Request For Proposal Revised.docx

2 RFP # 75D301-22-R-72169

RFP Table of Contents:

SECTION A DESCRIPTION OF THE REQUIREMENT

(1) Description

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. The Centers for Disease Control and Prevention intends to award a FIRM-FIXED-PRICE contract type for the requirement.

(ii) The solicitation number is 75D301-22-R-72169. The solicitation is issued as a Request for Proposals (RFP).

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2022-04 effective 01/30/2022.

(iv) This procurement has been designated a small business set-aside competed under NAICS 541380 – Testing Laboratories with small business size standard $16.5M.

(v) See Section B of this solicitation for contract line item number structure.

(vi) See Section C for the Performance Work Statement. This procurement is for commercial wastewater surveillance testing services in coordination with The National Wastewater Surveillance System to detect trends in COVID-19 cases in communities.

(vii) The contract anticipated period of performance is 04/01/2022 – 02/28/2023.

(viii) The provision at FAR 52.212-1, Instructions to Offerors-Commercial, applies to this acquisition.

(ix) The provision at FAR 52.212-2, Evaluation-Commercial Items, is applicable and indicates the evaluation procedures to be used.

(x) The provision at FAR 52.212-3, Offeror Representations and Certifications-Commercial Items, is to be included as part of the System for Award Management registration. If for any reason it is not a part of the System for Award Management registration, then include a copy with the proposal.

(xi) The FAR clause at 52.212-4, Contract Terms and Conditions-Commercial Items, applies to this acquisition.

(xii) A The clause at FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items, applies to this acquisition. The additional FAR clauses cited in the clause are applicable to the acquisition.

(xiii) Additional contract terms and conditions are included in this solicitation in Section D, Terms and Conditions, and Section E, Solicitation Provisions.

(xiv) The Defense Priorities and Allocations System (DPAS) is not applicable. See note in Section B regarding Health Resources Priorities and Allocations System

(xv) The date, time and place offers are due is indicated in the System for Award Management posting.

(xvi) The name, telephone number, and email address of the individual to contact for information regarding the solicitation is indicated in the System for Award Management posting.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

Phase 0

Professional services for project NWSS Wastewater Testing for SARS-CoV-2 in accordance with the Performance Work Statement as set forth herein.

Firm fixed price

Severable Services

Anticipated Period of Performance:

04/01/2022 – 04/14/2022

Phase 1

Professional services for project NWSS Wastewater Testing for SARS-CoV-2 in accordance with the Performance Work Statement as set forth herein.

Firm fixed price

Severable Services

Anticipated Period of Performance:

04/15/2022 – 07/14/2022

Phase 2

Professional services for project NWSS Wastewater Testing for SARS-CoV-2 in accordance with the Performance Work Statement as set forth herein.

Firm fixed price

Severable Services

Anticipated Period of Performance:

07/15/2022 – 01/14/2023

NWSS Wastewater Testing for SARS-CoV-2

Phase 3

Professional services for project NWSS Wastewater Testing for SARS-CoV-2 in accordance with the Performance Work Statement as set forth herein.

Firm fixed price

Severable Services

Anticipated Period of Performance:

01/15/2023 – 02/28/2023

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A— Health Resources Priorities and Allocations System. \

Vendor shall bill bi-weekly and shall meet the deliverable timeline in SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

SECTION C – PERFORMANCE WORK STATEMENT

Period of Performance: 11 months Title: SARS-CoV-2 Wastewater Testing and Sequencing Services

SECTION 1 – BACKGROUND

The Centers for Disease Control and Prevention (CDC) and our federal partners are working with state, tribal, local, and territorial (STLT) governments and with the private sector to execute a whole of government response to fight the COVID-19 pandemic and protect the public’s health. The National Wastewater Surveillance System (NWSS) was established to provide community-level data on infection trends using an approach that is independent of healthcare access and clinical testing capacity. Wastewater data has been used to support STLT response decision-making, such as resource allocation, siting of mobile testing units, refining health messaging, and near-term forecasting of cases and hospitalizations.

NWSS is a CDC-coordinated surveillance system that is implemented through STLT health departments. By August 2021, 43 state, local, and territorial public health jurisdictions had received funding to support wastewater surveillance activities. However, implementation of this novel surveillance approach requires considerable effort, resources, and coordination at the state and local level, and STLT health departments are already overburdened providing other COVID response activities. Thus, not all funded jurisdictions are able to rapidly implement this novel surveillance approach or provide substantial coverage of the communities in their jurisdictions. Some STLT jurisdictions do not have the capacity to implement wastewater surveillance activities and are lacking access to this valuable source of public health data.

In May 2021, HHS initiated a contract to provide commercial wastewater surveillance testing. This proof-of- concept contract evaluated whether direct coordination with utilities to collect and test wastewater could provide timely and consistent wastewater data to federal and STLT partners. The contractor was able to collect biweekly samples from ~300 utilities representing 98 million persons with data submitted to the government within 36 hours of sample receipt. This data enabled health departments to integrate wastewater data into their response decision-making while they are developing and implementing their jurisdiction-led wastewater surveillance program. This contract demonstrated that direct commercial provision of wastewater testing can provide timely and high-quality data, transmit data securely and efficiently to the NWSS DCIPHER data system, and can supplement jurisdiction-led efforts.

Continuing and expanding this commercial wastewater testing activity is a critical and urgent need to support the nation's ongoing response to the COVID-19 health emergency. With the emergence of new variants, there is a sustained risk of surges throughout the US. Wastewater data can provide an early warning of new surges to allow more time to allocate resources. Wastewater data also provides a robust measure of community infection trends at the height of surges when clinical testing can have insufficient capacity. This testing capacity would allow rapid expansion of the NWSS network to a truly national system providing COVID surveillance data for US territories, tribal nations, and all 50 states.

SECTION 2 – PURPOSE

The purpose of this project is to provide commercial wastewater testing services to communities that want to participate in NWSS but do not have access to testing. This 11-month contract will provide critical SARS- CoV-2 concentration and sequence data to CDC to support ongoing COVID response efforts at the national, state, and local levels. Priority wastewater treatment plants will be identified by CDC and provided to the contractor for enrollment. If necessary, additional facilities will be recruited by the contractor in coordination with CDC staff. The contractor will provide twice weekly quantitative wastewater SARS-CoV-2 testing for up to 500 sites and sequence data for the samples that meet pre-determined inclusion criteria for sequencing. The raw quantitative data will be submitted to NWSS for analysis and dissemination to health departments. The raw sequence data will be submitted to the National Center for Biotechnology Information (NCBI) for analysis and dissemination to health departments.

SECTION 3 – SCOPE OF WORK

The Contractor shall provide additive data and support to CDC’s NWSS by measuring SARS-CoV- 2 RNA in community wastewater, compiling that data, and securely transferring the derived data to the NWSS DCIPHER data system in a .csv format that corresponds with the NWSS Data Dictionary format to integrate within the existing data infrastructure. The contractor shall support wide-scale and regular, twice weekly testing of the American population for COVID-19 using wastewater surveillance to help guide mitigation strategies and serve as leading indicator for local re-emergence events. Additionally, sequencing of positive samples can provide information on the presence of variants of concern in the contributing communities.

The contractor must enroll and maintain 250 wastewater facilities within 2 weeks, increasing to 500 facilities within 3 months, to perform the services to fulfill all the objectives and requirements of this contract. CDC will provide a list of wastewater facilities currently participating in contract testing and additional priority sites for enrollment, totaling at least 500 priority wastewater facilities . If spaces remain after these sources are exhausted, the contractor will recruit additional facilities in coordination with CDC. The Contractor must provide all staff, equipment, supplies, and logistical support to perform all services described in this contract, including but not limited to, identification of sample collection location, sample analysis, and data management. This will include supplying sample collection supplies and shipping materials at no cost to the participating utilities.

Requirements

· Contractor will provide self-contained sampling kits and shipping materials to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples. Sample volumes must be sufficient to allow all required testing, repeat testing if necessary, and at least 15 ml raw wastewater for archiving by CDC.

· Contractor is responsible for maintaining an adequate supply of testing kits and shipping materials to support the continuous flow of testing throughout the contract period.

· The contractor shall enroll and maintain testing with at least 250 wastewater facilities with a ramp up period of 2 weeks, increasing to 500 wastewater facilities within 3 months.

· The contractor will conduct testing of wastewater samples from at least 250 wastewater facilities and up to 500 facilities twice per week, producing 500-1000 test results per week.

· The contractor will deliver to CDC the test results within 36 hours of receipt of wastewater sample.

· The contractor shall work with CDC to enroll wastewater treatment facilities in communities without existing wastewater surveillance activities. The contractor shall have the capacity to work with communities across all 50 states and territories including federally recognized Indian tribes according to IHS. Participating facilities must be approved by CDC prior to the initiation of sample collection.

· The contractor shall conduct laboratory analysis to quantify SARS-CoV-2 RNA via reverse transcriptase quantitative polymerase chain reaction (RT-qPCR) or digital/droplet digital polymerase chain reaction (dPCR or ddPCR). The testing protocol must include measurement of recovery efficiency, matrix inhibition evaluation, and human fecal normalization that meet the requirements for the National Wastewater Surveillance System as described here: https://www.cdc.gov/healthywater/surveillance/wastewater-surveillance/testing-methods.html

· Required QA/QC controls include extraction blanks, negative controls, positive controls, standard curves (if using RT-qPCR), and data management policies.

· The contractor shall conduct SARS-CoV-2 sequencing that is appropriate for variant detection and shall submit the raw sequence data and sample metadata to NCBI within 10 days of sample receipt by the Contractor. Next generation sequencing that accounts for genome fragmentation, short reads, potentially high viral diversity, and the relatively low abundance of viral RNA, such as tiled amplicon approaches are acceptable. The sequencing method should ensure that there is not a drop in coverage for the S-gene. Metagenomic sequencing of total RNA or Sanger sequencing of amplicons is not appropriate/acceptable. Sequence analysis shall be conducted on up to one representative sample (individual or pooled) per week from each participating utility. Only samples that have sufficient SARS-CoV-2 concentrations (e.g., Ct value less than a pre- determined threshold) should be considered for sequencing.

· Sample remainders, including at least 15 ml of raw wastewater and any remaining extracted RNA will be shipped to the CDC Biorepository for archiving. Samples should be shipped at least monthly.

Facility Monitoring It is imperative that the contractor monitors the facilities for adherence to the testing schedule. The absence of data collection can impair the monitoring of tracking SARS-CoV-2 concentrations in sewage.

This is a voluntary program, and a facility may choose to no longer participate, or they may not have the resources to comply with the testing schedule.

· The contractor shall contact a facility when they miss a collection date.

· If a facility misses an entire week of sample collection, the contractor shall notify the project manager with a written correspondence of the interaction with the facility and whether the testing schedule has been resolved. If a contractor cannot contact the facility after three attempts, the contractor should notify the facility that they are being replaced in the program and the contractor shall replace non-responsive facility with a new facility to be selected in coordination with CDC.

· If a facility consistently misses sampling events, the contractor shall replace the non-responsive facility with a new facility to be selected in coordination with CDC.

Data Quality It is imperative that the data received from the contractor are error free and complete. This includes proper file type, proper file format, accurate column headings, consistent data standards, and accurate data. The program manager will notify the contractor if they find data quality issues. The contractor is responsible to isolate and resolve these issues. If the same issue occurs multiple times, the program manager may ask for a corrective action plan to resolve the issues. In the corrective action plan, the contractor will provide the steps to be taken to prevent the issue from re-occurring.

Contractor Program Management The Contractor shall manage their performance to ensure compliance with all requirements of the contract. The Contractor shall assign a Program Manager who will ensure the Contractor’s performance complies with all requirements and will be the primary point of contact for the work to be performed. The Program Manager shall have sufficient corporate authority to direct, execute, and control all elements of the task and ensure that all necessary management, business, contracts, engineering, implementation, and maintenance resources are available and sufficient, both in numbers and qualifications, to successfully perform all the tasks required by the contract.

The Contractor shall continuously monitor the performance of this contract, and of all subcontracts, to provide the Government with a timely assessment of program progress and problems and to control contract activities to include Subcontractor and/or vendor activities. This should involve the development and execution of a Communication Plan to include the methodology and approach for communicating status, issues, and risks to CDC through the COR and for communicating with stakeholders outside CDC.

Data Use All data generated through this contract are the sole property of CDC. The contractor may provide data reports to participating facilities with approval by CDC. Under no circumstances may Contractor use this data for purposes not explicitly described in this contract without prior written approval from CDC. Examples of prohibited uses include, but are not limited to, inclusion in research publications, data sharing with other public or private entities, or incorporation into marketing materials. The Contractor shall report to CDC, both verbally and in writing, any instance in which a sample or any other data obtained in connection with this contract is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under the Freedom of Information Act). The Contractor shall provide such report to CDC as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. If CDC determines that it shall respond directly, the Contractor shall cooperate and assist CDC in its response.

The Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the samples and that prevent use or disclosure of such data other than as provided for by this Contract. As soon as possible, but in any event no later than twenty-four (24) hours after Contractor becomes aware of a misuse or mis-disclosure not permitted under the Contract, the Contractor shall verbally report the Event to CDC with as much of the details as possible and shall follow such verbal report within three (3) business days with a written report outlining the misuse or mis-disclosure and shall provide any additional information as CDC may reasonably request. The Contractor acknowledges that samples subject to this contract are sensitive, and violations of this section shall be deemed a material breach of the Contract.

SECTION 4 – TASKS TO BE PERFORMED

Phase 0: Rapid ramp-up of testing deployment and establishment of data transfer protocols between Contractor and CDC DCIPHER data system.

Duration: The contractor must begin to continuously test as soon as possible. Within 2 weeks of contract initiation, contractor must have enrolled, provided sampling kits, and begin receiving wastewater samples from at least 250 wastewater facilities. Facilities participating in previous CDC testing contracts shall be given priority for enrollment with testing initiation as soon as possible after contract award.

1. Establish data reporting format and test data transfer protocols between Contractor and DCIPHER. Data transfer must be via a secure mechanism, such as a secure file transfer site or API. The format shall comply with the NWSS-DCIPHER data dictionary. Any additional fields necessary to comply with reporting shall be appended to the tail of the NWSS-DCIPHER dataset. (NWSS- DCIPHER data dictionary is available at https://www.cdc.gov/healthywater/surveillance/wastewater- surveillance/data-reporting-analytics.html#data-dictionary)

2. Enroll wastewater treatment plants in priority areas for the National Wastewater Surveillance System in coordination with CDC.

3. Utilize CDC-provided list of priority wastewater treatment plants to onboard at least 250 wastewater facilities in the first 2 weeks.

4. Provide training to wastewater facility staff on proper collection, packaging, and shipping of wastewater samples to the contractor. Sample collection and shipping protocols are provided. Shipping costs are covered by the contractor.

Phase 0 Deliverables:

· Kickoff Meeting within one week of contract award date

· Weekly status report that includes a list of facilities recruited, number of sampling kits shipped, timeline for testing initiation, and any issues that may delay successful completion of phase 0.

· Weekly project meeting with CDC contract management team

· Data submission template and test submission.

· Data dictionary

· Data collection instrument for required wastewater treatment plant metadata.

· List of facilities that are participating in this contract. Whenever there is a change of participating facilities, this file must be updated and delivered to CDC. This file shall include:

· Wastewater treatment plant name

· ZIP code of treatment plant

· Wastewater treatment plant jurisdiction (state, territory, or Tribal Nation)

· Population covered

· NPDES_ID

· County or Counties Served

· Meeting to review the laboratory processing and testing protocols and data analysis to ensure proper use of the data

· Laboratory protocol for sequencing for variant tracking including library generation, primers used, sequencing platform, quality control, and sample inclusion criteria for sequence analysis

Phase 1: Testing wastewater samples and reporting data for at least 250 wastewater facilities twice per week including quality assurance and quality control (QA/QC). Facility enrollment will continue until 500 sites have been enrolled, provided sampling kits and are submitting samples. All 500 sites should be enrolled within 3 months.

Duration: 3 months

1. Contractor will provide self-contained sampling kits and shipping materials to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples. Sample volume should be sufficient to conduct all required testing, allow repeat testing if needed and have at least 15 ml raw wastewater remaining for archiving at CDC.

2. Contractor conducts laboratory analysis to quantify SARS-CoV-2 RNA via reverse transcriptase quantitative polymerase chain reaction (RT-qPCR) or digital/droplet digital polymerase chain reaction (dPCR or ddPCR). The testing protocol must include measurement of recovery efficiency, matrix inhibition evaluation, and human fecal normalization that meet the requirements for the National Wastewater Surveillance System as described here: https://www.cdc.gov/healthywater/surveillance/wastewater- surveillance/testing-methods.html

3. Contractor implements QA/QC measures to ensure the validity of the reported data as described here: https://www.cdc.gov/healthywater/surveillance/wastewater-surveillance/testing-methods.html. Required QA/QC controls include extraction blanks, negative controls, positive controls, standard curves (if using RT-qPCR), and data management policies.

4. Contractor consistently reports quantitative data to CDC within 36 hours of sample receipt by the contractor.

5. Contractor provides regular data streams to DCIPHER, at a minimum of 2x/week.

6. Contractor generates SARS-CoV-2 sequence data that is appropriate for variant detection and submits the raw sequence data and sample metadata to NCBI within 10 days of sample receipt by the Contractor. Sequence analysis shall be conducted on up to one representative sample (individual or pooled that meets the predetermined criteria for sequence analysis) per week from each participating utility. Pooling of multiple weeks or across sites is not acceptable.

Phase 1 Deliverables:

· Quantitative SARS-CoV-2 data from a minimum of 500 and up to 1000 samples per week with a minimum data upload frequency of twice per week. Submitted data must be complete with all elements of the data dictionary included.

· Sequence data uploaded to designated NCBI database within 10 days of sample receipt by the Contractor for all samples meeting predetermined sequencing criteria.

· Weekly project meeting with CDC contract management team

· Weekly sequencing manifest with sequencing determination (i.e., whether samples meet criteria for sequencing), sample pooling, sequence submission date to NCBI, and NCBI sample accession number for all wastewater samples received by the Contractor.

· Biweekly testing performance report including QA/QC statistics, turnaround time, and percent of samples requiring repeat testing

· Monthly status report that includes a list of facilities participating, any issues with facility noncompliance with sample collection or shipping protocols, and contractor’s efforts to resolve issues

Phase 2: Testing wastewater samples and reporting data for 500 wastewater facilities twice per week including quality assurance and quality control (QA/QC).

Duration: 6 months

1. Contractor will provide self-contained sampling kits and shipping materials to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples. Sample volume should be sufficient to conduct all required testing, allow repeat testing if needed and have at least 15 ml raw wastewater remaining for archiving at CDC.

2. Contractor conducts laboratory analysis to quantify SARS-CoV-2 RNA via reverse transcriptase quantitative polymerase chain reaction (RT-qPCR) or digital/droplet digital polymerase chain reaction (dPCR or ddPCR). The testing protocol must include measurement of recovery efficiency, matrix inhibition evaluation, and human fecal normalization that meet the requirements for the National Wastewater Surveillance System as described here: https://www.cdc.gov/healthywater/surveillance/wastewater- surveillance/testing-methods.html

3. Contractor implements QA/QC measures to ensure the validity of the reported data as described here: https://www.cdc.gov/healthywater/surveillance/wastewater-surveillance/testing-methods.html. Required QA/QC controls include extraction blanks, negative controls, positive controls, standard curves (if using RT-qPCR), and data management policies.

4. Contractor consistently reports quantitative data to CDC within 36 hours of sample receipt by the contractor.

5. Contractor provides regular data streams to DCIPHER, at a minimum of 2x/week.

6. Contractor generates SARS-CoV-2 sequence data that is appropriate for variant detection and submits the raw sequence data and sample metadata to NCBI within 10 days of sample receipt by the Contractor. Sequence analysis shall be conducted on up to one representative sample (individual or pooled that meets the predetermined criteria for sequence analysis) per week from each participating utility. Pooling of multiple weeks or across sites is not acceptable.

Phase 2 Deliverables:

· Quantitative SARS-CoV-2 data from 1000 samples per week with a minimum data upload frequency of twice per week. Submitted data must be complete with all elements of the data dictionary included.

· Sequence data uploaded to designated NCBI database within 10 days of sample receipt by the Contractor for all samples meeting predetermined sequencing criteria.

· Weekly project meeting with CDC contract management team

· Weekly sequencing manifest with sequencing determination (i.e., whether samples meet criteria for sequencing), sample pooling, sequence submission date to NCBI, and NCBI sample accession number for all wastewater samples received by the Contractor.

· Biweekly testing performance report including QA/QC statistics, turnaround time, and percent of samples requiring repeat testing

· Monthly status report that includes a list of facilities participating, any issues with facility noncompliance with sample collection or shipping protocols, and contractor’s efforts to resolve issues

Phase 3: Final data cleaning and submission

Duration: 6 weeks

Phase 3 Deliverables:

· Weekly project meeting with CDC contract management team

· Final report

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

CDC will provide a list of at least 500 priority wastewater treatment facilities for enrollment. CDC will also provide written documentation that this work is part of the National Wastewater Surveillance System to support enrollment efforts.

SECTION 6 – PERIOD OF PERFORMANCE

The period of performance is 11 months, divided into three phases

· Phase 0 - 2 weeks

· Phase 1 - 3 months

· Phase 2 – 6 months

· Phase 3 – 6 weeks

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Quantitative SARS-CoV-2 data SARS-CoV-2 data with all required elements of data dictionary included

500- 1000/week in Phase 1 1000/week in Phase 2

SARS-CoV-2 sequence data Raw SARS-CoV-2 sequence data from samples meeting inclusion criteria uploaded to NCBI

SECTION 8 – REFERENCE MATERIALS

N/A

SECTION 9 – INFORMATION SECURITY

The below information complies with CDC Security and Privacy compliance requirements for E-Government Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA 2014) Security Compliance

· If the contractor will host or create an information system on behalf of the CDC, provide IT services to the CDC, or provide IT products to the CDC, then the contractor shall comply with the applicable IT security references below (Standards 1 - 2).

Standard-1: Procurements Requiring Information Security and/or Physical Access Security A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ x ] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ x ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Cybersecurity Program Office (CSPO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2) All contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting PII. To this end, all contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

3) All contractors and subcontractors shall participate in regular training on how to identify and report a breach.

4) All contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC and incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines.