RFQ 75D301-26-Q-00146 Amendment 2.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

PAGE OF PAGES

1 45

2. AMENDMENT/MODIFICATION NO.

00002

3. EFFECTIVE DATE

09/03/2026

4. REQUISITION/PURCHASE REQ. NO.

000HCRDB-2026-00146

5. PROJECT NO. (If applicable)

6. ISSUED BY CODE 15948 7. ADMINISTERED BY (If other than Item 6) CODE

OFR - Office of Acquisition Services

Chamblee Campus Building 108

4770 Buford Highway

Atlanta, GA 30341-

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

X

9A. AMENDMENT OF SOLICITATION NO.

RFQ 75D301-26-Q-00146

9B. DATED (See Item 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (See Item 13)

CODE FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEGMENT

TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT

IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

This solicitation amendment is issued to update the PWS to include English and Spanish options as indicated in Question #270. This amendment also provides an answer to Question #116.

Howard D Bish

Contracting Officer uwo8@cdc.gov

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME OF CONTRACTING OFFICER

Howard D Bish

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED

16B. UNITED STATES OF AMERICA

BY ___________________________________________

(Signature of Contracting Officer)

16C. DATE SIGNED

NSN 7540-01-152-8070 STANDARD FORM 30 (REV. 10-83)

PREVIOUS EDITION UNUSABLE 30-105 Prescribed by GSA

FAR (48 CFR) 53.243

ITEM 10A.

9/3/2026 mailto:uwo8@cdc.gov

RFQ 75D301-26-Q-00146

Modernized Application for Consumer and Healthcare Provider VAERS Reporting

Questions and Answers

1. Intelligent completion assistance (PWS Section 2; Task 1). Does the Government envision the

"intelligent validation that assists with form completion, answers user questions, and supports site navigation" as a conversational/AI-assistant component, or as rules-based intelligent form validation and contextual guidance? If AI-based approaches are acceptable, may the application leverage CDC's existing FedRAMP-authorized Azure OpenAI services (e.g., via the EDAV environment) rather than introducing new AI services?

Rule based form validation and AI for contextual guidance. Yes on EDAV or other FedRAMP authorized provider.

2. Relationship to existing VAERS contracts (PWS Section 3). The PWS directs coordination with

"other existing contracts supporting the VAERS system." Please confirm this requirement is a new capability with no incumbent contractor performing this scope, and briefly describe the division of responsibilities between this contract and the existing VAERS support contracts.

This is a new capability with no incumbent contractor performing this scope of work.

Contract: #75D30124F19979

Contractor: General Dynamics Information Technology, Inc (GDIT) Provides technical and programmatic support services to collect and analyze information on vaccine adverse events (VAEs) and facilitate reporting to VAERS.

Contract: # 75D30126C20929

Contractor: EEC-Lukos JV, LLC

Provides CDC with a ready source of clinical, scientific, and technical services for the review, abstraction and revision/updating of Medical Dictionary for Regulatory Activities (MedDRA) coding of VAERS reports and associated medical records.

3. Page-limit treatment of required plans (Section F; CDCL.03/CDCL.10). Please confirm that the

Data Management Plan and the AI Compliance and Risk Management Plan are excluded from the

15-page Technical Proposal limitation, and identify where the CDCH.10 template referenced in

CDCL.03 may be obtained.

The 15-page limitation applies to the Technical Proposal. All other items may be submitted as attachments and are not counted towards the 15-page limit. Resumes can be submitted as an attachment and do not count against page limit.

4. Prototype (Tab 2-2). Please confirm that the prototype may be hosted on offeror-provided infrastructure using synthetic data only, and state how long after the submission deadline the prototype link must remain accessible for evaluation.

Confirmed. The prototype may be hosted on offeror-controlled infrastructure using synthetic/non-production data only. The link must remain live and unchanged through the conclusion of evaluation; offerors will be notified if earlier release is appropriate.

5. Paperwork Reduction Act. The PWS notes the branching-logic form and new survey instruments may trigger PRA review. Please confirm that PRA clearance activities are a Government responsibility and describe how PRA timelines are expected to interact with the DOA+90-day beta and DOA+150-day production milestones.

Yes, it’s a government responsibility and we will work with the awardee to address timeline changes where appropriate.

6. Question: Section F establishes a 15-page limit for the Technical Proposal and excludes cover pages, tables of contents, and resumes. The solicitation separately requires a Data Management Plan (per CDCL.10, evaluated under CDCM.03) and an Artificial Intelligence Compliance and Risk Management Plan (per CDCH.10 and CDCL.03, evaluated under CDCM.04), but neither appears in the Technical Volume tab structure in Section F. Please confirm whether the Data Management Plan and the AI Compliance and Risk Management Plan (a) count against the 15-page Technical Proposal limit, or (b) should be submitted as separate attachments outside the page limit.

See answer to Question 3.

7. Will the Government consider offerors whose relevant experience consists primarily of commercial software modernization and custom application development projects, provided they can clearly demonstrate the technical capability to perform the work? Or is prior experience performing similar work specifically for the CDC or another Federal agency expected to be a significant evaluation factor?

Yes. Relevant commercial or non-federal experience demonstrating comparable technical complexity, healthcare workflows, and regulatory/PHI-PII requirements will be considered under the Similar Experience factor.

8. Additionally, is the Government open to proposals from newly established small businesses that demonstrate strong technical capability and a credible execution approach, even if they have limited federal prime contract past performance?

Yes. The Government will evaluate demonstrated technical capability and credible execution approach; extensive federal prime experience is not a mandatory prerequisite.

9. Scope of security authorization: ATD versus ATO.

PWS Section 5 and the stated objective describe the contractor producing security and privacy documentation sufficient for CDC, in coordination with OCIO, to issue an Authority to Develop. Section 11 also references an Authority to Operate, and the Standard 3 and Standard 4 requirements describe a full Security Assessment and Authorization package due within 120 days of the planned go-live date, including SSP, SAR, POA&M, contingency plan and test, E-Authentication assessment, and penetration test results.

A development environment for the new VAERS user interface can be established within CDC’s OCIO-hosted infrastructure using authorized software under a Change Request (CR). Once all requirements are documented, a change request can be completed within weeks. Those requirements include items such as identification and documentation of software, architecture, configurations of products, vulnerability scans (once stood up), firewall rules, etc. package. Government will provide existing information, as applicable.

Awardee is responsible for updating the security and privacy documentation package.

10. Please confirm the contractor's responsibility. Specifically, is the contractor deploying into CDC's existing FedRAMP-authorized Azure environment and producing documentation to support CDC's issuance of the ATD and ATO, or is the contractor responsible for obtaining a separate system authorization, including any third-party assessment organization involvement?

See answer to Question 9.

11. Placement and page treatment of required standalone plans.

Section L identifies the Volume I structure as Tab 1 Executive Summary, Tab 2 Technical Approach, Tab 3 Management Approach, and Tab 4 Similar Experience, subject to the 15-page limitation. Separately, the solicitation requires a Data Management Plan, an Artificial Intelligence Compliance and Risk Management Plan, an Incident Response Plan, and a Section 508 Accessibility Conformance Report.

See answer to Question 3.

12. Please confirm where these documents should be placed in the quotation, and whether they are excluded from the 15-page limitation in the same manner as cover pages, the table of contents, and Key Personnel resumes.

See answer to Question 3.

13. Final delivery date. The deliverables schedule lists the Testing and Final Release (Production-Ready) deliverable as due both "DOA + 150 days" and "by end of period of performance." Please confirm which date governs.

No separate option CLIN exists in Section B. Offerors are advised to rely on the solicitation as written; no separately priced option period is required. DOA + 150 days governs.

14. Option to extend services.

FAR 52.217-8, Option to Extend Services, is incorporated, and FAR 52.217-5 provides that option prices are added to the total for evaluation. The schedule does not include a priced option line item. Please confirm whether offerors should price an option period, and if so, in what format.

FAR 52.217-8 is removed from the solicitation and will not be included any resulting award. This requirement is considered to be for nonseverable services which means that it is a specific entire job or undertaking, resulting in a defined end product, and provides value to the Government only at the time the entire job is completed.

15. Vulnerability remediation timeframes.

The POA&M requirements state remediation timeframes of 15 days for critical and 30 days for high findings, with medium findings shown as 60 days in one section and 90 days in the vulnerability management and cloud sections. Please confirm the governing timeframe for medium findings.

It is recommended to use 60 days for any planning purposes.

16. Submission email address.

The solicitation shows the submission address as uwo8@cdc.gov in most places, and as uw08@cdc.gov in one instance in the instructions. These differ by a letter "o" versus a zero.

We are submitting to uwo8@cdc.gov and wanted to flag the discrepancy in case it is a typographical error that could affect other offerors.

Submissions should be made to: uwo8@cdc.gov.

17. Evaluation factors. Will the Government confirm the evaluation factors and their relative importance for this quotation, including whether technical approach and past performance are evaluated factors?

The evaluation factors are as indicated in solicitation Section E:

Factor 1: Technical

Sub-Factor 1: Technical Approach

Sub-Factor 2: Management Approach

Sub-Factor 3: Similar Experience

Factor 2: Price

Factor 3: Past Performance

Evaluation factors are listed in descending order of importance. Evaluation factors other than price when combined are significantly more important than price.

18. Past performance sources. Given the small-business set-aside, will the Government consider recent commercial or non-federal past performance, and the past performance of proposed subcontractors or teaming partners, in the evaluation?

Yes.

19. Quote format. Are there page limits, formatting requirements, or specified volumes/sections for the technical and price quote?

See solicitation Section F – Instructions to Offerors.

20. Teaming and subcontracting. Does the Government anticipate that offerors may team or subcontract to deliver the full scope across development, UX/Section 508, and security authorization, and are there limitations on subcontracting beyond the standard clause?

Teaming and subcontracting are both permissible approaches. There are no limitations on subcontracting beyond the standard clauses.

21. Security authorization. Will the Government clarify the expected division of responsibility for the

SA&A/ATO package between the contractor and CDC/OCIO, and whether an existing System

Security Plan or defined authorization boundary will be provided as a starting point?

See answer to Question 9.

22. Incumbent and access timing. Is there an incumbent currently supporting VAERS reporting, and if so, will incumbent-developed code, designs, or artifacts be furnished as Government-Furnished mailto:uwo8@cdc.gov mailto:uw08@cdc.gov

Information at kickoff? Relatedly, given the Tier 2 background investigation requirement and the nine-month period of performance, when does CDC anticipate issuing PIV credentials and granting Azure environment access relative to award?

Offerors are advised to rely on the solicitation as written. No further information regarding incumbent status is provided. PIV credentials and Cloud environment access timing relative to award will be addressed at kickoff. See also Question 13 regarding schedule.

23. Section 508 deliverables. Will the Government confirm whether the required ACR/VPAT applies to the final application only or also to interim/beta releases, and whether manual assistive-technology testing is expected in addition to automated scanning?

The ACR/VPAT is due with Beta Release (draft) and updated with Final Release. Manual assistive-technology testing is expected in addition to automated scanning.

24. We noticed the solicitation has 3 modifications recorded on SAM.gov. Are there any updated or additional documents we should review beyond the RFQ PDF currently attached?

No – the only prior modification was to add the following update:

8/18/2026 Updates: 1. Questions are due 8/20/2026 2:00 PM ET. 2. Add Attachment 1 Artificial

Intelligence (AI) Use Compliance and Risk Management Plan.

25. Could you confirm the preferred submission format — are quotes to be submitted via email to this address, and are there any page limits or specific formatting requirements?

See answers to questions 3 and 16.

26. For the Similar Experience Factor, may the Government consider relevant experience performed by proposed subcontractors and key personnel, or must the experience have been performed under a contract held directly by the prime Offeror?

Subcontractor and key personnel experiences may be considered under the Similar Experience factor.

27. If subcontractor experience may be considered, are there any minimum workshare, commitment-letter, or documentation requirements beyond the draft subcontracting agreement identified in the

RFQ?

No, only a written draft Subcontracting Agreement is required. No additional minimum workshare documentation is required.

28. For the proposal prototype, would an interactive prototype using synthetic data and demonstrating representative workflows, branching logic, validation, accessibility, and user assistance satisfy the requirement, or is the Government expecting a functioning full-stack application connected to a database?

Yes, prototypes may be on Contractor controlled infrastructure, and no restrictions as long as the prototype tech stack uses the same tech stack available and operated at CDC and are part of FedRAMP approved and operated infrastructure.

29. Must the proposal prototype be hosted within a FedRAMP-authorized environment, or may it be hosted in a commercially available environment provided that it contains no VAERS data, PHI, PII, or other Government information?

http://sam.gov/

See answer to question 28.

30. Does the Government require the “intelligent validation,” form-completion assistance, supplemental-document suggestion tool, and interactive FAQ capabilities to use artificial intelligence, or may Offerors propose deterministic rules-based functionality where appropriate?

Offerors may propose deterministic rules-based functionality where appropriate; AI is not mandated, but considered helpful for contextual follow up question assistance.

31. If an Offeror proposes no AI use in its solution, is an Artificial Intelligence Compliance and Risk

Management Plan still required with the proposal? If a plan is required, should the Offeror submit the provided attachment indicating that AI is not proposed?

Yes, an AI Compliance and Risk Management Plan is required with every proposal. If no AI use is proposed, submit the attachment indicating no AI use.

32. Will the Government provide the selected contractor with the current VAERS data dictionary, interface specifications, validation rules, integration documentation, representative test scenarios, and baseline performance data following award?

Yes, these will be furnished at kickoff per PWS Section 9.

33. The RFQ requires resumes for all proposed key personnel, while the Key Personnel table in

Section D does not identify specific positions. May Offerors determine and propose their own key personnel positions based on their technical and management approaches?

Yes, offerors may propose their own Key Personnel positions consistent with their technical and management approach. The Government did not identify any specific positions as key personnel positions.

34. Please confirm whether the 15-page Technical Proposal limitation includes the prototype documentation and the Artificial Intelligence Compliance and Risk Management Plan, and whether the Data Management Plan is included in or excluded from that limitation.

See answer to Question 3.

35. Will the Government accept relevant commercial healthcare application experience as Similar

Experience when it demonstrates comparable healthcare workflows, PHI/PII safeguards, regulatory requirements, technical complexity, and stakeholder coordination, even if the work was not performed for a federal customer?

Yes, provided it demonstrates comparable workflows, PHI/PII safeguards, regulatory requirements, complexity, and stakeholder coordination.

36. Page limit. Section II states that cover pages, tables of contents, and resumes are excluded from the fifteen-page Technical Proposal limit. HHSAR 352.239-78 separately requires an Accessibility

Conformance Report, and CDCL.03 requires an AI Compliance and Risk Management Plan where

AI use is identified. Do those two documents count against the fifteen pages, or are they submitted as separate attachments alongside Volume I?

See answer to Question 3.

37. Signature. Block 14 of the SF-18 calls for the signature of the person authorized to sign the quotation. Does CDC accept a typed or electronic signature there, or does the Government require a scanned wet signature?

An electronic signature is acceptable.

38. Page limitation and required plans. Section F states the Technical Proposal shall not exceed 15 pages, with only cover pages, tables of contents, and resumes excluded. The solicitation also requires several plans and documents at proposal time — the AI Use Compliance and Risk

Management Plan (Attachment 1 template, CDCH.10/CDCL.03), the Data Management Plan

(CDCL.10), the Incident Response Plan (listed in the deliverables table as due "as part of

Proposal"), and the Section 508 Accessibility Conformance Checklist or ACR (HHSAR 352.239-

78(b)/(d)). Do these documents count against the 15-page Technical Proposal limit, or may they be submitted as separate attachments excluded from the page count?

See answer to Question 3.

39. Section 508 submission at proposal time. HHSAR 352.239-78(b) and (d) require an HHS Section

508 Accessibility Conformance Checklist or an ACR/VPAT with the proposal. Because this acquisition is for the development of an application that does not yet exist, would the Government please confirm which submission it expects: (a) an HHS Section 508 Accessibility Conformance

Checklist completed for the ICT services to be developed, (b) an ACR/VPAT prepared against the offeror's prototype, or (c) both? If a specific checklist from the HHS library is preferred, please identify it.

See answer to Question 23.

40. AI Use Compliance and Risk Management Plan format. Should the completed Attachment

1 template be submitted as its own document (Word or PDF attachment), or should its content be reproduced within Volume I? If submitted as its own document, please confirm it is not counted against the 15-page limit (see Question 1).

See answer to Question 3.

41. Prototype accessibility from the CDC network. The prototype must be provided as an accessible electronic link that the Government can reach and evaluate. Will the evaluation team be able to access an externally hosted, publicly reachable HTTPS website on a non-.gov commercial domain from the CDC network, and are there any restrictions on hosting location, domain, or site technology the Government would like offerors to observe? Also, through what date should offerors keep the prototype link live and unchanged?

Yes, evaluation team can access the link to an externally hosted, publicly reachable commercial domain. However, the prototype tech stack used should be the same tech stack available and operated at CDC and are part of FedRAMP approved and operated infrastructure (see also answer to question 28).

The link should remain available throughout the evaluation process.

42. Timing of Government-furnished access. PWS Section 5 states that PIV cards and laptops will be furnished by the Government and that CDC will provide access to the CDC-managed

Azure environment. Given that the staff roster is due 30 days before the contract effective date and that background investigations and training precede system access, when — relative to the 09/28/2026 effective date — should offerors assume contractor personnel will receive

PIV credentials, Government laptops, and CDC Azure environment access? Should proposed schedules assume development environment access is available on the effective date, or at some later milestone?

Offerors should assume development environment access may not be available on / within two weeks of start date and should build reasonable ramp-up time into their schedules; milestone dates will be adjusted for Government-caused delays consistent with standard FAR delay provisions.

43. Paperwork Reduction Act clearance. The PWS states the Government will determine

PRA applicability and recommends early CO/PRA engagement, and HHSAR 352.211-3 requires the contractor to allow at least 120 days for OMB clearance and prohibits data collection before written CO authorization. Within the nine-month period of performance, does CDC hold existing OMB clearance covering the redesigned reporting form and the new satisfaction survey instruments (PWS 1.5 and 1.7), or should offerors plan and price contractor support for a new or revised information collection request? What schedule assumption would the Government like offerors to use for PRA clearance?

See answer to question 5.

44. Baseline for the abandonment-rate requirement. PWS 1.10 and PRS require reducing the submission abandonment rate by at least 30 percent compared to the baseline established at project kickoff. Will the Government provide current VAERS submission analytics — abandonment rate, completion time, and related metrics — for establishing that baseline, or is the contractor responsible for instrumenting the current system and measuring the baseline at kickoff? If the latter, is measurement of the existing system within the contract scope?

The Contractor is responsible for instrumenting the existing system and establishing the baseline after project kickoff; this is within scope. The Government does not currently maintain this analytics baseline.

45. Existing application and upload tool documentation. PWS 2.1 requires integrating a new medical-record upload capability while maintaining the current post-submission upload tool, and PRS#9 evaluates preservation of that tool. Will documentation, interface specifications, or source code for the current VAERS reporting application and the existing post-submission upload tool be made available to the awardee as Government-furnished information, and at what point after award?

Available documentation will be furnished at kickoff; existing source code will be made available to the extent it exists and is releasable.

46. Option pricing. The schedule contains CLINs 0001 through 0003 with no separately identified option period, while FAR 52.217-8 (Option to Extend Services) is incorporated and the evaluation provision states that option prices will be added to the base for award purposes. Should offerors include separately priced amounts for the potential six-month extension of services, and if so, under what CLIN structure should those amounts be presented in the Price Proposal?

CLIN 0001 is the primary CLIN for this project. CLINs 0002 and 0003 are travel CLINs that the Government will fund if determined to be necessary. FAR 52.217-8 is removed from the solicitation. Also, see answers to questions 13 and 14.

47. Set-aside status. Block 10 of the SF-18 is difficult to read in the posted PDF, and the notice on

SAM.gov does not display a set-aside type. Could you confirm whether this RFQ is a small business set-aside?

This requirement is a 100% small business set-aside.

48. Contract support hours. PWS Section 6, Subsection B requires contract support during CDC core business hours, 8:30 a.m. to 5:00 p.m. ET. Could you clarify what that requires in practice: a continuously staffed availability window, or availability for scheduled coordination and

Government-initiated contact within a defined response time? If there is an expected response time we would like to price to it rather than guess.

Availability for scheduled coordination and Government-initiated contact within a reasonable response time is sufficient. Offerors should propose their own reasonable response-time commitment.

49. SA&A package. The RFQ requires the contractor to complete and maintain an agency SA&A package to support the agency ATO. As VAERS is an existing system, does CDC provide existing artifacts such as a current System Security Plan, contingency plan or prior POA&M as a starting point, or is the package expected to be developed from scratch?

Government will provide existing system artifacts and information, as applicable. You are not expected to create a package from scratch.

50. Proposal Prototype Hosting and Environment

Section F requires offerors to provide an accessible electronic link to the prototype for evaluation.

Please confirm that the proposal-stage prototype may be hosted in a contractor-controlled commercial environment outside the CDC Azure environment, using synthetic/non-production data, and that CDC security authorization/ATO requirements apply to the post-award application rather than the proposal prototype.

See answer to questions 28 and 41.

51. Draft Subcontracting Agreement and 15-Page Limit

Section F limits Volume I, Technical Proposal, to 15 pages, excluding cover pages, tables of contents, and resumes. Tab 3-1 also requires offerors proposing subcontractors to provide a written copy of the proposed draft Subcontracting Agreement. Please confirm that the draft

Subcontracting Agreement may be submitted as a separate attachment and is excluded from the

15-page Technical Proposal limitation.

See answer to Question 3.

52. Data Management Plan and 15-Page Limit

CDCL.10 requires a Data Management Plan as part of the proposal and states that a proposal received without a DMP will be deemed unacceptable. Please identify the proposal volume or attachment in which the DMP should be submitted and confirm whether it is excluded from the

15-page Technical Proposal limitation.

See answer to Question 3.

53. FedRAMP / ATO Authorization Boundary

The PWS states that the application will be developed and deployed within the CDC-managed

FedRAMP-authorized Azure environment and that the contractor will support CDC/OCIO issuance of the ATD and ATO. Standard-4 also references a FedRAMP-compliant ATO, 3PAO assessment, and agency SA&A. Please clarify whether the contractor-developed application operating entirely within CDC's managed Azure environment is expected to obtain a separate contractor/vendor FedRAMP authorization and 3PAO assessment, or whether the contractor is expected to support CDC's application-level ATD/SA&A/ATO within the existing CDC cloud authorization boundary.

No, the contractor will not need to obtain a separate ATO. The existing VAERS Azure environment operates under CDC's existing authorization. The new application will be evaluated for inheritance of applicable controls where appropriate, subject to CDC/OCIO's determination during the ATD/ATO process. The Contractor is responsible for updating the security and privacy documentation package. See answer to Question 9.

54. Final Release Due Date

Section 8 identifies the Testing and Final Release (Production-Ready) deliverable as due “By end of PoP (DOA + 150 days).” The stated Period of Performance is September 28, 2026 through

June 27, 2027, which is longer than 150 days. Please clarify whether the Production-Ready Final

Release is due 150 days after date of award or at the end of the nine-month Period of

Performance.

See answer to Question 13.

55. Day-45 Alpha Integration Expectation

Section 8 requires a Working Prototype (Alpha) Demonstration Build within 45 calendar days, while Section 9 states that VAERS data-element definitions, business rules, and integration requirements will be provided at kickoff. Please clarify whether the Day-45 Alpha is required to be integrated end-to-end with the existing VAERS environment, or whether the Alpha may demonstrate the production application workflow and VAERS-compatible structured output using a staged or simulated integration boundary, with operational VAERS integration completed during subsequent Beta/Final activities.

The Alpha may demonstrate the production workflow and VAERS-compatible structured output using a staged or simulated integration boundary; full operational integration is completed during subsequent Beta/Final activities.

56. Section 508 Documentation at Proposal Stage

HHSAR 352.239-78 on page 34 requires offerors to submit an appropriate HHS Section 508

Accessibility Conformance Checklist or Accessibility Conformance Report (ACR/VPAT) with their offer. This solicitation is for development of a new custom web application that will not exist in completed form at the time of proposal submission, and Section 8 separately requires an

ACR/VPAT with the Beta Release, updated with Final. Please clarify what Section 508 documentation the Government requires at proposal submission for a not-yet-developed custom application, and whether an applicable HHS accessibility checklist addressing the proposed development approach is sufficient at this stage.

See answer to Question 23.

57. Magnitude. Can CDC share the IGCE range or the estimated level of effort (labor hours or FTEs) for CLIN 0001? Is this acquisition being conducted under the simplified acquisition threshold?

The CDC will not disclose the Independent Government Cost Estimate (IGCE) nor an estimated level of effort. The CDC is intentionally allowing the contractor community to independently assess the requirements, leverage its industry expertise, and propose the most effective, efficient, and innovative solution to meet the Government’s objectives.

58. Hosting and authorization. The PWS places the application inside CDC's FedRAMP-authorized

Azure environment (Task 3.2, Section 11). Please confirm the contractor is not expected to hold or obtain its own FedRAMP cloud service provider authorization, and that the SA&A obligation is the agency ATD/ATO package for the application within CDC's existing boundary.

See answer to Question 9.

59. Prototype (Tab 2-2). May the prototype be hosted on the offeror's own infrastructure using synthetic data, and does it need to remain available only at submission or through the evaluation period?

See answer to questions 28 and 41.

60. Incumbency. Is there a current contractor supporting the VAERS public reporting front end, and is this scope new work or a re-compete?

See answer to question 2.

61. Key personnel and experience. How many key personnel positions does CDC expect? Can the healthcare informatics experience evaluated under Tabs 3-2 and 4 be satisfied by proposed key personnel or a subcontractor rather than the prime's corporate history, consistent with FAR

15.305(a)(2)(iii)?

The determination to identify key personnel is at the offeror’s discretion. Yes, key personnel or subcontractor experience can satisfy health informatics experience rather than prime contractor’s corporate history.

62. 1CDP. Is integration with the One CDC Data Platform (Palantir Foundry) in base scope, or is delivery of VAERS-compatible structured data mappings under Task 1.9 sufficient?

Delivery of VAERS-compatible structured data mappings under Task 1.9 is sufficient; 1CDP integration is not in base scope.

63. Contract vehicle. Task 4 and the Management Approach instructions refer to a "task order" and an "incumbent Contractor." Please confirm this is a standalone firm-fixed-price contract and not an order under an IDIQ or BPA.

This is a stand alone firm-fixed-price contract. All references to “task order: in the solicitation should be to “contract.” There is no incumbent. This requirement is not an order under an IDIQ or

BPA.

64. Background investigations. Section 11, paragraph 5 (Position Sensitivity Designations) is blank.

What investigation tier applies to contractor staff?

Public Trust Tier 2 applies.

65. Section F.I excludes only cover pages, tables of contents, and resumes from the Volume I 15-page limitation. The solicitation separately requires a Data Management Plan (CDCL.10), an AI

Compliance and Risk Management Plan where AI use is planned or potential

(CDCL.03/CDCH.10), a Section 508 Accessibility Conformance Checklist or ACR/VPAT

(HHSAR 352.239-78), and an Incident Response Plan “as part of Proposal” (PWS Standard-4).

Please confirm if these solicitation-required plans and artifacts (a) are excluded from the Volume

I 15-page limitation, and if not, (b) where they should be submitted.

See answer to Question 3.

66. If subcontractors are proposed, may the required written copy of the draft Subcontracting

Agreement be submitted as an appendix, excluded from the Volume I 15-page limitation?

See answer to Question 3.

67. Section B pre-prints CLINs 0002 and 0003 at $31,500.00 each (“Estimate” / “Not-to-Exceed”).

Should quoters carry these pre-printed NTE amounts as the quoted unit and extended prices for

CLINs 0002–0003 (with itemized travel estimates provided as supporting back-up documentation), or should quoters propose actual estimated travel amounts below the NTE?

Please also confirm how CLINs 0002–0003 will be treated in the total evaluated price.

Offerors are to all use the same unit and extended NTE prices for CLINs 0002 and 0003. Both

CLINs should have a unit price and NTE extended price of $31,500.00.

68. FAR 52.217-8 is included in the contract clauses. Will the potential six-month extension of services be included in the total evaluated price (e.g., by adding up to six months of performance at contract rates), and if so, how should quoters present pricing for the extension period?

See answer to question 14.

69. Please confirm which provision fill-ins, representations, and certifications must be completed and returned with the quotation (e.g., FAR 52.203-11, 52.203-18, 52.204-7, 52.229-11, and 52.240-

90), whether current SAM.gov representations and certifications satisfy any of these requirements, and whether the CDCL.09 CPARS contractor representative information is required with the quotation or at award.

Offerors are to complete any fill-ins, representations, and certifications required by the FAR provisions indicated in the solicitation. If they are part of the current SAM.gov representations and certifications then separate submissions are not required. Offerors are to complete CDCL.09.

The documentation can be submitted as part of the Price Proposal.

70. Section F.I directs quotations to uwo8@cdc.gov but directs questions “exclusively by email to uw08@cdc.gov,” while page 1 directs questions, quotes, and all communication to uwo8@cdc.gov. Please confirm the correct e-mail address(es) for (a) questions and (b) quotation submission, and whether the Government will acknowledge receipt of quotations.

See answer to Question 16.

71. CDCL.03 requires the AI Compliance and Risk Management Plan to be submitted “using the template provided,” but no template accompanies the RFQ document, and the invoicing instructions reference a “Section J, List of Attachments” that the RFQ does not contain. Please provide the AI plan template (Attachment 1) or identify where it is posted, and confirm the complete list of attachments to this solicitation.

The AI plan attachment was added to the solicitation notice on 8/18/2026.

8/18/2026 Updates: 1. Questions are due 8/20/2026 2:00 PM ET. 2. Add Attachment 1 Artificial

Intelligence (AI) Use Compliance and Risk Management Plan.

mailto:uwo8@cdc.gov mailto:uw08@cdc.gov

72. For the prototype submitted through an accessible electronic link: are credential-protected links acceptable if access credentials are provided in the proposal? Should the link remain accessible and unchanged through the full evaluation period, and will evaluators access it from the CDC network (relevant to any firewall or allow-listing constraints)?

See answer to questions 28 and 41. The link should remain through evaluation period and accessors will access it from the CDC network.

73. The RFQ does not state where the completed and signed SF 18 should be placed within the two-volume submission. Please advise where the Government prefers the signed SF 18 to be placed.

Please also confirm that quoters may annotate the SF 18 schedule block with “See Price

Breakdown Worksheet” in lieu of restating pricing on the form.

The signed SF 18 is to be included with the Price Proposal. Offerors may annotate the SF 18 schedule with “See Price Breakdown Worksheet” in lieu of restating pricing on the form.

74. Correct email address for proposals and for questions

Section F, page 61, directs proposals to uwo8@cdc.gov and questions to uw08@cdc.gov. Please confirm which address is correct for each, so that we can be certain our proposal volumes reach the Contracting Officer. We have copied both addresses on this message for that reason.

See answer to Question 16.

75. Attachment 1 and the 15-page Technical Proposal limitation

Amendment 0001 adds Attachment 1, the Artificial Intelligence (AI) Use Compliance and Risk

Management Plan. Section F excludes cover pages, tables of contents and resumes from the 15-page limitation by name, and is silent on attachments. Please confirm whether Attachment 1 counts toward the 15-page Technical Proposal limitation, or is excluded from it.

We would ask the same of the Data Management Plan required by CDCL.10 and the

Accessibility Conformance Report required by HHSAR 352.239-78, both of which are submitted with the proposal and neither of which is named in the Section F tab structure.

See answer to question 3.

76. HHS onboarding and the period of performance

The PWS requires a completed background investigation through HHS onboarding for all contractor and subcontractor personnel before work begins, with a period of performance starting

28 September 2026. Please confirm whether the onboarding period falls within the period of performance, and advise the Government's expected processing time, so that offerors can schedule accordingly.

See answer to question 42.

77. Government-furnished information on the existing application

Please confirm what the Government will furnish at award regarding the existing VAERS reporting application, specifically source code, data model documentation, design assets, and any current Accessibility Conformance Report, and whether access to the CDC-managed Azure environment is provided at start of performance.

mailto:uw08@cdc.gov

Available documentation, including any existing ACR, will be furnished at kickoff to the extent it exists and is releasable. Access to the CDC-managed Azure environment is provided per the ATD-governed schedule discussed in Question 22.

78. Is the working prototype a scored evaluation factor, or a supporting exhibit to the Technical Plan?

The prototype (Tab 2-2) is a scored element of the Technical Proposal evaluation.

79. Task 1.1 requires requirements gathering after award. On what requirements does CDC expect offerors to base a pre-award prototype?

Offerors should base the prototype on the publicly available current VAERS form and general PWS requirements. Full data elements and business rules will be provided at kickoff. The current form can be found at VAERS - Download / Upload a Writable PDF Form and the VAERS Data Use Guide found at VAERS - Data Sets provides field names and form box alignment (derived fields are related to this RFQ).

80. What minimum functionality must the prototype demonstrate?

See answer to Question 28.

81. Will CDC release the current VAERS form data elements and business rules before the due date so prototypes can be based on them? Section 9 currently provides them at kickoff.

Offerors should base the prototype on the publicly available current VAERS form and general PWS requirements. Any additional data elements and business rules will be provided at kickoff.

See question 264 for specific public artifacts available.

82. If there are unforeseen delays from the Government side for ATD issuance, PIV provisioning, or

EPLC stage gate review, will the Day 45 Alpha, Day 90 Beta, and final release milestones be adjusted?

Yes, milestone dates will be adjusted to the extent delays are attributable to Government dependencies, consistent with standard FAR provisions.

83. Section 5 states CDC will provide access to the CDC-managed Azure environment for development, testing, and deployment, governed by the ATD. Please clarify whether the

Contractor is expected to perform initial design and development in Contractor-provided or commercially available environments prior to ATD issuance and CDC environment provisioning, or whether all development must occur within the CDC environment. If Contractor environments are used, please confirm the applicable security configuration and scanning requirements under

Standard-3.

Yes, provided appropriate security configuration and scanning consistent with Standard-3 requirements are applied, and no Government/PHI/PII data is used prior to ATD/ATO issuance.

84. Please clarify whether the Contractor is expected to author the full ATD, SA&A, and ATO documentation packages, or to provide supporting input to CDC-authored packages. This materially affects the level of effort proposed.

Correct. No, the contractor will not need to obtain a separate ATO. However, the Contractor is responsible for updating the security and privacy documentation package.

https://vaers.hhs.gov/uploadFile/index.jsp https://vaers.hhs.gov/data/datasets.html

85. Section G requires Key Personnel resumes to demonstrate hands-on experience in healthcare informatics, public health surveillance, or healthcare data management. Will comparable experience delivering secure, regulated data systems for other federal agencies be considered qualifying?

Yes, comparable experience delivering secure, regulated data systems for other federal agencies will be considered.

86. Which positions are considered Key Personnel, and is there a limit on the number of resumes?

The CDCH.04 table is blank.

See answer to Question 33. There is no stated limit on the number of Key Personnel resumes.

87. Task 1.4 requires intelligent completion assistance. If an offeror proposes to meet this with rules-based logic and conditional guidance rather than artificial intelligence, is an AI Compliance and

Risk Management Plan (Attachment 1) still required?

See answer to Question 31.

88. Are the Data Management Plan, AI Compliance and Risk Management Plan, Incident Response

Plan, ACR/VPAT, draft subcontracting agreement, and three-year employee turnover table required with the proposal, and if so, are they excluded from the 15-page limit?

See answer to Question 3.

89. Please confirm CLIN 0001 is the only CLIN offerors price, and whether it is invoiced in nine equal monthly increments or upon deliverable acceptance.

Confirmed, CLIN 0001 is the only CLIN offerors are to price. Offerors are to include $31,500 as the unit and NTE extended price for CLINs 0002 and 0003. The proposed payment schedule can be by deliverable acceptance or monthly increments.

90. Section 8 states final release is due at DOA + 150 days, but the stated period of performance is nine months. Please confirm the correct final release date.

See answer to Question 13.

91. Standard-11 requires open-source release under FAR 52.227-14, while FAR 52.227-17 restricts release without Contracting Officer permission. Which governs custom code developed under this order?

The custom code is to be governed by FAR 52.227-17.

92. Could CDC provide an overview of the current VAERS reporting application's architecture, including the existing application components, frameworks, databases, APIs, integrations, and infrastructure that the Contractor will need to interface with or replace?

See PWS Subsection D for the current architecture summary (Azure SQL Managed Instance, VMs, ColdFusion, Tomcat, Node.js, .NET, Akamai, Blob Storage, Key Vault, Logic Apps).

Additional documentation will be furnished at kickoff.

93. Could CDC provide documentation of the current VAERS data model, data elements, business rules, validation rules, and integration specifications that will be available to the Contractor at project kickoff?

See answer to Question 32.

94. Could you please confirm will the Contractor be expected to modify or replace any existing VAERS backend components, or is the scope limited to developing the new reporting application and integrating with existing VAERS services?

Scope is limited to developing the new reporting application and integrating with existing VAERS services. Wholesale replacement of backend components is not required.

95. Could CDC clarify which Azure services, environments, subscriptions, networking components, CI/CD tools, and security services will be Government-furnished and which are expected to be provided/configured by the Contractor?

CDC furnishes the Azure environment, accounts, and standard platform services as described in PWS Subsection B. Contractor-specific development tooling and licensing not already available in the CDC environment are the Contractor's responsibility.

96. Could CDC identify the APIs/interfaces currently available for integration with VAERS and clarify whether new APIs or integration services are expected to be developed as part of this effort?

Interface specifications will be provided at kickoff per PWS Section 9. New integration services/structured data mappings may be required consistent with Task 1.9.

97. Could CDC provide the complete current VAERS form and identify the specific differences in fields, validation rules, and branching logic required between public and healthcare-provider reporting?

The current publicly available VAERS form may be used as a proxy for prototype development. Any additional data elements, validation rules, and branching specifications will be furnished at kickoff if not available publicly online.

98. Could CDC clarify whether the intelligent form assistance and supplemental-document recommendation capabilities are expected to use AI/ML/Generative AI, rules-based logic, or another approach?

See answer to Question 30.

99. Could CDC provide the expected reporting, usage metrics, and analytics requirements, including the specific metrics that must be captured for public and healthcare-provider users?

Specific metric definitions will be finalized with CDC after award; see PWS Task 1.10 and PRS#4 for baseline performance targets.

100. What is the approved budget or range allocated for this project?

See answer to question 57.

101. Is CDC open to an offshore-blended delivery model, and are there any data residency or US-only staffing restrictions?

CDC is generally open to an offshore-blended delivery model, provided that the model meets CDC’s security, compliance, data protection, and service-level…