Solicitation75D301-19-R-67983_8_9_2019_Final.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

75D301-19-R-67983

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

August 9, 2019

6. REQUISITION/PURCHASE NO.

000HJAAM-2019-32440

FORMTEXT

Centers for Disease Control and Prevention (CDC)

Office of Acquistion Services (OAS)

2900 Woodcock Blvd.

Atlanta, GA 30341

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and __copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in See Section L until 2:00 local time See Section L CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Sherrie A. Blackmon

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770)488-2925

C. E-MAIL ADDRESS

kuj1@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

FORMTEXT

Centers for Disease Control and Prevention (CDC)

Office of Acquistion Services (OAS)

2900 Woodcock Blvd.

Atlanta, GA 30341

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

Estimated Period of Performance:

60 Months After Contract Award

The ceiling price for this contract is $23,500,000.00.

B.1 Purpose The purpose of this contract is to provide services that fall within the scope of the work specified in Section C for the project entitled, “Procurement of Traceable Opioid Material* Kit Materials and Recipeint Laboratory Support.” The Contracting Officer (CO) will request the work through the issuance of task orders during the ordering period as specified in Section F of the contract.

B.2 Contract Type and Services

This is a ‘Full and Open’ competitive procurement. This acquisition is being competed in accordance with FAR Part 15 - Contracting by Negotiation. The NAICS Code is 325998 - All Other Miscellaneous Chemical Product and Preparation Manufacturing with a small business size standard of 500 employees.

This is an Indefinite-Delivery Indefinite-Quantity contract (IDIQ) utilizing individual task orders to provide Opioid Kit Development and Professional Services. The Government comtemplates mutliple IDIQ awards with competitive Task Orders. The Government will issue task orders that are Fixed-Price (FP).

Obligation of funds will be done by the issuance of individual task orders by the Contracting Officer in accordance with the clause titled “Award of Task Orders” in Section H and FAR clause 52.216-18 titled “Ordering” in Section I. The Contractor shall not exceed the amount negotiated for each individual task order without prior written approval of the Contracting Officer.

In addition, the Contractor shall not commence work until a task order or other written notification for a specific assignment is issued by the Contracting Officer. Only a CDC Contracting Officer is authorized to issue a task order request to the Contractor or issue finalized task orders under this contract. The Government is not obligated to reimburse the Contractor for any costs that it incurs before issuance of a task order or other written notification by the Contracting Officer.

The intent is to issue two task orders (see Attachments J5, J6 and Section L herein) upon award of this IDIQ. The task order will be issued with a specific performance period.

B.3 Performance-Based Preference

Pursuant to FAR 37.102(a) (1), the Contracting Officer will use performance-based acquisition methods to the maximum extent practicable. The government anticipates multiple awards.

B.4 Minimum and Maximum Ordering Amounts

Minimum Single Order Amount: $5,000.00 Maximum Single Order Amount: $5,000,000.00 The ceiling price for this contract (i.e. cumulative value of all task orders) is $23,500,000.

B.5 Minimum Guarantee

This contract guarantees that task order(s) amounting to a minimum of five thousand dollars ($5,000) will be issued during the first 12 months of the contract period of performance. In the event the contractor receives obligations of less than this minimum, during the first 12 months, the Government will fund the difference between the actual obligation and the guaranteed minimum. Once a task order is issued for $5,000 or more in the first 12 months of the period of performance, the government has satisfied its minimum guarantee.

B.6 Maximum Contract Value

The aggregate maximum value of all combined awards made under this solicitation shall not exceed $23,500,000.00. If the Government's requirements for services set forth in the solicitation do not result in orders in the amounts described as “maximum," the event shall not constitute the basis for an equitable price adjustment under this contract.

B.7 Task Order Pricing

Task orders issued under this contract shall be Fixed-Price.

B.7.1 Firm Fixed Price (FFP)

Pursuant to FAR 15.4, Pricing, and FAR 16.2, Fixed-Price Contracts, the Firm-Fixed Price for each task order will be negotiated based on the price to complete the work. After acceptance of a fixed price task order by the Contractor, the task order price will only be adjusted to reflect changes in scope or conditions.

B.8 Place of Work and Government-Furnished Equipment

Work under the contract will be conducted off-site at Contractor locations. On-site meetings with CDC staff may be required. Each task order will specify the location requirements.

B.9 CDC37.0001 Non-Personal Services (Apr 2015)

(a) Personal services shall not be performed under this contract. Although the Government may provide sporadic or occasional instructions within the scope of the contract, the Contractor is responsible for control and supervision of its employees. If the Contractor (including its employees) believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

(b) The contractor shall comply with, and ensure their employees and subcontractors comply with, CDC Policy titled “Identification of Contractors' Employees and Safeguarding Government Information.” No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. . The contractor is limited to performing the services identified in the contract statement of work and shall not interpret any communication with anyone as a permissible change in contract scope or as authorization to perform work not described in the contract. All contract changes will be incorporated by a modification signed by the Contracting Officer.

(c) The Contractor shall ensure that all of its employees and subcontractor employees working on this contract are informed of the substance of this clause. The Contractor agrees that this is a non-personal services contract; and that for all the purposes of the contract, the Contractor is not, nor shall it hold itself out to be an agent or partner of, or joint venture with, the Government. The Contractor shall notify its employees that they shall neither supervise nor accept supervision from Government employees. The substance of this clause shall be included in all subcontracts at any tier.

(d) Nothing in this clause shall limit the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept or reject the services performed under this contract.

(End of Clause)

B.10 Service Contract Act

The contract labor categories are considered professional labor and are generally exempt from the Service Contract Act. However, each task order will be reviewed for applicability.

B.11 Contract Structure The basic contract will establish the general scope and ordering period for task orders to be issued against this contract. The term of this IDIQ contract is 60 months. It is anticipated that multiple task orders will be issued to the contractors to work on areas identified in the Scope of Work. Each task order shall have a discrete period of performance independent of the basic contract and no task order shall extend more than twelve (12) months beyond the expiration date of the basic contract.

Individual task orders exceeding $3,500 will be competed in accordance with the fair opportunity process described in FAR 16.505(b)(1) unless an exception to fair opportunity is documented in accordance with FAR 16.505(b)(2). All tasks orders will be solicited by email. Contractors will have a minimum of 14 days to respond.

SECTION C – DESCRIPTION/SPECIFICATION/WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Title of Project: Procurement of Traceable Opioid Material Kit* Materials and Recipient Laboratory Support C.1 Background and Need

The CDC’s Division of Laboratory Sciences is contracting for the development, manufacture, distribution, marketing, and support of a Traceable Opioid Material* Kits product line to improve and expand the detection of current and emerging opioids by U.S. laboratories. This work expands the national laboratory testing capacity during the HHS-declared public health emergency for the opioid overdose crisis.

*TRACEABLE OPIOID MATERIAL, TOM KITS, and the TOM KITS logo are marks of the U.S. Department of Health and Human Services.

C.2 Project Objective

The purpose of this indefinite delivery, indefinite quantity (IDIQ) contract is to acquire the development, manufacture, distribution, marketing, and support of the following domains of work: 1) Fentanyl Analog Screening (FAS) Kit materials and accompanying products, 2) Opioid Certified Reference Material (CRM) Kit materials and accompanying products, and 3) the flexibility of contractors to provide a third or more domains as needed in the CDC’s product line of Traceable Opioid Material* Kits. The third domain is a placeholder for future goods and services that may be needed to address the U.S. Department of Health and Human Services’ public health emergency for the opioid overdose crisis.

The Traceable Opioid Material* Kits will be distributed as approved by the CDC to laboratories across private, public, and academic sectors. The kits not only directly increase national capacity for laboratory testing of opioids but also improve the quality and comparability of emerging opioids identified during public health surveillance and research.

C.3 Scope of Work

The unique nature, scope, and complexity of the scientific, technical, expert, operational, and logistical services needed to support the Traceable Opioid Material* Kit product line will vary. This project will be achieved using a multi-task approach assuring quality products and services. In the completion of the project tasks described below, the contractor shall provide all labor, materials, and equipment using current infrastructure and in-house logistics. The performance stages included in the completion of each task will include: 1) Development, 2) Manufacture, 3) Distribution, 4) Marketing, and 5) Laboratory Support.

C.4 Technical Requirements

Independently, and not as an agent of the Government, the Contractor shall furnish all qualified and acceptable personnel to perform the tasks identified in the Performance Work Statement (PWS).

All activities, work products, reports, and deliverables developed/performed/conducted by the Contractor on behalf of Divisons of Laboratory Sciences shall be subject to review and approval by Divions of Laboratory Sciences. Any communication on be-half of Divions of Laboratory Sciences by the Contractor with non- Divions of Laboratory Sciences individuals, organizations, groups, companies, or agencies must have prior approval by Divions of Laboratory Sciences.

Within the three general areas of support, the Contractor may be required to perform the types of tasks listed below. Performance of all areas of support and tasks may be required concurrently on multiple projects and tasks. Although the successful Contractor shall be expected to provide all services listed in the SOW, it is not expected that the successful Contractor(s) shall have the capabilities to perform all of the required services included in the scope of work for this acquisition. Therefore, the Government anticipates that subcontracting for some limited services (e.g. laboratory services, expert panel members, highly specialized expertise) may be necessary.

Task Area 1:

FAS KIT

The Contractor shall work on the FAS Kit materials and accompanying products and services shall include the development of a list of needed synthetic opioids and fentanyl analogs as requested per task order.

1. This development will take the largest collection of commercial fentanyl analogs and continue to expand coverage of this FAS Kit through a series of task orders for Emergent Panels. The labs shall keep track of the prodcuct series they are using and the assigned DEA product numbers. (example: version 1-##).

2. The contractor shall then manufacture each kit or panel with the intent to distribute the products and accompanying services (example: Certificates of Analysis, Safety Data Sheets, Searchable Compound Databases, and as defined further in each task order).

3. The contractor shall need to have the manufacturing flexibility to provide bulk materials that may be higher quantities than the kits and in different matrices. For instance, a laboratory may request 3 milligrams of powder instead of a planned kit film.

4. Distribution of the product from each task order should begin no later than six months of task order.

5. The contractor shall market the resulting kits as similar products and services in their commercial catalog (example: handouts at technical conferences and meetings, customer distribution email lists, and as defined further in each task order). All marketing materials or supporting documents shall be approved by CDC prior to release.

6. Each task order shall include a pilot test product, accompanying certificates of analysis information for each component, a CDC-provided citation on how to cite the use of these kits, customer service contact information, and a shipping manifest with directions on where to access electronic resources such as safety information.

7. The contractor shall provide a technical and customer service process for all kit recipients that answers any product or service questions. These recipient inquiries and feedback shall be logged throughout the contract award and reported back to the CDC in annual final reports.

8. The contractor shall maintain their DEA registration and ISO accreditation requirements needed to complete all tasks at the quality level needed for each product and service.

9. The contractor shall maintain an electronic platform to support the CDC in reviewing and approving order requests. This platform should be able to adapt to simple data analytics requests. For instance, the CDC may need to see a U.S. map of where shipments are going and where they are requested.

Task Area 2: Opioid CRM Kit The Contractor shall work on the Opioid CRM Kit materials and accompanying products and services shall include the development of a list of growing synthetic opioids reported by the DEA and NFLIS systems as requested per task order.

1. This development shall take the largest collection of carbon-13 and nitrogen-15 labeled synthetic opioid certified reference materials and continue to expand coverage of this Opioid CRM Kit through a series of task orders for emerging threats (example: version 1-##).

2. The contractor shall then manufacture each kit or panel with the intent to distribute the products and accompanying services (example: Certificates of Analysis, Safety Data Sheets, Searchable Compound Databases, and as defined further in each task order).

3. The contractor shall need to have the manufacturing flexibility to provide bulk materials that may be higher quantities than the kits and in different matrices. For instance, a laboratory may request 10 milligrams of powder instead of a planned kit solution of 1 milligram in methanol.

4. Distribution of the product from each task order should begin no later than six months of task order.

5. The contractor shall market the resulting kits as similar products and services in their commercial catalog (example: handouts at technical conferences and meetings, customer distribution email lists, and as defined further in each task order). All marketing materials or supporting documents shall be approved by CDC prior to release.

6. Each task order shall include a pilot test product, accompanying certificates of analysis information for each component, a CDC-provided citation on how to cite the use of these kits, customer service contact information, and a shipping manifest with directions on where to access electronic resources such as safety information.

7. The contractor shall provide a technical and customer service process for all kit recipients that answers any product or service questions. These recipient inquiries and feedback shall be logged throughout the contract award and reported back to the CDC in annual final reports.

8. The contractor shall maintain their DEA registration and ISO accreditation requirements needed to complete all tasks at the quality level needed for each product and service.

9. The contractor shall maintain an electronic platform to support the CDC in reviewing and approving order requests. This platform should be able to adapt to simple data analytics requests. For instance, the CDC may need to see a U.S. map of where shipments are going and where they are requested.

Task Area 3: Traceable Opioid Material Kit The Contractor shall work on additional Traceable Opioid Material* Kit goods and services shall be identified as needed and will be based on emerging threats as they are identified in-time.

1. The contractor for task orders shall have the experience, expertise, and flexibility to develop and support new synthetic Traceable Opioid Material* Kits and all needed product support services needed for laboratory implementation.

2. The contractor shall then manufacture each kit or panel with the intent to distribute the products and accompanying services (example: Certificates of Analysis, Safety Data Sheets, Searchable Compound Databases, and as defined further in each task order).

3. The contractor shall need to have the manufacturing flexibility to provide bulk materials that may be higher quantities than the kits and in different matrices. For instance, a laboratory may request 10 milligrams of powder instead of a planned kit solution of 1 milligram in methanol.

4. Distribution of the product from each task order should begin no later than six months of task order. The contractor shall market the resulting kits as similar products and services in their commercial catalog (example: handouts at technical conferences and meetings, customer distribution email lists, and as defined further in each task order).

5. All marketing materials or supporting documents shall be approved by CDC prior to release.

6. Each task order shall include a pilot test product, accompanying certificates of analysis information for each component, a CDC-provided citation on how to cite the use of these kits, customer service contact information, and a shipping manifest with directions on where to access electronic resources such as safety information.

7. The contractor shall provide a technical and customer service process for all kit recipients that answers any product or service questions. These recipient inquiries and feedback shall be logged throughout the contract award and reported back to the CDC in annual final reports.

8. The contractor shall maintain their DEA registration and ISO accreditation requirements needed to complete all tasks at the quality level needed for each product and service.

9. The contractor shall maintain an electronic platform to support the CDC in reviewing and approving order requests. This platform should be able to adapt to simple data analytics requests. For instance, the CDC may need to see a U.S. map of where shipments are going and where they are requested.

C.5 Reporting Schedule

In addition to specific reporting requirements defined in each Task Order issued, the Contractor shall furnish monthly progress reports detailing current status of each Task Order under the IDIQ. The report shall be narrative in form and shall include summary of progress towards completion of each Task Order and any problems encountered to date, including the Contractor’s assessment of the specific impact of such problems on scheduled date of completion of milestones.

C.6 Special Requirements

All contractor products and services shall refer recipients to:

1. A CDC provided citation for use when citing findings reported from using the kits,

2. CDC’s website for the Traceable Opioid Material* Kits, and

3. Additional electronic resources in support of each deliverable produced.

4. The contractor must be located in the US and hold (and maintain) a valid Drug Enforcement Administration (DEA) controlled substance registration for both Schedule I-V controlled substances for manufacture and distribution.

5. Inspection and acceptance of the articles, services, and documentation called for herein shall be accomplished by the Contracting Officer, or his duly authorized representative (who for the purposes of this contract shall be the Contracting Officer’s Representative) at the destination of the articles, services or documentation.

6. No information related to data obtained under this contract shall be released or publicized without the prior written consent of the COR.

All collected data under Task Orders are intended for dissemination at the discretion of CDC. The requirements for Federal Government approval prior to disclosure of information pertain. The Contractor agrees not to release or disclose, verbally or in writing, information pertaining to the results or findings of work (including study design, evaluation plan, or draft or final papers and reports prepared) for the period of the contract without obtaining prior written approval of the Contracting Officer and Technical Monitor. Failure to receive a response from the Contracting Officer by a requested date does not constitute approval for release of information.

The data collected are considered sensitive information and shall not be released to anyone other than CDC or someone designated by CDC for the duration of the project thereafter.

7. This contract is subject to the Paperwork Reduction Act, requiring the Assistant Secretary for Management and Budget (ASMB) and the Office of Management and Budget (OMB) to approve the action. The Contractor is not authorized to expend any funds or take any action whatsoever in soliciting data from any of the public respondents until the Contracting Officer has notified the Contractor that ASMB and OMB final approval has been obtained. The Contractor shall provide the COR with all information necessary to obtain final clearance.

IT Security

Standard for Security Configurations

(a) The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. Note: FDCC is applicable to all computing systems using Windows XPTM and Windows 7TM, including desktops and laptops—regardless of function—but not including servers.

(b) The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

Note: The Contracting Officer shall specify applicable security configuration requirements in solicitations and contracts based on information provided by the Project Officer, who shall consult with the OPDIV/STAFFDIV Chief Information Security Officer.

(c) The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings—see http://nvd.nist.gov/validation.cfm. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest FDCC major version and subsequent major versions.

(d) The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

(e) The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

(f) The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

(g) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Standard for Encryption Language

(a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered “sensitive” in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.)

(b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

(c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

Code of Federal Regulations / Title 48 - Federal Acquisition Regulations System / Vol. 4 / 2011-10-01117

(d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).(e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.(f) The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

Security Requirements for Federal Information Technology Resources

(a) Applicability. This clause applies whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term “information technology (IT)”, as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

(b) Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their—

(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and.

(iii) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

(c) Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP)—due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

(i) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(A) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources.

(B) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(C) HHS-OCIO Information Systems Security and Privacy Policy.

(ii) After resolution of any comments provided by the Government on the draft IT-SP, the Contracting Officer shall accept the IT-SP and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. On an annual basis, the Contractor shall provide to the Contracting Officer verification that the IT-SP remains valid.

(2) IT Risk Assessment (IT-RA)—due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment)—due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

(4) IT Security Certification and Accreditation (IT-SC&A)—due within 3 months after contract award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems—see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems; and NIST SP 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provide it to the Contracting Officer for review, comment, and acceptance.

(i) After resolution of any comments provided by the Government on the draft IT-SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

(ii) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(A) Annual testing of the system contingency plan; and

(B) The performance of security control testing and evaluation.

(d) Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Technical Representative (COTR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in “HHS-Controlled Facilities and Information Systems Security” requirements specified in the SOW/PWS of this contract.

(e) Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COTR evidencing that Contractor employees have completed the required training.

(f) Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

(g) Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that—

(1) Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

(h) Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

(i) Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

(j) Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

(k) Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

Electronic and Information Technology Accessibility Notice

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards.

(c) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-74, Electronic and Information Technology Accessibility.

In order to facilitate the Government’s determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and document—in detail—whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS website http://www.hhs.gov/web/508.

In order to facilitate the Government’s determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(End of Provision)

C.7 Government Furnished Property (GFP) No GFP is being provided C.8 References

Task Orders will specify pertinent references.

C.9 Deliverables

Deliverables will vary with each Task Order and will include the reporting requirements listed in the reporting section.

C.10 Ownership Rights In accordance with FAR 52.227-14 Rights in Data, all records, files, analyses, models, and documents developed under this contract shall be the property of the CDC.

C.11 Deliverables

Specific deliverables will be determined at the Task Order level. They will usually include a monthly progress report and final report describing the implementation and results of the task.

C.12 Performance Based Matrix The Pefromance Based Matrix will be used to ensure that systematic quality assurance methods are used in the administration of the Performance-Based Service Contract (PBSC) standards included in this contract. This matrix will be defined at the task order level.

The contractor is responsible for management and quality control actions necessary to meet the quality standards set forth in the task order.

SECTION D - PACKAGING AND MARKING

D.1 Offeror shall enter into a license agreement to use only the CDC logo, the TOM Kits* logo, and a single contractor logo that represents the ISO accreditation and closest first-party production of the technical product. Offerer shall enter your proposed logo in the graphic below and copy and paste the graphic into your Proposal. Platforms containing the logos will be reviewed and approved by the CDC COR prior to release. See Attachment J7 for logo details.

SECTION E - INSPECTION AND ACCEPTANCE

E.1 Clauses Incorporated by Reference

SECTION F - DELIVERIES OR PERFORMANCE

F.1 Clauses Incorporated by Reference

F.2 Deliverable(s) Schedule (Jul 1999)

The Contractor shall deliver to the Contracting Officer's Representative (COR), Contract Specialist and the Contracting Officer any reports or deliverables as may be specified in the individual task orders within the time frames specified.

(End of Clause)

F.3 Period of Performance (Contract and Task Orders) (Jul 1999)

(a) Contract: The period of performance shall be sixty (60) months from the effective date of the contract.

(b) Task Orders: Task orders may include options to be exercised at the discretion of the Government. The time for completion for each task order shall be determined under each individual task order through the mutual agreement of the parties involved. Task orders under this contract may be awarded by the Contracting Officer at any time within the contract period.

F.4 Place(s) of Performance (Jul 1999)

The Contractor shall perform all work under this contract as determined by individual task orders in accordance with the Performance Work Statement.

(End of Clause)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 CDCP_G009 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

(End of Clause)

G.2 CDC0_G008 Contracting Officer’s Representative (COR) (Jul 2017)

Performance of the work hereunder shall be subject to the technical directions of the designated COR for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof.

In the event that the Contractor believes full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer, immediately or as soon as possible, in a letter or e-mail separate of any required report(s). No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government COR is not authorized to change any of the terms and conditions of this contract. Contract changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the COR delegation memorandum upon request.

(End of Clause)

G.3 CDCP_G010 Contract Communications/Correspondence (Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

(End of Clause)

G.4 CDC0_G018 Payment by Electronic Funds Transfer (Feb 2018)

(a) The Government…