RFQ_75D301-19-Q-70948.docx

Request for Quote 75D301-19-Q-70948

Department of Health and Human Services Public Health Service Centers for Disease Control and Prevention Atlanta, GA 30333

RE: Automated temperature and humidity monitoring for laboratories

Be sure to submit a proposal and questions you may have to Monica Shaw at vwk1@cdc.gov.

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

Statement of Work Automated temperature and humidity monitoring for laboratories within the National Center for Immunization and Respiratory Diseases (NCIRD) B1 Background and Need The Centers for Disease Control and Prevention (CDC) works 24/7 to protect America from health, safety and security threats, both foreign and in the U.S. Whether diseases start at home or abroad, are chronic or acute, curable or preventable, human error or deliberate attack, CDC fights diseases and supports communities and citizens to do the same. CDC’s National Center for Immunization and Respiratory Diseases (NCIRD) works to prevent disease, disability, and death through immunization and by control of respiratory and related diseases.

In order for NCIRD to achieve their mission, state-of-the-art laboratory equipment must be in working order and compliant with either the Clinical Laboratory Improvement Amendments (CLIA) regulations or with the International Standards Organization (ISO) requirements. These regulations and standards require monitoring of temperature and humidity in all laboratory areas where quality assurance materials and other samples are manufactured, stored, and/or tested. Accurate recordings are essential to ensure the quality of the materials being used and stored in the laboratory. Historically, monitoring and recording temperature, humidity, and CO2 in all required areas was done manually multiple times each day. This process is inaccurate, impractical and cost prohibitive. The lack of automated notifications when levels are out of range has resulted in costly loss of reagents and samples. CDC laboratories have an urgent need for an automated temperature, humidity, and CO2 monitoring and notification system.

B2 Project Objective This requirement is to obtain an automated monitoring and notification system that will record temperature, humidity, and CO2 levels in NCIRD laboratories and notify laboratory staff when required levels are out of range.

B3 Scope of Work The vendor will provide and install a comprehensive monitoring system to record temperature, humidity, and CO2 levels in necessary laboratory areas, including open laboratory rooms, refrigerators, freezers, and incubators. The monitoring system will include a network of temperature transmitters, laboratory receivers, and centralized servers to collect data and generate graphs and reports; remote access and notification capabilities; and door sensors to indicate when equipment is opened, closed, or left ajar.

The vendor will provide all necessary software and hardware, covering monitored equipment, rooms, and doors. The system must be scalable to allow future expansion.

The vendor must be ISO 17025 compliant to perform required calibration/recalibration; perform installation qualification (IQ) and operational qualification (OQ) following laboratory protocol; and provide documentation on all installation and calibration activities.

B4 Technical Requirements Temperature mapping the areas where laboratories store products ensures the products are kept at the correct condition which is essential for safety and compliance. This requirement includes purchase of equipment, warrantied for one (1) year, installation, software set up and monitoring.

a. Equipment must meet the following specifications

· NIST traceable sensors (Temperature range -200 to 300C

· Minimum of 0.1C resolution

· out of specification reporting with the ability to electronically review and/or approve reports

· Ability to document corrections/corrective action with electronic signature

· Single-server 21 CFR part 11/CLIA/ISO compliant system

· Server and SQL instance that supports virtualization using VMWare ESC Hypervisor

· Active Directory or LDAP Domain Authentification

· Ability to create user groups and at least 3 permission levels

· Text/email alerts

· Secure and auditable logs of all system activity, recording user and action with date/time

· 900Mhz Zigbee IEEE 802.15.4 Wireless Transmitters

· Transmitter battery-life of at least 12 months, based on minimum two readings per hour

· Minimum 14 days data buffering when power or connection to server fails

· Replacing batteries does not erase logged data

· Door status sensor and 2 analog sensor inputs on each transmitter

· LCD temp/humidity/CO2 display on transmitter modules

· Audible and visual alarms

· 900Mhz Zigbee IEEE 802.15.4 Wireless Receivers with Gigabit Ethernet network ports

· Self-healing, redundant MESH network topology that auto-recovers from receiver failures

· User-friendly web-based client GUI (no client application required)

· Graphs of monitored readings

· Table, List and Map views of monitored resources

b. Warranty /Monitoring /Support

· One (1) year equipment warranty

· Perform installation qualification (IQ) and operational qualification (OQ)

· Unlimited phone, fax, e-mail and website operational support for up to two NCIRD points-of-contact.

· Remote support must be available 24 hours per day, 7 days per week. Local 8/5 tech support (local support technician proximal to campus)

· Onsite support must be available 8 hours per day, 5 days per week, excluding federal holidays.

· Remote 24/7 tech support (for support during emergency response activities)

· Users’ phone calls must be returned within four (4) business hours if not handled immediately; and

· Provide support for all equipment in ATTACHMENT A: Equipment list.

· Provide NIST traceable calibration services by an ISO 17025 certified vendor.

· Provide application server software /firmware updates in a timely manner and without additional cost.

· Provide a HHS Product Accessibility Template (HHS PAT) for every software release or upgrade (for Section 508 compliance).

B5 Reporting Schedule The contractor shall provide announcements of product updates through customer service bulletins and announcements or directly to NCIRD points of contact.

B6 Delivery Schedule The delivery schedule for equipment installation shall be between four (4) and eight (8) weeks from the date of award.

Equipment shall be under warranty for a period of twelve (12) months beginning the day after installation and qualifications are completed.

The system may be expanded and/or additional systems /components may be acquired in the future. Expansion will be determined as needed and funded through issuance of a contract modification.

B7 Other Requirements

a. Safety (as applicable for each laboratory): As required by the Occupational Safety and Health Administration’s (OSHA) Bloodborne Pathogens Program (BBP), Standard 29 CFR 1910.1030, CDC’s Exposure Control Plan (ECP) is in place to inform employees about appropriate control measures necessary to eliminate or minimize exposure to human blood and other potentially infectious materials.

· CDC requires contractors that may be exposed to these hazards comply with the requirements listed in the BBP ECP.

· All mechanical or electrical systems that must be deactivated prior to service shall be deactivated by whatever disconnect or shut-off means are provided. Each deactivated system shall be properly "tagged-out" to prevent accidental reactivation. The CDC Environmental, Safety and Health Compliance (ESHCO) will furnish "tag-out" procedures and tags. The government shall be responsible for performing surface decontamination of equipment; removing the contents of equipment and ensuring the equipment is biologically safe before making it available to the contractor service representative for service or repair.

b. Security: Information Security Continuous Monitoring - Upon the government issuance of an Authority to Operate (ATO), the vendor owned/operated systems that input, store, process, output, and/or transmit government information, shall meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, and HHS IS2P. The following are the minimum requirements for ISCM:

· Annual Assessment/Pen Test - Assess the system security and privacy controls (or ensure an assessment is conducted) at least annually to determine the implemented security and privacy controls are operating as intended and producing the desired results (may involve penetration testing conducted by the agency or independent third-party.) Review relevant SA&A documentation (SSP, POA&M, Contingency Plan, etc.).

· Asset Management - Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS-owned information/data. It is anticipated that this inventory information will be required to be produced at least annually or to comply with CDC/ATSDR change management requirements. IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP- compliant format information. The contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

· Configuration Management - Use available SCAP-compliant automated tools, per NIST IR 7511, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard HHS and government configuration baselines. The contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

· Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST-specified SCAP standards for vulnerability identification and management. The contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP-compliant automated tools and report to the agency at least monthly.

· Patching and Vulnerability Remediation - Install vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within vendor and agency specified timeframes.

· Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US- CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

· Boundary Protection - The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities is routed through a Trusted Internet Connection (TIC).

· End of Life Compliance. The Contractor (and/or any subcontractor) must use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software need to be within one major version of the current version; deviation from this requirement will only be allowed via the HHS waiver process (approved by HHS CISO). The contractor shall retire and/or upgrade all software/systems that have reached end-of-life in accordance with HHS End-of-Life Operating Systems, Software, and Applications Policy.

c. Special Considerations: The vendor shall employ a formal tracking system to identify and track customer issues reported to them. The tracking system shall include a critical evaluation of the reported issues, proposed resolutions for each issue, an estimated timeline for release of updates to correct each issue, and documentation of product quality assurance activities related to validation of software fixes and enhancements. The vendor must maintain a timeline of planned future product releases to include estimated timelines and specific issues addressed as part of the expected product release, and make such timelines available on request.

B8 Government Furnished Property CDC will not furnish any property. The server is hosted in a consolidated virtual environment provided by CDC. The vendor shall ensure that all IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices, etc.) used to process information on behalf of CDC are deployed and operated in accordance with approved security configurations and meet the following minimum requirements:

a. Encrypt equipment and sensitive information stored and/or processed by such equipment in accordance with HHS and FIPS 140-2 encryption standards.

b. Configure laptops and desktops in accordance with the latest applicable United States Government Configuration Baseline (USGCB), and HHS Minimum Security Configuration Standards;

c. Maintain the latest operating system patch release and anti-virus software definitions;

d. Validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching and ensure changes in hardware and software do not alter the approved configuration settings;

e. Automate configuration settings and configuration management in accordance with HHS security policies, including but not limited to:

· Configuring its systems to allow for periodic HHS vulnerability and security configuration assessment scanning; and

· Using Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capabilities to scan its systems at least on a monthly basis and report the results of these scans to the CO and/or COR, Project Officer, and any other applicable designated POC.

B9 Quality Assurance Surveillance Plan (QASP)

on- time payment /delayed payment

B10 Deliverables

B11 Inspection and Acceptance Criteria The CDC COR and/or designee will monitor the contractor's performance and shall be responsible for documenting acceptance or rejection of contractor services with five (5) business days of services being rendered. If inspection and written (e-mail) notice of rejection has not been provided to the contractor with ten (10) business days of service, such services will be determined acceptable.

B12 Other PrivacyAct and ITSecurity FAR 39.101(d) IT Contractor performance and resulting deliverables must adhere to all Federal, HHS, and/or CDC IT security policies and procedures. Based upon the scope of this contract, adherence to the following HHSAR IT Security clauses is required: 352.239-70 Standard for Security Configurations (http://www.gpo.gov/fdsys/pkg/CFR-2011-title48-vol4/xml/CFR-2011-title48-vol4-sec352-239-70.xml); 352.239-71 Standard for Encryption Language (http://www.gpo.gov/fdsys/pkg/CFR-2011-title48-vol4/xml/CFR-2011-title48-vol4-sec352-239-71.xml); 352.239-72 Security Requirements for Federal Information Technology Resources (http://www.gpo.gov/fdsys/pkg/CFR-2011-title48-vol4/xml/CFR-2011-title48-vol4-sec352-239-72.xml). Development or implementation of an electronic information system or any electronic data collection effort conducted in the performance of this contract will be required to complete Certification and Accreditation (C&A) prior to operation resulting in an Authority of Operate (ATO) from CDC. The contractor shall be required to complete all security documentation and materials necessary to obtain an ATO. The contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other federal policies and regulations in the performance of the security requirements. All information systems developed, implemented, or maintained in support of this contract must adhere to the security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final-errata.pdf) and NIST 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations. The Contractor must follow the guidance available from NIST and other recognized sources; NIST publication SP 800-44 Guidelines on Securing Public Web Servers, (http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf), NIST publication SP 800-95 Guide to Secure Web Services, (http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf) when applicable, Web Application Security Consortium (http://www.webappsec.org), and Open Web Application Security Project (OWASP) (http://www.owasp.org). The contractor must follow CDC development standards and use the CDC web template package. The CDC Secure Web Application Coding Guidelines and CDC Template Package can be provided by the CDC Project Officer or NCCDPHP ISSO. During any application development or enhancement, the contractor shall work closely with the NCCDPHP Office of Informatics and Information Resources (OIIRM) to ensure all CDC-related technical and security standards, processes and procedures are followed. This working relationship shall continue through full production. All web content must reside on a CDC.gov domain and must be hosted on CDC or CDC-authorized information systems. The contractor may not establish a .org or .com site to host CDC funded content or web applications. All CDC websites, campaign sites, and applications must use standard the standard CDC web template to ensure a consistent look and feel for CDC websites. The template will be provided as needed. CDC information systems are not approved for cloud deployment at this time (February 2015). However, if cloud deployment is approved in the future, the provider must be FedRAMP certified. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for CDC’s authorization is based on the System’s NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. All publicly accessible Federal websites and web services must provide service over a secure connection. The strongest privacy protection currently available for public web connections is Hypertext Transfer Protocol Secure (HTTPS).

Section 508 of the Rehabilitation Act (29 USC 794d) FAR 39.2 and HHSAR 339.2 HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

(End of provision)