RFP_68055_final.pdf

SAP RFP for Services

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Requirements (FAR) Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposal are being requested, and a separate written solicitation will not be issued.

Request for Proposals: 75D301-19-R-68055 This is a total small-business set-aside.

Offerors MUST have HSEEP Certification.

Questions are due no later than 8:00 AM Eastern Standard Time, Monday, August 12, 2019.

Proposals are due no later than: 8:00 AM Eastern Standard Time, Thursday, August 15, 2019.

Questions and Proposals must be submitted via e-mail ONLY to yto1@cdc.gov

Proposals must include the following information:

• Delivery Date (or delivery window)

• Trade-in Credit Information (if applicable)

• DUNS Number

• GSA Schedule Number (if applicable). Also identify any items that are “open market”

• Proposal Number

• Provide current date of proposal

• Expiration Date (120 days or more)

• The proposal must be addressed to Sean Golan at yto1@cdc.gov

Your proposal must be valid for at least 120 days. An email confirming the receipt of request would be greatly appreciated. If you do not wish to submit a proposal on this request, please reply with a “no proposal” e-mail message to me.

The proposal format is at the discretion of the offeror but must comply with Section E below.

It is the offeror's responsibility to be familiar with the applicable clauses and provisions. Clauses and provisions may be accessed via the Internet at website http://farsite.hill.af.mil.

This solicitation document and incorporated provisions and clauses are those in effect through the Federal Acquisition Circular (FAC) 2005-101 (09/17/18).

This acquisition is set aside for small businesses under North American Industry Classification System (NAICS) code 327315 and small business size standard of fewer than 1000 employees. A Firm-Fixed Price purchase order will be issued in writing to the successful offeror. To be eligible to receive an award resulting from this solicitation, contractor must be registered in SAM.gov (the System for Award Management). To register apply via the Internet at http://www.sam.gov.

Include FAR 52.212-3, Offeror Representations and Certifications with Offer or indicate if it is available online at SAM.gov.

Interested offerors should provide the Centers for Disease Control and Prevention with a proposal for the following services in accordance with the Statement of Work (SOW) in Section C:

mailto:yto1@cdc.gov mailto:yto1@cdc.gov http://www.sam.gov/

SECTION B – Services and Prices

Line Items

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Hospital Morbidity Survey Toolkit

Develop toolkit with SMEs at specialized treatment centers familiar with specialized care for victims of acute radiation exposure

1 Each

0002 Travel Two trips are planned Kick off meeting within 30 days of award to Chamblee 2nd meeting to conduct exercise and/or final meeting to summarize findings

1 Each

SECTION C – Description/Specification/Work Statement

Statement of Work

Title: Development and Testing of Hospital Morbidity Surveillance Toolkit: Improvised Nuclear Device (IND) detonation emergency response.

SECTION 1 – BACKGROUND

The Centers for Disease Control and Prevention, National Center for Environmental Health, Division of Environmental Health Science and Practice (CDC/NCEH/DEHSP) promotes health and quality of life by leading environmental health science, public health interventions, and services to protect the health of all people in the United States. Its mission is supported by surveillance, epidemiologic studies, technical assistance, training, and emergency response activities conducted by the following four Branches: Water, Food, and Environmental Health Services Branch (WFEHSB), Asthma and Community Health Branch (ACHB), Lead Poisoning Prevention Branch (LPPB, proposed), and the Emergency Management, Radiation, Chemical Branch (EMRCB). These Branches and their programs serve and provide critical environmental health capacity for state, tribal, local, and territorial (STLT) health departments and other agencies with related responsibilities.

The Emergency Management, Radiation, Chemical Branch (EMRCB) provides 1) guidance and resources to STLT and international public health agencies to respond to environmental public health events, natural disasters, and radiation exposures, 2) expertise in epidemiology and medical toxicology to investigate environmental health threats, and 3) oversight to the U.S.

chemical weapons elimination program.

The detonation of an improvised nuclear device (IND) within a large US metropolitan city would create a national need for healthcare facilities to manage the numerous casualties, including persons exposed to radiation and those with blast and trauma injuries. Many casualties may be treated at a combination of field hospitals, community hospitals, and secondary and tertiary care hospitals. Because only a small fraction of healthcare practitioners have either training or experience in the field of radiation injury, persons with acute radiation syndrome (ARS) will require transfer to specialized treatment centers that can provide the most effective medical treatment.

These specialized treatment centers can offer advanced therapy including bone marrow stem cell transplantation and other very specialized care for victims of acute radiation exposure. However, issues such as limited resources, geographic location, and bed capacity of the specialized treatment centers will likely result in a large number of non-fatal casualties receiving supportive care at other medical facilities across the US.

Currently, surveillance data on hospitalized patients is being collected by the CDC’s National Syndromic Surveillance Program (NSSP). NSSP data is useful for monitoring presenting medical diagnoses at participating medical facilities in the form of ICD-10 codes and some limited information from emergency department visits such as “chief complaint.” However, during a nuclear emergency, NSSP data lacks specific information (e.g., radiation exposure dose, exposure location, and medical countermeasures, age group, pregnancy) that is required for situational awareness and for the development of a long-term registry following a large-scale radiological or nuclear disaster, such as an IND detonation.

SECTION 2 – PURPOSE

The public health role of CDC after an IND detonation includes population monitoring, public health surveillance, and establishment of a long-term registry. Recent public health surveillance planning efforts have been focused on capturing information on the affected population that presents to community reception centers or CRCs after such an emergency. This population will have minor medical injuries given that CRCs are not intended to provide medical treatment.

There is currently a gap in efforts to develop and implement public health surveillance of patients receiving treatment for radiation exposure-associated illness at medical facilities. State and local public health departments have limited ability to perform this type of surveillance because of limited radiation expertise and resources. This project will seek to develop and pilot test tools and “proof-of-concept” processes that state and local public health agencies can use to conduct hospital morbidity surveillance following IND detonation.

The successful completion of this project will help close existing gaps in the public health surveillance for hospitalized patients after an IND. It will enable CDC to better support STLT partners in providing useful tools and guidance on what data to capture from hospitalized patients at specialized medical facilities and non-specialized medical facilities after an IND detonation.

SECTION 3 – SCOPE OF WORK

The objectives of this project are to:

1. Develop a hospital morbidity surveillance toolkit for use after an IND detonation

2. Pilot test the hospital morbidity surveillance toolkit for use after an IND detonation process during a Homeland Security Exercise Evaluation Program (HSEEP) compliant exercise or drill in a specialized medical facility or setting identified as similar to a specialized medical facility.

SECTION 4 – TASKS TO BE PERFORMED

The contractor will work with CDC staff with expertise in radiation (i.e., disaster epidemiologists, medical toxicologists, and health physicists) to develop “proof of concept” tools and processes for hospital morbidity surveillance following an IND detonation. Examples of previously developed materials will be provided at the start of the period of performance. Please note that the data used in this project will not be real patient data, rather artificially created datasets to test tools and processes being developed.

1. Develop a hospital morbidity surveillance toolkit for use after an IND detonation. The toolkit shall include, but is not limited to:

a. Examples of individual patient data collection tool that includes essential data elements needed for short-term and long-term surveillance

b. Examples of aggregate reporting template for consolidating individual patient data

c. Examples of data exchange processes and mechanisms to transfer data from medical facilities to CDC and other federal and state public health partners.

2. Obtain feedback on hospital morbidity surveillance toolkit from collaborators and public health partners.

3. Test each component of hospital morbidity surveillance toolkit during a HSEEP compliant exercise/drill using an artificial dataset and a notional scenario. Location to be determined.

4. Develop an After Action Report following the HSEEP exercise that includes results of the pilot test and recommendations for improvements to the hospital morbidity surveillance toolkit.

5. Produce final hospital morbidity surveillance toolkit for use after an IND detonation based on findings described in After Action Report.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

Examples of previously developed materials will be provided at the start of the period of performance.

SECTION 6 – PERIOD OF PERFORMANCE

The Period of Performance is planned for a period of 12 months.

SECTION 7 – PLACE OF PERFORMANCE

The place of performance will be off site, at the contractor’s facility.

SECTION 8 – DELIVERABLES/REPORTING

SCHEDULE Items Description Format Due Within/

Estimated Date

Deliver To

Kickoff meeting Meeting summary, action items and next steps

MS Office document or similar as determined by COR

30 days of award HSS SME, Project Officer/COR

Patient Data Collection Tool Example of Patient-level hospital morbidity data collection tool approved by all parties

MS Office document or similar as determined by COR

March 31, 2020 est.

HSS SME,

Project Officer/COR

Aggregate Reporting Template Example of Template for aggregating and reporting individual patient data approved by all parties

MS Office document or similar as determined by COR

March 31, 2020 est.

HSS SME,

Project Officer/COR

Data exchange processes document

Document describing examples of data exchange process to transfer data from medical facilities to CDC and other partners approved by all parties

MS Office document or similar as determined by COR

March 31, 2020 est.

HSS SME,

Project Officer/COR

After Action Report of HSEEP Drill

Report detailing HSEEP drill or exercise planning, execution and results including lessons learned

MS Office document or similar as determined by COR

July 30, 2020 est. HSS SME, Project Officer/COR

Final hospital morbidity surveillance toolkit

Final proof-of-concept hospital morbidity surveillance toolkit documents (examples of patient-level data collection tool, aggregate reporting template, data exchange process) with edits based on the HSEEP exercise/drill After Action Report

MS Office document or similar as determined by COR

September 30, 2020 est.

HSS SME,

Project Officer/COR

All materials will be provided electronically.

SECTION 9 – TRAVEL

The contractor will be responsible for organizing one trip for the kick off meeting for up to three staff to the CDC Chamblee campus within 30 days of award. Depending on the site selection of the exercise, a second trip may be required. Based on availability of travel funds, a final meeting may be held at Chamblee to summarize findings, review the After Action Report and the toolkit.

SECTION 10 – SPECIAL REQUIREMENTS

• The Contractor shall have demonstrated expertise and experience in the following:

o Medical treatment of radiation injuries including Acute Radiation Syndrome o Public health activities including data collection/exchange and surveillance o Proven record of coordinating large regional HSEEP compliant exercises involving medical facilities caring for potential patients with radiation injuries o Past successful collaborative projects with federal, state and local public health agencies

• Homeland Security Exercise and Evaluation Program (HSEEP) Certification is required.

Information Technology (IT) Security and Privacy

Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information; Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, reusing, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR upon request.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HHS/CDC non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

Incident Response. A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information (PII) or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send CDC approved notifications to affected individuals.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the CDC Incident Response Team (IRT) (CSIRT@cdc.gov, 866-655-2245), COR, CO, CDC SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable CDC and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information and HHS/CDC incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional mailto:CSIRT@cdc.gov security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide documentation or attestation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or CDC policies.

Records Management and Retention. The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS policies and shall not dispose of any records unless authorized by HHS.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS policies.

Privacy Act. It has been determined that this contract is subject to the Privacy Act of 1974, because this contract provides for the design, development, or operation of a system of records on individuals.

The System of Records Notice (SORN) that is applicable to this contract is:

09-19-0001 Records of Persons Exposed or Potentially Exposed to Toxic or Hazardous Substances

The design, development, or operation work the Contractor is to perform is:

Some requirements gathering and analysis will be done as part of the design of this potential system of records. No development or system operation will occur as part of this contract.

The disposition to be made of the Privacy Act records upon completion of contract performance is:

No records will be created in performance of this contract.

SECTION 10 – REFERENCE MATERIALS

Knebel et.al. Allocation of Scarce Resources After a Nuclear Detonation: Setting the Context.

Disaster Med Public Health Preparedness. 2011;5:S20-S31

DiCarlo et. al. Radiation Injury After a Nuclear Detonation: Medical Consequences and the Need for Scarce Resources Allocation. Disaster Med Public Health Preparedness. 2011;5:S32-S44) https://www.remm.nlm.gov/ https://ritn.net/ https://www.fema.gov/hseep https://www.remm.nlm.gov/ https://ritn.net/

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services http://www.hhs.gov/web/508 http://www.access-board.gov/sec508/standards.htm http://www.access-board.gov/sec508/standards.htm http://hhs.gov/web/508 delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html.

Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

http://508.hhs.gov/ https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html

Clauses

SECTION D – Clauses

D.1 Clauses Incorporated by Reference

FAR 52.252-2 -- CLAUSES INCORPORATED BY REFERENCE. (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/far1toc.htm http://www.hhs.gov/policies/hhsar/subpart301-1.html

FAR SOURCE TITLE AND DATE

52.204-13 System for Award Management Maintenance (Oct 2018) 52.204-18 Commercial and Government Entity Code Maintenance (Jul 2016) 52.212-4 Contract Terms and Conditions- Commercial Items (Oct 2018) 52.232-39 Unenforceability of Unauthorized Obligations (Jul 2013) 52.232-40 Providing Accelerated Payments to Small Business Contractors (Dec 2013) 52.227-14 Rights in Data—General (May 2014)

HHSAR SOURCE TITLE AND DATE

352.222-70 Contractor Cooperation in Equal Employment Opportunity Investigations (Dec 2015)

(End of Clause)

FAR 52.212-5 -- Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (May 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and

Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/far1toc.htm

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

_X__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

___ (10) [Reserved]

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved]

_X__ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Nov 2016) of 52.219-9.

___ (iii) Alternate II (Nov 2016) of 52.219-9.

___ (iv) Alternate III (Nov 2016) of 52.219-9.

___ (v) Alternate IV (Aug 2018) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

_X__ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

_X__ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

_X__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2018) (E.O. 13126).

_X__ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

___ (28) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

___ (ii) Alternate I (Feb 1999) of 52.222-26.

_X__ (29) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

___ (ii) Alternate I (July 2014) of 52.222-35.

_X__ (30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

___ (ii) Alternate I (July 2014) of 52.222-36.

_X__ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

___ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X__ (33) (i) 52.222-50, Combating Trafficking in Persons (JAN 2019)

(22 U.S.C. chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O.13693).

___ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

___ (38) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514

___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (39) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

___ (41) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

_X__ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

___ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

___ (44) 52.223-21, Foams (Jun 2016) (E.O. 13696).

___ (45) (i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

___ (ii) Alternate I (Jan 2017) of 52.224-3.

___ (46) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

___ (47) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C.

chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L.

103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112- 43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

___ (48) 52.225-5, Trade Agreements (Aug 2018) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__X_ (49) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (50) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (51) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

___ (52) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (53) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505), 10 U.S.C. 2307(f)).

___ (54) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C.

2307(f)).

_X__ (55) 52.232-33, Payment by Electronic Funds Transfer--System for Award Management (Oct 2018) (31 U.S.C. 3332).

___ (56) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (57) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

___ (58) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

___ (59) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

___ (60) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

___ (iii) Alternate II (Feb 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

___ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495)

___ (2) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67.).

___ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C.206 and 41 U.S.C. chapter 67).

___ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015) (E.O. 13658).

___ (9) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

___ (10) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C.

1792).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph

(d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c) and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Jan 2019) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and

Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(iv) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(v) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(vi) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(vii) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

(viii) 52.222-35, Equal Opportunity for Veterans (Oct 2019) (38 U.S.C. 4212).

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222- 40.

(xii) 52.222-41, Service Contract Labor Standards (Aug 2018), (41 U.S.C. chapter 67).

(xiii) (A) 52.222-50, Combating Trafficking in Persons (Jan 2019) (22 U.S.C. chapter 78 and E.O.

13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67.)

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67)

(xvi) 52.222-54, Employment Eligibility Verification (Oct 2015) (E. O. 12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015).

(xviii) 52.222-62, Paid sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

(xix) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008;

10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately-Owned U.S. Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

D.2 Clauses Incorporated In Full Text

52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 10 calendar days of the expiration of the contract; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 15 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed one year and six months.

(End of Clause)

52.232-32 Performance-Based Payments (Apr 2012)

(a) Amount of payments and limitations on payments. Subject to such other limitations and conditions as are specified in this contract and this clause, the amount of payments and limitations on payments shall be specified in the contract’s description of the basis for payment.

(b) Contractor request for performance-based payment. The Contractor may submit requests for payment of performance-based payments not more frequently than monthly, in a form and manner acceptable…