B3. Q&A.pdf

Compiled Offeror Questions

RFQ 75D301-26-Q- 79261 - Systematic Information Review and Literature Validation Support Services

1. Does the >85% sensitivity/specificity threshold need to be shown separately for each baseline capability/evidence stream, or is a representative end-to-end validation sufficient? Are confusion matrices, validation protocols, and study documentation acceptable substantiation?

The Government requires the proposed solution to demonstrate performance greater than 85% for both sensitivity and specificity at each of the following stages of the systematic review workflow: (1) title and abstract screening, (2) full-text screening, and (3) data extraction. The greater-than-85% threshold is intended to apply independently to each stage; performance should not be averaged or pooled across stages to satisfy the requirement. Weighted accuracy may be used to evaluate data extraction. Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, and calculations used to determine sensitivity and specificity for each stage.

2. Can substantiating attachments (screenshots, sample outputs, validation reports, peer-reviewed studies, resumes, Section 508 ACR/VPAT) be submitted outside Volume I's 20-page limit?

Yes. Volume I's 20-page limit excludes the cover page, table of contents, resumes, and supporting attachments. The listed substantiating materials may be submitted as clearly labeled supporting attachments after the 20-page technical narrative in the single Volume I PDF. Attachments may not be used to avoid providing the required technical approach within the 20-page narrative.

3. Can a small-business prime substantiate Factor 1 using evidence from a subcontractor/teaming member's existing commercial service, provided the prime remains responsible for performance?

Yes. A small-business prime may rely on substantiating evidence associated with a subcontractor or teaming member’s existing commercial service to support Factor 1, provided that the capability demonstrated is the capability actually being proposed for performance under the contract and is available as part of the prime’s offered solution at the time of quotation.

The quotation should clearly identify the relationship between the prime, the subcontractor/teaming member, and the commercial service being proposed, and should provide sufficient evidence to demonstrate that the offered service satisfies the Factor 1 requirements. Evidence that demonstrates only a subcontractor’s general or unrelated capabilities, without establishing that those capabilities are part of the proposed solution, will not be sufficient.

The small-business prime remains responsible for overall contract performance, management, security, compliance, and delivery of the required outcomes. Any proposed subcontracting arrangement must also comply with all applicable solicitation requirements, including applicable small-business and limitation-on-subcontracting requirements.

4. Must the quote include an existing Federal ATO/FedRAMP authorization, or can offerors instead describe their approach and schedule for post-award IT Security Plan/accreditation?

An existing Federal ATO or FedRAMP authorization is not required to be in place at the time of quotation.

Offerors may describe their proposed security approach and schedule for completing the applicable post-award assessment and authorization requirements.

For cloud services, if the proposed information system/service does not already have an approved FedRAMP-compliant ATO, the Contractor must submit a plan to obtain one no later than 10 days after award. In addition, where the Contractor system does not already have a valid agency ATO, the Contractor must work with CDC/HHS and provide the required authorization artifacts before the system is used in a production capacity.

Accordingly, offerors without an existing ATO/FedRAMP authorization are not excluded from consideration solely for that reason, but their quotation should provide a credible approach for satisfying the applicable security requirements and obtaining the required authorization before production use.

5. What is the intended rights allocation between pre-existing commercial IP and Government-furnished/contract-generated materials? Would a standard background-IP/data-rights schedule be accepted?

Background IP (the offeror's commercial platform) remains the Contractor's property — the Government is acquiring a service outcome, not the platform or source code. GFI remains Government property with no rights conferred by use (FAR 52.227-14). Contract-generated materials — data, business logic, workflow/configuration, validation materials, and documentation for the modified service — are subject to Government rights in perpetuity (FAR 52.227-19). A standard rights schedule may be submitted, but any variance from this allocation must be identified and explained per Section 6.2.

6. Should all 12 CLINs be priced as separate Firm-Fixed-Price deliverables, and does "fully funded" mean the full 36-month value is obligated at award?

Yes. Offerors should provide a separate Firm-Fixed-Price for each of CLINs 0001 through 0012, consistent with the CLIN structure in the RFQ, Section B. Each CLIN may encompass one or more associated deliverables identified in the PWS/CDRL; therefore, the CLIN price is the fixed price for completing the work and associated deliverables under that CLIN, rather than necessarily a separate price for every individual CDRL item. Payment for a CLIN is contingent upon Government acceptance of the associated deliverable(s).

The RFQ’s reference to a “fully funded” 36-month period of performance means that the Government intends to fund the full awarded 36-month contract value at award rather than incrementally funding the contract by Contract Year. Contract Years 1–3 are used for performance scheduling and deliverable management.

Payment will nevertheless occur in accordance with the CLIN/deliverable acceptance structure specified in the contract.

7. Is the deadline governed by Eastern Time despite the solicitation referencing EST, and is an email receipt from the CO the preferred proof of timely submission?

Yes, the deadline for response submission is 9/18/2026 at 4:00 p.m. Eastern Time

8. Is there an Independent Government Cost Estimate or anticipated contract value range?

The RFQ does not provide an Independent Government Cost Estimate (IGCE) or an anticipated contract value range. Offerors should develop their pricing based on the requirements, CLIN structure, period of performance, and their proposed technical and staffing approach. The Government will evaluate proposed prices in accordance with the evaluation criteria stated in the RFQ.

9. Is this a new requirement, or has CDC/NIOSH procured similar services before? If so, can incumbent/prior award info be shared?

This is a new requirement. There is no incumbent.

10. What evidence types will satisfy the >85% sensitivity/specificity requirement (e.g., commercial validation results, customer studies, reproducible tests, peer-reviewed studies)?

Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, and calculations used to determine sensitivity and specificity for each stage. Evidence must be sufficiently specific and relevant to substantiate the claimed >85% sensitivity and specificity against human review; unsubstantiated claims will not be credited.

11. Must >85% performance be independently demonstrated for every workflow capability, or can overall systematic-review performance suffice?

The Government requires the proposed solution to demonstrate performance greater than 85% for both sensitivity and specificity at each of the following stages of the systematic review workflow: (1) title and abstract screening, (2) full-text screening, and (3) data extraction. The greater-than-85% threshold is intended to apply independently to each stage; performance should not be averaged or pooled across stages to satisfy the requirement. Weighted accuracy may be used to evaluate data extraction. Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, and calculations used to determine sensitivity and specificity for each stage.

12. May a prime satisfy the baseline capability requirement via a subcontractor/teaming partner's existing commercial service?

Yes. A prime contractor may satisfy the baseline capability requirement through a subcontractor or teaming partner’s existing commercial service, provided that the service is part of the solution actually proposed for contract performance and is currently available at the time of quotation. The quotation should clearly identify the relationship between the prime and the subcontractor/teaming partner, explain how the commercial service will be used in performance, and provide substantiating evidence that the offered service satisfies the Factor 1 requirements.

The prime contractor remains responsible for overall contract performance and compliance with all applicable solicitation requirements. Generic evidence of a subcontractor’s capabilities that is not tied to the solution proposed by the prime will not be sufficient.

13. If so, can that subcontractor's documentation/evidence be used to satisfy Factor 1?

Yes. Documentation and other substantiating evidence from the subcontractor or teaming partner may be used to support Factor 1, provided the evidence pertains to the existing commercial service that is actually being proposed as part of the prime contractor’s solution.

The quotation should clearly connect the subcontractor’s evidence to the offered solution and demonstrate that the required baseline capabilities are currently available at the time of quotation.

Acceptable substantiating evidence may include documentation, screenshots, sample outputs, peer-reviewed validation studies, or a demonstration if requested. Generic evidence of a subcontractor’s capabilities that is not tied to the proposed solution will not be credited.

14. Are there minimum past-performance requirements specific to the prime, or can subcontractor experience count?

The RFQ does not establish a separate minimum past-performance requirement or past-performance evaluation factor. Relevant prime or proposed subcontractor experience may be used to substantiate the proposed capability, personnel, or management approach, but will be considered only under the stated evaluation factors.

15. Will a live demonstration be required during evaluation, and if so, what are the expected scenarios, duration, and participants?

A live demonstration is not currently mandatory. The Government may request a demonstration or oral presentation if determined necessary. If requested, the Government will provide the scenarios, duration, participants, and submission instructions.

16. Will a current VPAT/ACR satisfy the Section 508 requirement at quotation stage, subject to post-award remediation?

Yes, provided the ACR/VPAT is complete, current, and accurately addresses the specific platform version and configuration offered and the applicable RFQ standards. Any nonconformance and planned remediation must be disclosed. Submission of a remediation plan does not waive the contract's accessibility requirements and required post-award remediation is at the Contractor's expense.

17. Can estimated literature volumes (citations, abstracts, full-text articles) be provided per validation/search package?

The Government does not currently have sufficiently reliable volume estimates to provide fixed ranges of citations, abstracts, full-text publications, or other records for each starting set or topic across CLINs 0001–0012. The size and composition of the literature pools will vary substantially by the Government-designated OSH topic, review type, evidence stream, search strategy, and stage of validation. Offerors should anticipate that some occupational safety and health topics may involve very large bodies of literature. Depending on the topic and search strategy, initial retrievals may include tens of thousands of citations or records before screening and deduplication. Other topics may yield substantially smaller literature pools. These potential volumes are provided only as a general planning consideration and are not guaranteed quantities for any individual CLIN or topic. The solicitation is structured around performance outcomes and deliverables rather than a fixed number of records. Where historical starting sets or comparison materials are available, the Government will provide the applicable starting information in accordance with the task-triggered schedule. Actual retrieval volumes generated by the Contractor may differ from Government-provided starting sets because part of the purpose of the acquisition is to evaluate, validate, and refine the Contractor’s literature retrieval methodology.

18. Is there an anticipated ceiling or level of effort for human-in-the-loop review labor per contract year?

No Government-prescribed ceiling or labor-hour level of effort is stated. This is a Firm-Fixed-Price, deliverable-based acquisition; offerors are responsible for proposing staffing and human-in-the-loop labor sufficient to meet the PWS outcomes, schedules, and quality requirements.

19. Will all 12 CLINs and the full 36-month period be funded at initial award?

Yes. As written, the RFQ contemplates award of a single, fully funded 36-month Firm-Fixed-Price contract covering CLINs 0001 through 0012. Accordingly, the Government intends to fund the full 36-month contract value at initial award rather than incrementally funding individual Contract Years.

Contract Years 1–3 are used for scheduling and deliverable-management purposes. Payment, however, remains tied to successful completion and Government acceptance of the applicable CLIN deliverables.

20. Do the Government's retained rights under PWS 12.0/FAR 52.227-19 apply only to contract deliverables/NIOSH-specific configurations, not the contractor's underlying commercial platform?

Will FAR 12.212-consistent commercial license terms be considered?

Yes. Government rights extend to contract-generated data, business logic, workflow/configuration, validation materials, and documentation for the modified service — not the underlying commercial platform or source code, consistent with Part 2's statement that this acquisition is not for a standalone platform or source code. FAR 12.212-consistent commercial license terms for the platform will be considered, provided they don't narrow Government rights to the contract-generated materials above;

any variance must be explained per Section 6.2.

21. At what review stage(s) must the >85% sensitivity/specificity threshold be demonstrated (title/abstract screening, full-text screening, data extraction, or all three), and against what reference standard?

The Government requires the proposed solution to demonstrate performance greater than 85% for both sensitivity and specificity at each of the following stages of the systematic review workflow: (1) title and abstract screening, (2) full-text screening, and (3) data extraction. The greater-than-85% threshold is intended to apply independently to each stage; performance should not be averaged or pooled across stages to satisfy the requirement. Weighted accuracy may be used to evaluate data extraction. Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, and calculations used to determine sensitivity and specificity for each stage.

22. Can the Government provide anticipated volumes (review topics/starting sets per year, typical/max citation counts) for pricing?

The Government does not currently have sufficiently reliable volume estimates to provide fixed ranges of citations, abstracts, full-text publications, or other records for each starting set or topic across CLINs 0001–0012. The size and composition of the literature pools will vary substantially by the Government-designated OSH topic, review type, evidence stream, search strategy, and stage of validation. Offerors should anticipate that some occupational safety and health topics may involve very large bodies of literature. Depending on the topic and search strategy, initial retrievals may include tens of thousands of citations or records before screening and deduplication. Other topics may yield substantially smaller literature pools. These potential volumes are provided only as a general planning consideration and are not guaranteed quantities for any individual CLIN or topic. The solicitation is structured around performance outcomes and deliverables rather than a fixed number of records. Where historical starting sets or comparison materials are available, the Government will provide the applicable starting information in accordance with the task-triggered schedule. Actual retrieval volumes generated by the Contractor may differ from Government-provided starting sets because part of the purpose of the acquisition is to evaluate, validate, and refine the Contractor’s literature retrieval methodology.

23. What FIPS 199 categorization applies, given the system will process only public scientific/technical information?

The RFQ identifies the FIPS 199 impact levels as Confidentiality-Low, Integrity-Moderate, Availability-Moderate, and Overall-Moderate. The fact that the system processes only publicly available scientific and technical information supports a Low confidentiality impact, but it does not eliminate the need to protect the integrity and availability of the service and its outputs.

24. Does this contract replace/consolidate existing CDC systematic-review software licenses, and would migration of existing projects/records be required?

The RFQ does not include migration of existing projects or records as a performance requirement. This contract is not currently intended to replace or consolidate existing software licenses.

25. Which bibliographic sources must be searched (e.g., MEDLINE/PubMed, Embase, Scopus, Web of Science, NIOSHTIC-2, grey literature), and is subscription/full-text access contractor- or Government-furnished?

The RFQ does not prescribe specific bibliographic databases and does not identify database subscriptions or full-text access as Government-furnished resources. PubMed, Embase, Web of Science, Scopus, and NIOSHTIC-2 are examples for informational purposes.

26. May Factor 1 be satisfied through an integrated service combining multiple commercial platforms with the offeror's proprietary workflow/QC/human-in-the-loop services?

Yes. Factor 1 may be satisfied through an integrated commercial service that combines multiple existing commercial platforms, tools, and/or proprietary workflow, quality-control, and human-in-the-loop services, provided the integrated service being offered is currently available at the time of quotation and, as a whole, demonstrates all required Factor 1 capabilities.

The quotation should clearly describe the components of the integrated service, how they operate together, and which component or workflow provides each required capability. Substantiating evidence may be drawn from the relevant components, but the offeror must demonstrate that the capabilities are available as part of the actual end-to-end solution proposed for contract performance. Planned post-award integration or development will not satisfy the baseline capability requirement.

The integrated service must also maintain the required human-in-the-loop quality controls, traceability, reproducibility, auditability, and configuration control across the overall workflow.

27. May licensed third-party commercial platforms be used as components, including different tools for different review stages?

Yes. Licensed third-party commercial platforms may be used as components of the proposed service, including use of different tools for different stages of the systematic review workflow, provided the overall service offered satisfies the PWS and Factor 1 requirements.

The offeror should clearly identify how the component tools are integrated into the end-to-end service, which review stages they support, and how the overall workflow maintains the required human-in-the-loop controls, traceability, reproducibility, auditability, configuration control, and security. The prime Contractor remains responsible for the performance and compliance of the complete service, including applicable requirements associated with third-party providers.

For Factor 1, the required capabilities must be currently available as part of the offered service at the time of quotation; planned post-award development or integration would not satisfy the baseline capability requirement.

28. Must the specific integrated configuration have existed before solicitation issuance, or is it enough that it's operational and capable at quotation/award?

The specific integrated configuration must be operational and capable at the time of quote submission. It need not have existed before solicitation issuance but planned or in-development capability does not satisfy the RFQ's award-eligibility requirement.

29. May validation evidence combine individual component validation with offeror-conducted integrated-workflow validation, rather than requiring prior validation of the complete integrated service?

The RFQ permits multiple forms of substantiation and does not expressly require a single prior validation study of the complete integrated service. Component-level evidence may be combined with integrated workflow validation, provided the combined evidence substantiates the performance and capabilities of the complete service offered.

30. May a third-party technology provider's documentation/validation/evidence be used to support Factor 1 and Factor 4?

Yes. Documentation, validation, or other substantiating evidence from a third-party technology provider may be used where it is relevant to and supports the capabilities, security controls, or accessibility features of the offeror’s proposed service. The offeror remains responsible for demonstrating that the proposed service, as configured and offered to the Government, satisfies the applicable Factor 1 and Factor 4 requirements.

31. Must each underlying cloud component independently hold a FedRAMP ATO, or is authorization evaluated at the overall proposed service/system boundary (per HHSAR 352.239-77)?

FedRAMP authorization is evaluated at the defined information system/service authorization boundary. The Contractor must identify the proposed system boundary, environment, interconnections, and dependencies and demonstrate that the overall cloud service satisfies the applicable FedRAMP and HHS/CDC requirements. Underlying services or dependencies that are outside that authorization boundary must be separately addressed and, where applicable, separately authorized. The solicitation does not state that every individual software, infrastructure, or third-party component must independently hold its own FedRAMP ATO.

32. May an offeror propose a third-party commercial AI platform as a component (not owned by the offeror) if it assumes full contractual responsibility?

The RFQ does not require the prime to own each technology component. It permits a third-party AI platform if disclosed, operational as part of the offered service at quote submission, available throughout performance, and compliant with all technical, security, accessibility, data-use, data-rights, and subcontract requirements. The prime must retain full responsibility.

33. Which baseline capabilities (Section 3.0) must be fully operational at quotation/award vs. those that may be refined during performance (Sections 7.3/7.4)?

The baseline capabilities identified in PWS Section 3.0 must be existing and operational at the time of quotation. These include the service’s ability to perform structured data extraction, populate editable Excel extraction forms with source quotes and page numbers, parse tables and figures/OCR, support human-in-the-loop review, conduct data synthesis and meta-analysis, select and extract appropriate effect measures with human-in-the-loop review, generate meta-analytic models, and produce narrative summaries. The solicitation does not require all future refinements to be complete at quotation.

Sections 7.3 and 7.4 contemplate evaluation, refinement, and implementation of changes during Contract Years 2 and 3. In CY2, the contractor will identify minimal and key platform changes, evaluate their effectiveness, and implement Government-prioritized changes. In CY3, the contractor will apply and evaluate the updated service methodology on additional Government-designated strategy categories. Accordingly, the distinction is that the core baseline service capabilities must already be available and operational at quotation, while configuration, workflow, methodology, and platform refinements arising from the Government’s validation and feedback process may occur during contract performance.

34. To which specific tasks/outputs does the >85% sensitivity/specificity standard apply (retrieval, screening, extraction, etc.), and how will it be calculated?

The Government requires the proposed solution to demonstrate performance greater than 85% for both sensitivity and specificity independently at each applicable screening stage of the systematic review workflow: (1) title and abstract screening and (2) full-text screening. For data extraction, performance must also exceed 85%; weighted accuracy may be used where sensitivity and specificity are not appropriate for the type of data being extracted. The greater-than-85% threshold is intended to apply independently to each stage and may not be averaged or pooled across stages to satisfy the requirement. For title/abstract and full-text screening, performance should be calculated against a human-reviewed reference standard using the following definitions: sensitivity = true positives / (true positives + false negatives) and specificity = true negatives / (true negatives + false positives). A true positive is a study correctly identified for inclusion, a false negative is an eligible study incorrectly excluded, a true negative is a study correctly excluded, and a false positive is an ineligible study incorrectly included. Where results are reported across multiple validation datasets or systematic reviews, offerors should clearly describe whether results are calculated separately by dataset and/or as weighted or pooled estimates. For data extraction, where the extracted variables are not naturally binary, weighted accuracy may be calculated as the number of correctly extracted, human-validated data elements divided by the total number of evaluable data elements, with weighting based on the number of evaluated data elements across datasets or reviews. If an offeror elects to report sensitivity and specificity for a binary extraction task, the offeror should clearly define the positive and negative classes and the corresponding true-positive, false-negative, true-negative, and false-positive determinations. Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, treatment of missing or unevaluable data, and calculations used to determine performance for each stage.

35. Must validation evidence be prior independently validated/peer-reviewed results, or can sample outputs/demonstrations suffice?

No. The solicitation does not require that all validation evidence consist of prior independently validated or peer-reviewed results. Under Factor 1, offerors may substantiate their existing baseline capabilities using documentation, screenshots, sample outputs, peer-reviewed validation studies, or demonstrations if requested. However, for the specific requirement to demonstrate validation performance greater than 85% sensitivity and specificity against human-reviewer results, the offeror must provide supporting evidence sufficient for the Government to evaluate that claim. Peer-reviewed evidence should be provided where available, but the solicitation does not make peer review an absolute prerequisite for consideration of other substantiating evidence.

36. Must the service have an existing FedRAMP authorization at quotation/award, or is a plan to obtain one sufficient for award eligibility?

An existing FedRAMP authorization is not required at the time of quotation or award. If the proposed information system/service does not already have a FedRAMP-compliant ATO, the Contractor must submit a plan to obtain one no later than 10 days after award, in accordance with HHSAR 352.239-

77. The Contractor must also complete the applicable HHS/CDC A&A requirements and obtain the required agency ATO prior to system deployment/service implementation or production use.

37. If no FedRAMP ATO exists at award, may CYl validation activities proceed before ATO issuance, given only public information is processed?

The solicitation does not provide a blanket exception allowing CY1 validation activities to proceed before ATO issuance solely because the service will process only publicly available information. The PWS states that the service will process only publicly available scientific and technical information and will not process sensitive personal information, PHI, classified information, or non-public CDC data. However, the security requirements separately provide that, if the system does not already have a valid ATO, the Contractor must complete the applicable authorization requirements before the system is used in a production capacity. HHSAR 352.239-77 also requires the agency ATO prior to system deployment/service implementation. Accordingly, pre-ATO CY1 activities would be permissible only to the extent CDC determines that they constitute non-production validation/testing and do not amount to deployment or service implementation requiring an ATO.

The solicitation does not itself establish a public-information exemption from the ATO requirement.

The Contracting Officer and applicable CDC security officials would determine whether a proposed pre-ATO validation environment or activity may proceed.

38. Which specific security/FedRAMP/ATO/continuous monitoring/SA&A requirements in Section 13 actually apply, given no PH/PHI/classified data is processed?

Section 13 applies as written to the extent the Contractor’s proposed service falls within the applicable HHS/CDC information-system and cloud-service requirements. The solicitation establishes an overall FIPS 199 Moderate impact level and requires FedRAMP-compliant authorization, agency A&A/ATO, applicable SA&A documentation, and continuous monitoring for the system/service used under the contract. The fact that the requirement is limited to publicly available scientific and technical information and does not involve PII, PHI, classified information, or non-public CDC data does not, by itself, waive those system-level security requirements. Requirements that are expressly contingent on the presence of PII, PHI, Privacy Act records, CUI, or other sensitive information would apply only if such information is actually handled. For this requirement, the solicitation states that no PII is involved and that Privacy Act requirements are not applicable.

Accordingly, PII-specific breach, privacy-impact, and Privacy Act requirements would not apply except to the extent otherwise triggered by a change in scope or by HHS/CDC security determination. Offerors should therefore address the FedRAMP, agency ATO, SA&A, and continuous-monitoring requirements applicable to their proposed service/system boundary, while identifying any requirements that are not applicable because the service processes only public information. Final applicability will be determined by the Contracting Officer in coordination with the applicable CDC security officials.

39. Does the Government's IP rights language apply only to contract-specific modifications/deliverables, not the contractor's/third party's preexisting commercial IP?

Yes. The Government’s IP/data-rights requirements apply to contract-generated deliverables, data, documentation, configurations, validation materials, workflow/business logic, and modifications or updates developed in performance of this contract. They are not intended to transfer ownership of the Contractor’s or a third party’s preexisting commercial intellectual property, including preexisting software, platforms, source code, models, algorithms, or other proprietary technology. Preexisting commercial intellectual property remains subject to the applicable commercial license and the data-rights provisions incorporated into the contract. The Contractor is responsible for identifying any asserted restrictions and ensuring that it has sufficient rights to provide the Government the contract-required use rights in deliverables and contract-specific modifications.

40. Do ordinary vendor platform updates require prior Government approval, and what qualifies as a "material platform change"?

Routine commercial platform maintenance and updates do not require prior Government approval unless they materially affect contract performance, outputs, validation results, reproducibility, auditability, or the system’s security posture. The Contractor must maintain configuration control and document material platform changes, including model/service updates, search-method refinements, and data-processing changes that materially affect generated literature pools or analytics. Changes that may affect HHS/CDC’s security posture require agency approval, and substantive changes to accepted deliverables may not be made without Contracting Officer direction or written Government authorization. The solicitation does not provide a separate formal definition of “material platform change.” For purposes of this requirement, it should be understood as a change reasonably capable of affecting the service’s outputs, methods, validation performance, reproducibility, audit trail, security posture, or other contract-relevant functionality. Routine maintenance, bug fixes, or updates that do not materially affect those areas would not ordinarily require prior Government approval, although they remain subject to the Contractor’s configuration-management obligations as applicable. Examples that would reasonably be considered material changes include, but are not limited to, the following:

• replacing or substantially changing an AI/ML model used for screening or extraction;

• changing ranking, inclusion/exclusion, or retrieval logic in a way that could change which studies are retrieved;

• changing OCR, table parsing, or structured extraction methods in a way that could affect extracted results;

• changing meta-analysis/effect-measure logic;

• changing confidence scoring or human-in-the-loop decision logic;

• changing data-processing pipelines in a way that could affect reproducibility;

• changing infrastructure, architecture, or cloud components in a way that affects the authorized security posture.

41. Can estimated ranges (citations, abstracts, full-text publications, etc.) be provided per starting set/topic across CLINs 0001-0012?

The Government does not currently have sufficiently reliable volume estimates to provide fixed ranges of citations, abstracts, full-text publications, or other records for each starting set or topic across CLINs 0001–0012. The size and composition of the literature pools will vary substantially by the Government-designated OSH topic, review type, evidence stream, search strategy, and stage of validation. Offerors should anticipate that some occupational safety and health topics may involve very large bodies of literature. Depending on the topic and search strategy, initial retrievals may include tens of thousands of citations or records before screening and deduplication. Other topics may yield substantially smaller literature pools. These potential volumes are provided only as a general planning consideration and are not guaranteed quantities for any individual CLIN or topic.

The solicitation is structured around performance outcomes and deliverables rather than a fixed number of records. Where historical starting sets or comparison materials are available, the Government will provide the applicable starting information in accordance with the task-triggered schedule. Actual retrieval volumes generated by the Contractor may differ from Government-provided starting sets because part of the purpose of the acquisition is to evaluate, validate, and refine the Contractor’s literature retrieval methodology.

42. Is 100% human verification of extracted fields/effect measures required, or is risk-based/sampled validation acceptable?

The solicitation does not require 100% manual human verification of every extracted field or effect measure. It requires the service to support human-in-the-loop review, including human-in-the-loop selection and review of extracted effect measures, and to produce traceable, reproducible, auditable outputs. Offerors may propose an appropriate quality-control and validation approach, including risk-based or sampled review where suitable, provided the approach is sufficient to demonstrate accuracy, traceability, reproducibility, and compliance with the PWS requirements. The Government may require additional review or correction where validation or QA identifies deficiencies.

43. Will NIOSH provide subscription database/full-text access, or must the contractor include all such costs in its FFP?

The Contractor should include in its Firm-Fixed-Price all costs necessary to obtain and maintain the subscriptions, licenses, database access, institutional access, or other lawful access needed to perform the required literature searches, screening, extraction, and related activities, except for the limited Government assistance described below.

CDC/NIOSH does not intend to provide general subscription access to commercial literature databases or publisher platforms for Contractor use. CDC/NIOSH will provide available full-text articles in its possession or accessible through Government resources when practicable. For paywalled articles that are not otherwise available to the Contractor, CDC/NIOSH may assist with obtaining and furnishing up to 50 articles per contract year, subject to availability and applicable licensing or copyright restrictions.

Accordingly, offerors should price the requirement assuming they are responsible for routine database, subscription, and full-text access costs necessary to perform the PWS.

44. What are the acceptance criteria for OCR, table parsing, and figure extraction accuracy?

For data extraction, where the extracted variables are not naturally binary, weighted accuracy may be calculated as the number of correctly extracted, human-validated data elements divided by the total number of evaluable data elements, with weighting based on the number of evaluated data elements across datasets or reviews. If an offeror elects to report sensitivity and specificity for a binary extraction task, the offeror should clearly define the positive and negative classes and the corresponding true-positive, false-negative, true-negative, and false-positive determinations. Offerors should provide supporting validation evidence and clearly describe the reference standard, validation dataset(s), sample size, methodology, treatment of missing or unevaluable data, and calculations used to determine performance for each stage.

45. What statistical methodologies, software compatibility, and validation criteria apply to contractor-generated meta-analytic models?

The solicitation does not prescribe a specific statistical methodology or statistical software package for contractor-generated meta-analytic models. The Contractor’s service must be capable, at baseline, of conducting data synthesis and meta-analysis; auto-selecting and extracting appropriate effect measures (e.g., relative risks, odds ratios, mean differences) with human-in-the-loop review;

generating meta-analytic models; and producing narrative summaries.

The Contractor should use statistically appropriate and scientifically accepted methods for the evidence type and review question and document the methodology, assumptions, decision logic, and outputs sufficiently to support Government review, reproducibility, auditability, and validation.

For compatibility, outputs must be provided in Government-specified or industry-standard formats acceptable to NIOSH, including, as applicable, Excel, CSV, RIS, EndNote-compatible files, PDF, and narrative reports. The solicitation does not require compatibility with a specific statistical software application.

Validation will be evaluated through comparison with human-generated results and other Government-provided validation information. Factor 1 requires demonstrated existing capability, including validation against human-reviewer results at greater than 85% sensitivity and specificity with supporting evidence, as well as human-in-the-loop quality control and a transparent audit trail. The solicitation does not establish a separate numerical validation threshold specifically for the statistical estimates produced by meta-analytic models.

46. May subcontracted/embedded third-party AI/model services be used, and what security/FedRAMP/data rights/disclosure requirements would apply to them?

Yes. Subcontracted, embedded, or third-party AI/model services may be used as part of the Contractor’s proposed commercial service, provided their use is consistent with the solicitation and all applicable contractual, security, privacy, FedRAMP/ATO, supply-chain, data-rights, and flow-down requirements are satisfied. The prime Contractor remains responsible for the performance and compliance of the overall proposed service.

Third-party services that process, store, transmit, or otherwise have access to HHS information, or that provide cloud/IT services within the scope of the contract, must be appropriately addressed within the proposed system/service architecture and authorization boundary, including applicable interconnections and dependencies. Applicable security and privacy requirements must be flowed down to subcontractors and third-party providers as required by the solicitation.

FedRAMP applicability will depend on the role of the third-party service and whether it is part of, or external to, the authorized cloud service/system boundary. The solicitation does not state that every individual third-party software or AI component must independently possess its own FedRAMP ATO; however, the overall information system/service must satisfy the applicable FedRAMP and HHS/CDC A&A requirements, and external cloud services or dependencies must be appropriately addressed and separately authorized where applicable.

The Contractor must also identify and appropriately protect any asserted Contractor or third-party intellectual property/data rights. Use of third-party technology does not alter the Government’s rights in Government data or contract-generated deliverables established by the solicitation. Any restrictions on deliverables or data rights must be identified and marked in accordance with the applicable contract clauses.

47. What is the nature/completeness of the human-generated comparison materials NIOSH will furnish for CY1 validation?

For CY1 validation, CDC/NIOSH will provide the initial starting set of information and available human-generated comparison materials relevant to the selected validation activity. These materials may include prior search results, screened/included literature sets, published review outputs, and other available NIOSH validation information suitable for comparison with Contractor-generated results. The specific composition and completeness of the comparison materials will depend on the selected topic and the historical materials available.

The Government does not guarantee that every comparison set will contain a complete record of all intermediate human-review decisions, extraction fields, or workflow artifacts. The materials furnished will be sufficient to support the comparative validation activities described in the PWS, and CDC/NIOSH will provide written feedback during the initial and repeat validation cycles.

48. What are the objective technical acceptance criteria for each deliverable type (search results, validation report, extraction output, meta-analytic deliverable)?

The solicitation is performance-based and does not establish separate numerical acceptance thresholds for each individual deliverable type beyond the requirements stated in the PWS. Deliverables will be accepted based on conformance with the applicable PWS/CLIN/CDRL requirements, completeness and technical validity, traceability and reproducibility, required content and format, and satisfactory resolution of Government review comments.

For search-results packages, the Government will assess completeness and validity of the literature results, required documentation and traceability, conformance with the applicable search/validation task, and delivery in the approved format. For validation/comparative reports, acceptance will consider whether the required comparisons to Government-provided human-generated or published results are performed, findings and discrepancies are adequately documented, and methods and conclusions are supported and reproducible.

For structured extraction outputs, the service must provide the required editable structured extraction, including source-linked information such as quotations and page numbers, applicable table/figure parsing and OCR, and support for human-in-the-loop review. For meta-analytic outputs, the service must support appropriate effect-measure extraction and selection with human-in-the-loop review, generation of meta-analytic models and narrative summaries, and sufficient documentation to permit technical review, traceability, and reproducibility.

The Government will perform 100 percent inspection of critical deliverables and subject-matter review at draft and final submission. Deficiencies identified during review must be corrected at no additional cost.

The greater-than-85-percent sensitivity and specificity criterion in Factor 1 is a demonstrated baseline capability requirement for validation against human-reviewer results; the solicitation does not establish that threshold as a separate acceptance criterion for every individual contract deliverable.

49. Would CDC consider issuing this requirement through GSA eBuy as a small business set-aside under SIN 54151S (IT Professional Services)?

No

50. For limitation-on-subcontracting purposes, will third-party software/subscription/database costs be excluded from the small-business prime's work percentage, or counted as subcontracted effort?

For purposes of any applicable limitation on subcontracting, third-party software, subscription, database, or cloud-service costs are not categorically considered subcontracted labor or effort, nor are they categorically excluded from the calculation. Other direct costs may be excluded where permitted, including where they are not the principal purpose of the acquisition and small business concerns do not provide the applicable service.

Whether a particular third-party software, database, subscription, or service cost is excludable will depend on the nature of that cost and its role in performance. Costs paid to a non-similarly situated entity for substantive services required to perform the contract generally count toward the applicable subcontracting limitation unless an authorized exclusion applies. Offerors remain responsible for structuring their proposed performance approach to comply with the applicable limitation-on-subcontracting requirements.

51. Which literature databases does CDC/NIOSH typically use for these systematic review projects?

The RFQ does not identify the databases that CDC/NIOSH typically uses and does not prescribe a fixed set of literature databases for all reviews. Database selection may vary by the occupational safety and health topic, review question, evidence stream, and search strategy. PubMed, Embase, Web of Science, Scopus, and NIOSHTIC-2 are examples for informational purposes only and should not be interpreted as a required or exhaustive list. The Contractor is expected to use appropriate bibliographic and scientific information sources necessary to generate comprehensive, reproducible literature pools and to document the databases/sources and search methods used. Where relevant historical search information is available for a validation topic, CDC/NIOSH will provide that starting information as part of the Government-furnished materials.

52. Can CDC/NIOSH provide representative SLR metrics (articles eligible for screening, unique variables extracted)?

CDC/NIOSH can provide general representative ranges for planning purposes, but these should not be interpreted as fixed or guaranteed quantities for any individual topic or CLIN. The number of articles eligible for screening varies substantially by topic, search breadth, evidence stream, and review type. For some OSH topics, the initial body of literature may be in the thousands to tens of thousands of records before deduplication and screening, while other topics may be considerably smaller. The number of unique variables extracted also varies by review question and study design. Extraction may include bibliographic and study-design fields, population characteristics, exposure and outcome variables, effect estimates, uncertainty measures, covariates, risk-of-bias elements, and other topic-specific fields.