Combined Synopsis Solicitation - 75D30123R72715 Amend 1.pdf

Solicitation - 75D30123R72715

Combined Synopsis/Solicitation - 75D30123R72715

Section A. GENERAL INFORMATION

General Information

Document Type: Combined Synopsis/Solicitation

Solicitation Number: 75D30123R72715

Posted Dated 7/27/2023

Response Date 8/21/2023 at 5:00 p.m. Eastern Time

NAICS 541511 - Custom Computer Programming Services $34.0 Million

Product or Service Code B506

Set Aside: None – Full and Competition

A.1.1 Purpose:

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal

Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for

Commercial Items,” as supplemented with additional information included in this notice. This procurement is being conducted FAR Part 13 Simplified Acquisition Procedures; therefore, competitive range determinations as provided for in FAR Part 15 Contracting by Negotiation, are not applicable under this FAR Part 13 acquisition.

This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

A.1.2 Solicitation Number:

The solicitation number is 75D30123R72715 and is being issued as a request for proposal (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC

2023-04.

A.1.3 NAICS Code:

The associated North American Industrial Classification System (NAICS) code for this procurement is 541511 -

Custom Computer Programming Services, with a small business size-standard of $34.0 Million. This procurement is full and open. Vendors must be registered in the System for Award Management (SAM) at http://www.sam.gov, in order to be considered for award.

A.1.4 Contract Overview and Period of Performance

ATSDR anticipates awarding one (1) Firm-Fixed Price contract from this solicitation. CDC anticipates the resulting period of performance will be 1 year with 4 option years from the effective date of the contract, a total of

5 years if all options are exercised. This contract includes the clause FAR 52.217-8, which if exercised, may add up to an additional 6 months to the contract in addition to the total of 5 years. The anticipated maximum Period of

Performance for this requirement is September 1, 2023, thru August 31, 2028.

A.1.5 Place of Performance

It is anticipated the performance of this contract will be completely offsite at the successful contractor’s location.

A.1.6 Points of Contact

David Smythe, Contracting Officer – Phone: 770-488-2782 – Email: Dsmythe@cdc.gov

A.2 Submission Information

A.2.1 FAR Provisions and Clauses

This requirement includes numerous provisions and clauses by reference. Vendors submitting a quote should review the full text located at www.acquisition.gov/FAR. This includes provision FAR 52.212-1 Instructions to

Offerors–Commercial Items (Section E) and clause FAR 52.212-4 Contract Terms And Conditions -

Commercial Items (See Section C). Some provisions that must be filled out and returned are attached, including

FAR 52.204-24 and FAR 52.212-3 Offeror Representations and Certifications -- Commercial Items. (Section

D)

A.2.2 Evaluation Key Factors

This requirement will be evaluated as discussed in Section E. This includes FAR 52.212-2, Evaluation --

Commercial Item. Technical Evaluation factors are listed in descending order of importance; however when combined, technical factors are significantly more important than price. These are listed below but full details are contained in Section E.4

● Technical Approach

● Staffing and Management Plan

● Similar Experience

● Past Performance

A.2.3 Price Proposal

See price proposal instructions in Section E.3.3

A.2.4 Question Submission

Questions: Questions are due 8/2/2023, Noon Eastern Time. All questions/inquiries must be submitted via email to the points of contact in A.1.6 contracting officer. Inquiries submitted via telephone will be redirected to an e-mail submission. Submit offers and/or any questions to the attention of David Smythe at

Dsmythe@cdc.gov. Questions will be answered by 8/7/2023 and responses will be posted to SAM.gov. Late questions may still be answered if the Contracting Officer elects and will also be posted timely.

A.2.5 Submission Requirements and Quote Due Date

Vendors shall submit the quotation package in its entirety to the Contracting Officer, David Smythe, via e-mail at dsmythe@cdc.gov. Vendors who fail to complete and submit the requirements of this combined synopsis/solicitation may be considered non-responsive. Proposals received prior to the RFP closing date and time, 8/21/2023 at 5:00 p.m. Eastern Time will be considered by CDC. Late proposals will not be accepted.

http://www.acquisition.gov/FAR mailto:david.smythe@gsa.gov

Table of Contents

Combined Synopsis/Solicitation - 75D30123R72715

Section A. GENERAL INFORMATION

Section B. SUPPLIES OR SERVICES AND PRICES/COSTS SUPPLIES AND SERVICES

B.1 Line Items

B.2 Services and Performance Work Statement

B.2.3 Description of Tasks:

Table 1. Deliverables / Schedule

B.2.5 IT Security and Privacy Considerations (Tailored language in bold):

C. CLAUSES AND PROVISIONS

D. CONTRACT DOCUMENTS

E. INSTRUCTIONS AND EVALUATION FACTORS

E.1 Provisions Incorporated by Reference

E.2 Provisions Incorporated in Full Text

E.3. Instructions for Submission

E.4. Evaluation

Section B. SUPPLIES OR SERVICES AND PRICES/COSTS SUPPLIES AND SERVICES

B.1 Line Items

The following is the proposed CLIN structure.

Base Period: September 1, 2023 – August 31, 2024

ITEM SERVICES QTY /

UNIT

UNIT PRICE EXTENDED

PRICE

0001 Aggregated Mobility Data Delivery &

Professional Services

See Section B.2.3 Description of Tasks

Firm-Fixed Price

Severable Services Line Item

Period of Performance: 9/1/2023 – 8/31/2024

12 Months

Option Period 1: September 1, 2024 – August 31, 2025

ITEM SERVICES QTY /

UNIT

UNIT PRICE EXTENDED

PRICE

1001 Aggregated Mobility Data Delivery &

Period of Performance: 9/1/2024 – 8/31/2025

Option Period 2: September 1, 2025 – August 31, 2026

UNIT

UNIT PRICE EXTENDED

PRICE

2001 Aggregated Mobility Data Delivery &

Period of Performance: 9/1/2025 – 8/31/2026

Option Period 3: September 1, 2026 – August 31, 2027

UNIT

UNIT PRICE EXTENDED

PRICE

3001 Aggregated Mobility Data Delivery &

- Period of Performance: 9/1/2026 – 8/31/2027

Option Period 4: September 1, 2027 – August 31, 2028

UNIT

UNIT PRICE EXTENDED

PRICE

4001 Aggregated Mobility Data Delivery &

- Period of Performance: 9/1/2027 – 8/31/2028

B.2 Services and Performance Work Statement

Title: Aggregated Mobility Data to Support CDC/ATSDR Public Health Priorities

B.2.1 Background:

The Centers for Disease Control (CDC)/Agency for Toxic Substances and Disease Registry (ATSDR) is seeking procurement of aggregated, anonymized population mobility data to support programmatic areas and public health priorities across the agency, including but not limited to estimating aggregate evacuation during natural disasters and environmental health emergencies; assessing potential population exposures to environmental health hazards; inferring physical activity, modes of travel, and population migration before, during, and after other public health events of interest (e.g., outbreak investigations); and visualizing aggregate population mobility trends. There is an ongoing need for aggregate, anonymous population mobility data and a software-as-service tool for internal CDC users to support emergency response operations and emerging public health research.

Examples include chemical exposure investigations that pose risks to human health, data modernization initiatives for various health behaviors, evaluation of health policies and community mitigation guidelines, and aggregate population movement and migration following international plane travel or other border crossing.

Mobility data are commercially available data derived from the location of mobile devices and wearables which have been aggregated over time or geography or both to create various metrics. These are the same data that private sector acquires and uses for various marketing purposes. All data are aggregated, anonymous, contain no personally identifying information (PII), and cannot be linked to individuals. Any general demographic information is inferred using underlying, publicly available US Census data. CDC/ATSDR will work with the

Contractor to ensure data anonymization and protection of PII by utilizing publicly available sources and ensuring consumer opt-in.

B.2.2 Purpose:

The purpose of this Contract is for CDC/ATSDR to acquire routine (i.e., daily, weekly, and/or monthly) access to timely, geographically representative, anonymous (i.e., no personally identifying information, cannot be tracked to individuals), aggregate (e.g. spatially, temporally, or both) data on population movement. This will provide general mobility trends and indicators that may create additional insights into aggregate population movement during emergency and non-emergency public health responses and activities.

The CDC/ATSDR intends to use Contractor’s aggregate, anonymous population mobility data, software and services acquired through this Contract to assess spatiotemporal trends of population mobility in the United States and beyond to evaluate the impacts of aggregate movement on disease transmission and other health outcomes.

CDC/ATSDR will use the data and tools to provide reports to US public health partners to support risk assessment, surveillance, preparedness, emergency response, and other public health activities.

B.2.3 Description of Tasks:

The Contractor shall provide the necessary capabilities and resources to support Tasks 1 - 3 detailed below:

B.2.3.1 Task 1: Aggregate, Anonymous Population Mobility Data

Contractor shall acquire and provide access to the necessary data to conduct public health research and response related to evaluating the impact of aggregate visitation to key points of interest such as parks and greenspaces; aggregate movement trends before, during, and after public health or environmental health emergencies; and other emerging research areas including those related to social vulnerability and health disparities. Aggregate data will be made available to approved internal CDC staff and will be accessed via secure, user-authenticated cloud-based tools. CDC will own and maintain analytic outputs produced during the period of performance after contract expiration.

The Contractor shall provide aggregate, anonymous population mobility data to CDC daily, weekly, or monthly (depending on data type). Contractor will provide access to the necessary data to support various public health research and response related to evaluating the impact of aggregate visitation to key points of interest such as parks and greenspaces, aggregate movement trends before, during, and after public health or environmental health emergencies, and other emerging research areas including those related to social vulnerability and health disparities.

The Contractor shall make the data accessible to CDC via Azure, Amazon Web Services, or other platform as a service tool. The Data shall be immediately available via script for export to secure, limited-access, CDC-hosted platform(s). CDC will own and maintain analytic outputs produced during the period of performance after contract expiration. The Contractor shall provide the following data to CDC:

General

• Sample query code and workbooks

• Access for up to ten (10) named CDC users at a time

• Data discovery and visualization tool for hypothesis generation

• Report on privacy-practices and privacy-enhancing data features

• Detailed methodology on metrics and indices creation

• Detailed codebook

• Ability to consume aggregated data queries into CDC statistical and visualization tools (i.e., R, SAS, ESRI ArcGIS Portal, Tableau, PowerBI)

Delivery

• Data delivered at regular intervals but no less frequently than monthly deliveries. Frequency of delivery will be as frequent as data are available, while still maintaining privacy requirements.

• Access to data via privacy-secured environments by user authenticated systems

Spatial Aggregation

• Census geometry aggregation (e.g., block group, tract, county, state) and associated GeoID

• Ability to use aggregate by custom geographic boundaries from shapefiles, polygon, raster image

• Points of interest (parks, shopping malls) including latitude/longitude (Note: requires temporal or industry aggregation)

• Industry aggregation (e.g., food service, grocery stores)

• Street segment or trajectories along road networks aggregated to privacy thresholds

• Data must meet privacy standards and be aggregated spatially, temporally, or both prior to export or visualization

Temporal Aggregation

• Data aggregated at a finest temporal scale available while still protecting privacy. Smaller geometric aggregates are expected to be at a smaller temporal scale (daily, if available). Conversely, larger geometric aggregates may be at a higher temporal scale, but at the smallest temporal scale available while protecting privacy

• Data latency would scale to data scale.

• Data must meet privacy standards and be aggregated spatially, temporally, or both prior to export or visualization

Privacy

• No personally identifying information (PII)

• No known user characteristics or demographics

• Transparent privacy practices including opt in/out language, disclosure of apps used

• Removal or geomasking of sensitive points of interest

• Small numbers policies (data not delivered if under 10 values)

Geographic Extent

• North America

• Additional countries/regions as available

Custom/Standard Metrics

• Aggregation of visitation to points of interest (POIs) (sensitive POIs removed)

• Aggregation of movement to census block groups

• Aggregated movement metrics around areas with environmental health hazards (e.g., superfund sites, PFAS sites)

• Population mobility flows from origin point of interest (i.e., airport) and destination (county or metropolitan area).

• Ability to infer movement speed to infer mode of transportation (cycling, walking, car, public transportation)

• Ability to define trips including distance traveled, speed, route, and categorization of origin and destination (e.g., work, home, POI)

• Ability to define custom metrics aggerated via a privacy-secure platform and/or in collaboration with data provider

• Evacuation metrics and routes (and associated rates of return) to areas impacted by natural disasters or emergencies

• Rates of relocation (origin and destination) for populations relocating residences at the national, state, and county level.

• Ability to select a custom baseline and calculate change from baseline

• Ability to stratify metrics by residence (i.e., bicycle trips taken in Fulton County by county residents or county visitors)

• Ability to infer trips/trajectories and characterize trip purpose by aggregated categories (e.g., travel to work, leisure)

• Aggregated indices and database that may be useful for public health research and practice

Key Data Features

• Historical data from Jan 1, 2016, through current

• Daily unique device counts at each level of data availability (e.g., country, county, census block group)

• POI identifier such as NAICS code or other industry identifier

• Geography identifiers (GEOID)

• Dwell Time

• Level of aggregation (spatial or temporal or both) for all data

• Geographic information (street segment, lat/log, census geometry, etc.)

• Temporal information (dwell time, timestamped, day/week/month/year)

• Inferred sociodemographic characteristics from US Census, American Community Survey or other public database

• Inferred device home/work locations aggregated to centroid of census geometry (e.g., census block group or tract)

• Aggregate counts of devices that travel between designated origin and destination (e.g., POIs such as airports and counties)

B.2.3.2 Task 2: Cloud-based Data Access via Hosted Platform

The Contractor shall provide CDC/ATSDR with on-going access to a named user authenticated Cloud-based

Platform Software as a service tool (PaaS) for a period of one (1) year as a service to support custom metrics and ad hoc requests for analysis. PaaS access, services, and support shall include the following:

• Data discovery to identify any new insights

• Custom geoset and points of interest

• Customized geographic resolution (i.e., census tract, block group)

• Hosted instance plus one node cluster

• Up to 10TB of storage

• Access for up to ten (10) CDC users at a time

• Onboarding plus a total of ten (10) hours of dedicated support over one (1) year

• Transparent privacy standards and privacy-enhancing features

• Privacy audits

B.2.3.3 Task 3: Professional Services

The Contractor shall provide CDC with ten (10) days (or 80 hours) of professional services over one (1) year to support ad hoc projects and help with customized data extraction and analysis. Professional services shall be provided by a team of one (1) Contractor professional who is qualified to meet CDC’s specific need(s).

Table 1. Deliverables / Schedule

No.

SOW

Task Description Availability Frequency

1 1 Indices Data Beginning no later than one week after contract award

Daily, Weekly, Monthly

(based on privacy)

2 1 Points of Interest Data Beginning no later than one week after contract award

Daily, Weekly, Monthly

(based on privacy)

3 1 Census Block Data Beginning no later than one week after contract award

Daily, Weekly, Monthly

(based on privacy)

4 1 County Data Beginning no later than one week after contract award

Daily, Weekly, Monthly

(based on privacy)

B.2.4 Period of Performance

The period of performance is anticipated to be a base of 12 months, with a possibility of no more than 4 option periods of 12 months each, for a maximum of 5 years.

B.2.5 IT Security and Privacy Considerations (Tailored language in bold):

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing

Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information

Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network, or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the

Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and

Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of

Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk

Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [X] Low [ ] Moderate [ ] High

Integrity: [X] Low [ ] Moderate [ ] High

Availability: [X] Low [ ] Moderate [ ] High

Overall Risk Level: [X] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or

Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled

Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately,

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB

Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the

Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and

[CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB

Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security

(TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module

Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information

Security Officer (OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer

(CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall reasonably assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for

Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall reasonably assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) To the extent applicable - Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor

Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security

Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) To the extent applicable - Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training

(RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant

Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) To the extent applicable, the Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”

(03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include

PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the

CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2) All contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting

PII. To this end, all contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

3) All contractors and subcontractors shall participate in regular training on how to identify and report a breach.

4) All contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and shall use best efforts to provide such notice no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC and incident management policy, and United States

Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer

Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative.

5) All contractors and subcontractors shall be able to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access

Federal information, and identify the initial attack vector.

6) All contractors and subcontractors shall allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with HHS/CDC Policy and the HHS/CDC Breach Response Plan and to assist with responding to a breach.

7) Cloud service providers shall use guidance provided in the FedRAMP Incident Communications Procedures when deciding when to report directly to US-CERT first or notify CDC first.

8) Identify roles and responsibilities, in accordance with HHS/CDC Breach Response Policy and the HHS/CDC

Breach Response Plan. To this end, the Contractor shall NOT notify affected individuals unless and until so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, all notifications must be pre-approved by the appropriate CDC officials, consistent with HHS/CDC

Breach Response Plan, and the Contractor shall then send CDC- approved notifications to affected individuals;

and,

9) Acknowledge that CDC will not interpret report of a breach, by itself, as conclusive evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

E. Position Sensitivity Designations

F. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential

Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS

HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the

COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

G. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise

Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the

HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the

EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or

COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or CDC policies.

6) The Contractor (and/or any subcontractor) shall perform and document the actions identified in the CDC Out-

Processing Checklist (http://intranet.cdc.gov/od/hcrmo/pdfs/hr/Out_Processing_Checklist.pdf) when an employee terminates work under this contract. All documentation shall be made available to the CO and/or COR upon request.

H. Records Management and Retention

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order

13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS policies and shall not dispose of any records unless authorized by HHS.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS policies.

HHS FedRAMP Privacy and Security Requirements

The Contractor (and/or any subcontractor) shall be responsible for the following privacy and security requirements:

1) FedRAMP Compliant ATO. Comply with FedRAMP Security Assessment and Authorization (SA&A) requirements and ensure the information system/service under this contract has a valid FedRAMP compliant (approved) authority to operate (ATO) in accordance with Federal Information Processing

Standard (FIPS) Publication 199 defined security categorization. If a FedRAMP compliant ATO has not been granted, the Contractor shall submit a plan to obtain a FedRAMP compliant ATO.

a. Implement applicable FedRAMP baseline controls commensurate with the agency-defined security categorization and the applicable FedRAMP security control baseline (www.FedRAMP.gov). The

HHS Information Security and Privacy Policy (IS2P) and HHS Cloud Computing and Federal Risk and Authorization Management Program (FedRAMP) Guidance further define the baseline policies as well as roles and responsibilities. The Contractor shall also implement a set of additional controls identified by the agency when applicable.

b. A security control assessment must be conducted by a FedRAMP third-party assessment organization

(3PAO) for the initial ATO and annually thereafter or whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

2) Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS) if so required.

3) Service Level Agreements. Add when applicable The Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and cloud providers and work with CDC to develop and maintain an SLA.

4) Interconnection Agreements/Memorandum of Agreements. Add when applicable The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of

Agreements/Understanding in accordance with HHS/CDC policies.

A. Protection of Information in a Cloud Environment

1) If contractor (and/or any subcontractor) personnel must remove any information from the primary work area, they shall protect it to the same extent they would the proprietary data and/or company trade secrets and in accordance with HHS/CDC policies.

2) HHS will retain unrestricted rights to federal data handled under this contract. Specifically, HHS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of HHS and hosted on contractor’s infrastructure, as well as maintains the right to request full http://www.fedramp.gov/ copies of these at any time. If requested, data must be available to HHS within one (1) business day from request date or within the timeframe specified otherwise. In addition, the data shall be provided at no additional cost to HHS.

3) The Contractor (and/or any subcontractor) shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with FedRAMP requirements and HHS policies.

4) The contractor shall support a system of records in accordance with NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36

CFR § 1236.20 & 1236.22 (ref. a), including but not limited to the following:

a. Maintenance of links between records and metadata, and

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

5) The disposition of all HHS data shall be at the written direction of HHS/CDC. This may include documents returned to HHS control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

6) If the system involves the design, development, or operation of a system of records on individuals, the

Contractor shall comply with the contract language herein related to “Requirements for Procurements

Involving Privacy Act Records”.

B. Security Assessment and Authorization (SA&A) Process

1) The Contractor (and/or any subcontractor) shall comply with HHS and FedRAMP requirements as mandated by federal laws, regulations, and HHS policies, including making available any documentation, physical access, and logical access needed to support the SA&A requirement. The level of effort for the

SA&A is based on the system’s FIPS 199 security categorization and HHS/CDC security policies and in accordance with the contract language herein related to “Procurements Involving Government

Information Processed on GOCO or COCO Systems”.

a. In addition to the FedRAMP compliant ATO, the contractor shall complete and maintain an agency

SA&A package to obtain agency ATO prior to system deployment/service implementation in accordance with the contract language herein related to “Procurements Involving Government

Information Processed on GOCO or COCO Systems”. The agency ATO must be approved by the

CDC Authorizing Official (AO) prior to implementation of system and/or service being acquired.

b. CSP systems must leverage a FedRAMP accredited third-party assessment organization (3PAO).

c. For all acquired cloud services, the SA&A package must contain documentation in accordance with the contract language herein related to “Procurements Involving Government Information Processed on GOCO or COCO Systems”. Following the initial ATO, the Contractor must review and maintain the ATO in accordance with HHS/CDC policies.

2) HHS reserves the right to perform penetration testing (pen testing) on all systems operated on behalf of agency. If HHS exercises this right, the Contractor (and/or any subcontractor) shall allow HHS employees

(and/or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with HHS requirements. Review activities include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

3) The Contractor must identify any gaps between required FedRAMP Security Control

Baseline/Continuous Monitoring controls and the contractor’s implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts. In addition, all gaps shall be documented and tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require remediation at the contractor’s expense, before HHS issues an ATO.

4) The Contractor (and/or any subcontractor) shall mitigate security risks for which they are responsible, including those identified during SA&A and continuous monitoring activities. All vulnerabilities and other risk findings shall be remediated by the prescribed timelines from discovery: (1) critical vulnerabilities no later than thirty (30) days and (2) high, medium and low vulnerabilities no later than sixty (60) days. In the event a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they shall be added to the designated POA&M and mitigated within the newly designated timelines For all system-level weaknesses, the following are specified mitigation timelines from weakness creation date in the POA&M:

a. 30 days for critical weaknesses;

b. 60 days for high weaknesses;

c. 180 days for medium weaknesses; and

d. 365 days for low weakness.

e. HHS will determine the risk rating of vulnerabilities using FedRAMP baselines.

5) Revocation of a Cloud Service. HHS/[CDC/OCIO] have the right to take action in response to the

CSP’s lack of compliance and/or increased level of risk.