75D301-23-R-72632 Rev. 1.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

75D301-23-R-72632

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

6. REQUISITION/PURCHASE NO.

00HCUCGB-2023-73802

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and handcarried, in the depository located in 2:00pformtext until local time 05/1/2023 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Adam Dwyer

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

C. E-MAIL ADDRESS

Oel3@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

Development of a simulation model in accordance with the Statement of Work.

Period of Performance: 07/01/2023-06/30/2025

This is a firm fixed price, non-severable line item.

1 Job

Section C - Description/Specification/Work Statement Title: Developing a web-based systems science simulation model to evaluate the health and economic impact of policies/programs related to social determinants of health to reduce disparities in diabetes

SECTION 1 – BACKGROUND

Diabetes is a serious public health issue in the United States. In 2019, more than 37 million Americans had diabetes, about 11.3% of the U.S. population and 90-95% of them have preventable type 2 diabetes. Disparities of diabetes and its complications exist across communities and populations and are closely linked with social, demographic, environmental, and geographic factors. For instance, diabetes and its complications such as nephropathy, retinopathy, and cardiovascular disease is more prevalent among racial/ethnic minority groups, persons with an education level less than high school, and low-income populations. Reducing disparities and achieving health equity are critical for public health in this country. Therefore, it is important to understand the causes of the disparities and the mechanisms through which various factors affect these disparities.

Disparities in diabetes and its complications are not driven by a single factor but arise from a complex interplay of connected pathways and systems often rooted in the presence of unequitable polices, practices, and conditions. One such set of pathways are the social determinants of health (SDOH), defined by the Centers for Disease Control and Prevention (CDC) as “conditions in the places where people live, learn, work, and play that affect a wide range of health, functioning, and quality-of-life outcomes and risks.” Inequities in living and working conditions where people reside (e.g. access to healthy food and nutrition, affordable housing and health care) directly impact the biological and behavioral outcomes associated with diabetes prevention and management. Disparities in diabetes and its complications can be addressed at multiple levels: from individual level to community level, and to the society level. Operating from a SDOH perspective, the approach addressing the disparities shifts from an approach focusing on downstream factors that influence individual health and behaviors towards one that emphasizes upstream social-economic conditions and environments such as income, education opportunities, access to affordable housing and food security.

The U.S. Department of Health and Human Services’ Healthy People 2030 highlights the importance of addressing SDOH by including “social and physical environments that promote good health for all” as one of the four overarching goals for the next decade. The key priorities of CDC’s National Center for Chronic Disease Prevention and Health Promotion (NCCDPHP) support this charge by focusing on advancing health equity and addressing systemic factors that drive inequity in health outcomes through SDOH, such as built environment, community-clinical linkages, food insecurity, and social connectedness. Policies and interventions that address these SDOH areas include:

(1) Built environment programs and policies that facilitate access to transportation of varying types and physical resources that enhance quality of life, minimize exposure to environmental contaminants, and support physical activity, safe recreation, and other protective factors;

(2) Clinical-community linkages strategies that bring together public health, health care, and community-based organizations to address inequities in access to, utilization, and quality of preventive and chronic care services in local communities;

(3) Food and nutrition security programs and policies that can improve access to, and affordability of, safe and sufficient food to meet people’s dietary needs and food preferences;

(4) Social connectedness strategies that improve the diversity of relationships and create a sense of belonging, shared identity, and being cared for, valued, and supported;

(5) Economic and other programs and policies that improve people’s income and employment opportunities that may impact one’s ability to meet health needs and prevent diabetes (e.g., tax credit, cash transfer payments, livable wage and employment policies). Additionally, housing policies (e.g., low-income housing tax credits, inclusionary zoning, and eviction policies) that improve housing stability may also impact a person’s ability to engage in health-promoting behaviors and medication adherence (e.g., insulin must be refrigerated).

Policies/programs that address SDOH can reduce disparities in diabetes and its complications and achieve health equity. However, no single policy can address the issue and achieve the goal, and SDOH factors are not independent and usually interconnected. Policies/programs can affect disparities in diabetes and its complications at multiple levels and through multiple mechanisms and pathways. In addition, feedbacks loops exist between social economic circumstances and health disparities. For instance, income disparity may affect health disparities in diabetes, and health disparity in diabetes may also change income disparity.

There is a growing recognition that traditional reductionist approaches such as regression and randomized controlled trials may not be sufficient to understand or address the health disparities resulting from the interactions among social economic conditions, environments, behaviors at multiple levels and over time, and that a systems science approach can be a better way to address this complex issue. A systems science approach mimics the characteristics of a complex system such as interrelations between multiple components in one system, players at multi-levels (e.g. individual, environments, community), and dynamic with feedback, which provides a more accurate depiction of the real world. Simulation modeling using a systems science approach can estimate the effect of different scenarios where various interventions alternatives could be tested for their capacity to reduce health disparities. Since it usually has multiple interventions in one model, one can compare which intervention is most effective or cost-effective at reducing health disparities in diabetes and its complication outcomes, or understand under what conditions an intervention can achieve the highest effectiveness. This modeling approach can also facilitate the combination of SDOH factors into one model and takes into account the interdependence and interactions of those factors at multi-levels. By incorporating dynamic and feedback between SDOH and health disparity, the simulation model using systems science approach can improve the understanding of the complex causal pathways.

Systems science approaches have been widely used in public health research and they have been used to answer public health questions in the fields of infectious disease, obesity, tobacco control, and other chronic diseases. However, limited research has focused on addressing disparities particularly through the SDOH lens. There has been a growing call for using complex systems science approach to address health disparities within the SDOH context. Although systems science approaches have been used in some existing CDC chronic disease simulation models (e.g. PRIMS model), those models neither addressed health disparities in outcomes associated with diabetes and its complications nor social determinants of health. In addition, the complexity deriving from multiple levels of SDOH, multiple causal pathways linking each determinant to outcomes, the intersections of these levels, and the potential feedback relationships between all of these factors call for a new and separate model to simulate this complex system through the lens of the SDOH. In this contract, we aim to fill this research gap by developing a new web-based systems science simulation model to focus on evaluating the health and economic impact of policies/programs related to social determinants of health to reduce disparities in diabetes and its complications.

SECTION 2 – PURPOSE

The purpose of this project is to apply a systems science approach to a build simulation model of the interplay of SDOH factors and their relationships with type 2 diabetes and its complications as well as their associated risk factors such as body-mass-index (BMI), diet and physical activity levels, controls of glucose, blood pressure and cholesterol. The model shall include policies and programs that have significant impacts on diabetes and diabetes-related complications but within the following five NCCDPHP SDOH priority areas: (1) built environment, (2) community-clinical linkages, (3) food insecurity, (4) social connectedness, (5) economic or other more upstream factors that address sociocultural issues to improve SDOH. Policies/programs and priority areas selected shall be based on magnitude of the impact on reducing disparity in type 2 diabetes and its complications, strength of the evidence, and feasibility of the policies/programs implementation in a large scale. The model shall be able to demonstrate the interrelated relationship between SDOH factors, and their relationship with type 2 diabetes and its complication, as well as their risk factors by sub-population group in which disparities exist such as socioeconomic status, race/ethnicity or urbanicity in a single model system.

SECTION 3 – SCOPE OF WORK

The contractor shall build a user-friendly complex computer simulation model that is able to:

1) Assess the long term effectiveness and cost-effectiveness of the existing and hypothetical policies/programs that address SDOH factors for the purpose of reducing disparities in diabetes. The effectiveness is measured in both primary and secondary outcomes. The primary outcomes are incidence and prevalence of type 2 diabetes, incidence and prevalence of all major diabetes-related complications including hear diseases, stroke, amputations, renal diseases, eye diseases, depression and mortality, changes in risk factors of type 2 diabetes and its complications, and disparities in those outcomes. The secondary outcome includes the quality-adjusted life-year (QALY). The cost outcome includes costs of the intervention and future costs avoided for the health care system cost and society as a whole. All the outcomes should be assessed by overall population and subgroups in which disparities exist such as race and ethnicity group, sex, socioeconomic status, health insurance status, and places to live such as rural-urban settings. The cost-effectiveness is measured as costs per unit change in disparities associated with primary and secondary health outcomes between subpopulation groups.

2) Evaluate the contribution of an individual and combined SDOH factors on disparities in incidence and prevalence of diabetes and its complications and QALYs. Applicants shall demonstrate which one or combined efforts to improve SDOH factor would contribute the most and least to reduction of disparities between subpopulation groups in diabetes and its complications and QALYs. Applicants shall also demonstrate which efforts to improve SDOH is the most/least cost-effective in reducing existing disparities in incidence and prevalence of diabetes and complications;

3) Demonstrate causal pathways how SDOH factors link to risk factors of type 2 diabetes and its complications as well as the mechanisms through which SDOH factors impact existing disparities across sub-population groups in those outcomes.

The modeling methods could be, but are not limited to microsimulation, agent-based modeling, network analysis, system dynamic modeling, Markov modeling, and discrete-time modeling.

To build the simulation model, the contract shall:

(1) Conduct a thorough literature review of existing SDOH simulation models related to chronic disease including diabetes, with the key objectives focusing on the purpose, structure, strengths, and weakness of the models and the data sources used for developing modules/components, and identifying state-of-art modeling methodologies that can be readily adopted for building the simulation model in this request for proposal;

(2) Design a simulation model that is capable of modeling interplays of multiple SDOH factors, risk factors of diabetes and its complications, incidence and prevalence of diabetes and its complications, QALYs, and changes in costs across sub-population groups;

(3) Obtain the parameters/equations needed for the model from published literatures. If not available, obtain the most appropriate data, both available publicly and not available publicly, to estimate the parameters/equations;

(4) Specify an algorithm used to link all the mathematical equations in the model.

(5) Specify the programming language for the simulation model.

(6) Build a web-based simulation model that can be installed and operated on a FEDRAMP compliant cloud environment.

(7) Ensure the web-based platform meets the technical and security standards for the CDC platform.

(8) Provide a run book that includes written procedures for the IT administrators for installation and deployment.

(9) Validate and calibrate the model, following the guidelines recommended by professional organizations;

(10) Develop complete documentation for the model, including a technical report that describe the modeling methods, data sources and model validation results, and a user manual.

(11) Develop and publish one peer-reviewed manuscript descripting the design, implementation, and validations of the simulation model.

SECTION 4 – TASKS TO BE PERFORMED

Task 1: Conduct a literature review of existing SDOH simulation models:

Within 3 months of contract award, the Contractor shall conduct a detailed review, including published literature and other appropriate sources (e.g., websites, informative interviews), to document and evaluate the existing SDOH simulation models in the area of chronic diseases using systems science approaches. Immediately following 3 months of the receipt of the contract, the Contractor shall submit to the CDC COR a written report that includes the results of the review. Specifically, the report shall include at least the following components for each reviewed model:

1. Purpose of the model.

2. Types of the model.

3. Policies and interventions evaluated by the model.

4. Geographic setting of the model.

5. Outcome produced by the simulation.

6. Structure of the model, including modules and components within each module.

7. Theoretical justification of the model.

8. Underlying mechanism for interactions of SDOH and causal pathways through which SDOH influence diabetes risk factors, diabetes incidence and prevalence, and their disparities, etc.

9. Algorithms for combining each module.

10. Sources and characteristics (demographic, socioeconomic, and health) of the baseline dataset.

11. Model diagrams.

12. Simulation methods/approaches used.

13. Whether and how to incorporate a time element into the simulation.

14. Outcome measurements and their data sources.

15. Programming language used to program the model.

16. Methods to handle uncertainties.

17. Validation of the model.

18. Strengths and weakness of the models.

19. Summary of the reviewed models

20. Recommendations for advancing the field of simulation modeling using systems science approaches for food/nutritional policies.

Task 2: Convene an external scientific evaluation panel (ESEP) for developing the simulation model:

Within 3 months of contract award, the Contractor shall identify 3-4 national/international experts in various aspects of simulation modeling and with expertise in SDOH of diabetes to form an External Scientific Evaluation Panel (ESEP) for the development of the diabetes SDOH model. Throughout the project period, the Contractor shall convene three video conferences or webinars with the members of the ESEP and CDC project team, with the first meeting convening within 4 months of contract award, second one within 14 months of the award and the last one within 21 months of the award. The Contractor shall arrange all the logistics for the video conference or webinar.

Task 5: Final work plan:

Within 5 months of the receipt of the contract, but after the first ESEP meeting, the Contractor shall submit the final detailed work plan that reflects the recommendations made by the ESEP and CDC COR on: the type of model; justifications of the model selection; SDOH interventions or policies/programs to be evaluated; structure of the model; health and cost outcome measurements; source for baseline-data set; simulation method; mathematical equations and parameters used for simulation; data sources that will be used for developing key mathematical equations, algorithms and parameters; programming languages for developing the model; computing environments required for running the model; method to handle uncertainty; and methods to validate the model.

Task 6: Design, build, and program the simulation model:

Upon the completion of the literature and model reviews and guided by the final agreement of the CDC COR and ESEP, the Contractor shall design and build a simulation model which is flexible and comprehensive in evaluating the health and economic impacts of existing and hypothetical SDOH policies/programs for reducing disparities in incidence and prevalence of diabetes and diabetes-related complications and mortality.

The developed model shall have the following analytical capacity (also see the description in the scope of work section):

1. Estimate long-term (>= 5 years) incidence and prevalence of diabetes and its complications, and their disparities without and with one or multiple SDOH policies/programs.

2. Estimate long-term (>= 5 years) changes in risk factors of diabetes and its complications, life years, QALYs, and their disparities without and with one or multiple SDOH policies/programs.

3. Estimate long-term (>= 5 years) changes in costs with and without multiple SDOH policies/programs.

4. Estimate and rank the cost-effectiveness of implementing one or more existing and hypothetical SDOH policies/programs as measured by cost per unit change in disparities by each health outcome.

5. Estimate and rank the contribution of individual or combined SDOH factors that would reduce the disparities in incidence and prevalence of diabetes and its complications.

6. Demonstrate causal pathways how SDOH factors link to risk factors of type 2 diabetes and its complications as well as the mechanisms through which SDOH factors impact existing disparities across sub-population groups in those outcomes.

7. Be able to handle various types of uncertainties such as those associated with model structure and model parameters (also see the descriptions below on statistical properties).

The model shall be capable of simulating the interaction of existing and/or hypothetical SDOH interventions, policies/programs with risk factors of diabetes and its complications, incidence and prevalence of diabetes and complications, and their disparities, and estimating the gap between trajectories of the baseline scenario and an alternative under evaluation.

The model shall be capable of aggregating simulation outcomes at individual level to produce population-wide estimates of the impact of the existing and hypothetical SDOH interventions and policies if the final simulation model is an individual based model.

The model shall be capable of producing desired statistical properties of simulated outcomes such as confidence intervals, capable of performing formal post-simulation statistical testing, and be capable of performing both probabilistic and non-probabilistic sensitivity analyses for all analyses listed above.

The model shall consist of at least the following elements: a baseline dataset consisting of a target population or data used to parameterize the model, model diagrams that illustrates causal pathways of multiple SDOH to diabetes risk factors, diabetes and individual diabetes complications, mortality and their disparities, corresponding model parameters, and executable computer program that implements the simulation.

The model shall be programmed in a computer language that is compatible with most common operating systems. Candidates for the programming language include but not limited to C++, Python, Java, or R. While there is no restriction on how the model will be programmed, the final platform of the model must also be simple enough for end users who were not involved in the development of the model to run the model as instructed by the user manual. Within 21 months of the receipt of the contract award, the Contractor shall submit and install a beta version of the model that is operational in CDC’s cloud environment. Software design and development must the best practice in the field and needs to be 508 compliance. The model should also meet the security requirements by the CDC IT system before the installation. Within 21 months of the receipt of the contract award, the Contractor shall submit the documentation of the model. Within 23 months of the receipt of the contract award, the Contractor shall install the final web-based simulation models on CDC network. CDC will test the model and the contractor shall fix any bugs or other problems identified by the tester.

Task 7: Model validation and model recalibration:

Within 18 months of receipt of the contract award, the Contractor shall complete validations of the developed models. However, validation of the specific module/segment of the model shall be performed under the guidance of the CDC COR and ESEPs. The procedure used for the internal and external valuation shall be consistent with existing literature and recommendation from professional organizations on simulation models.

Within 20 months of receipt of the contract award, the Contractor shall complete recalibration of the updated model if needed. The Contractor shall recalibrate the model if the results generated by the model are significantly different from the results of observed data or official population projections.

Task 8: Develop model-related documentation and publications, including progress report, technical reports, user manuals and one journal article:

Within 21 months of receipt of the contract award, the Contractor shall prepare and submit to the CDC COR a draft technical report. Within 21 months of receipt of the contract award, the Contractor shall prepare a draft user manual. The manual shall include instructions for the entire model including all associated modules. The instructions provided in the manual shall be easy to follow, clear and in detail. The instruction shall also be written in non-technical language and plain English.

Within 21 months of receipt of the contract award, the Contractor shall develop one draft manuscript for peer-reviewed publications for CDC review. The manuscript shall describe the design, methods, and validation for the SDOH simulation model and be in the appropriate format for peer reviewed publication.

The Contractor shall develop at least one final manuscript for peer-reviewed publications that is ready for CDC clearance within 23 months of the date of award.

Within 24 months of receipt of the contract award, the Contractor shall prepare and submit to the CDC COR the final technical report that describes the computational algorithms, parameters, and all data used in the model (see the table of deliverables for the completion dates for the draft and final reports). The report shall include technical descriptions for all associated modules. The technical report shall include the algorithms, all mathematical equations/parameters used in the model, and methods and data sources used for estimating the mathematical equations/parameters. The technical report shall also include the procedures used for the internal and external validations and the results of the validations. The technical report shall be written in sufficient detail to allow other SDOH modelers to duplicate the model results based on the information provided.

Within 24 months of receipt of the contract award, the Contractor shall provide all the programming codes used in the software and the documentation of the codes. A report/document that describes the structure and organization of the programming code shall also be provided. The final programmed model shall be bug free and efficient in running time.

Within 24 months of receipt of the contract award, the Contractor shall prepare a detailed and final user manual that provides step-by-step instructions on how to run the models (see the table of deliverables for the completion dates for the draft and final manuals).

Task 9: Monthly progress reports:

The Contractor shall prepare monthly progress reports detailing work accomplished during each month, problems encountered and recommendations for solving problems identified in the reporting period, activities planned for the next month, and special items of interest. The purpose of these reports is to keep appropriate Government managers apprised of the current status of significant work activities under the Work Authorization. These reports shall document the progress of the project.

The Contractor shall deliver electronically a monthly progress report in Word format. The contractor shall also prepare a financial summary report and invoice associated with deliverable. Charges shall not exceed the authorized cost limits for labor and other direct costs (ODCs). The Government will not pay for work that cannot be validated. These reports shall include:

1) A summary of the progress made under the contract during the reporting period, An explanation of any technical and/or schedule problems which may have occurred or are expected to arise. The description of any differences between planned and actual technical progress shall include a statement of why the differences occurred or why they are expected to occur and what remedial or alternative actions are planned or recommended. This may include any recommended action by the Government to assist in the resolution of a problem;

2) Actual versus planned level of effort broken down by individual(s), including cumulative expenditures incurred.

3) Projected activities and costs for the next reporting period; and

4) Minutes of status review meetings, if any.

Task 10: A detailed staffing plan

The Contractor shall provide a detailed staffing plan, including (1) Representative resumes (limited to 10 pages) for members of the project team, their role and technical expertise to be used for this project, and hours used in this project as well as percent time of their time used on this and other projects. The key project members shall include persons with expertise and a minimum of 3-years experience in the following areas: disease simulation modelling, SDOH/health disparity research related to chronic disease/diabetes prevention and control, a chronic disease/diabetes epidemiology, economist evaluations, web-based software development/programing; (2) hours devoted to the project for each team member and how the team will interface with CDC project team, as well as descriptions of methods used to recruit professional and technical staff as staff turnovers occur; and (3) a clear delineation of staff authorities and line of responsibility with special emphasis on relationships with subcontractors, other contractors, and CDC partners.

The Contractors shall provide a management plan that describes its approach for managing the work outlined in this contract by demonstrating its understanding of the labor requirements listed. Contractors shall provide (1) a detailed description of how conflicts are managed; (2) a plan to ensure client satisfaction; and (3) a measurement of fiscal responsibility and accountability paying particular attention to the deliverable timeline in this task order.

This criterion will be evaluated according to the soundness, practicality, and feasibility of the contractor’s staffing plan for this contract.

In addition to the reports and deliverables required by the Statement of Work, the Contractor shall prepare and submit each of the following reports:

Regularly Scheduled Meetings;

Minutes of the project meetings shall be prepared by the Contractor and provided electronically within five business days to all participants. Progress will be monitored by the COR..

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

No materials will be supplied

SECTION 6 – PERIOD OF PERFORMANCE

The performance period will be July 1, 2023 through June 30, 2025.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Timeline of Task/Activities over proposed project duration.

Items: Tasks/

Activities Description

Within 3 months of the date of award.

Within 3 months of the date of award.

COR

Within 4 months of the date of award.

Within 3 months of the date of award.

COR

*All timeframes are indicated from time of award

SECTION 8 – PAYMENT TERMS

Fixed Price with payment plan to be proposed by vendor as part of proposal.

SECTION 9 – SPECIAL CONSIDERATIONS

Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats is available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Requirements for Information Security and/or Physical Access Security Information Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed..

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality:

[X] Low [ ] Moderate [ ] High

Integrity:

Availability:

Overall Risk Level:

[X] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR and ISSO within 30 days of contract award.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the CDC SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff.