Information in Nonfederal Information Systems and

Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive

Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6

(IPv6). .

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict

Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The

Contractor shall provide a written copy of the validation documentation to the COR

[CDC-provided delivery date].

e. Use the Key Management system on the HHS personal identification verification

(PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys shall be provided to CDC Office of Chief Information Security Officer

(OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative

(COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The

Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a

PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the

E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable

HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees shall complete CDC Security Awareness Training (SAT) and Records

Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based

Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their

RBT requirement.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and

Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security

Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally

Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PU by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PU and portable electronic storage media that store PU, the inadvertent disclosure of PU on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PU for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII” .

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2) All contractors and subcontractors shall properly encrypt PII in accordance with

OMB Circular A-130 and other applicable policies, including CDC-specific policies, and…