75F40121R00003_0002.pdf

(x)

75F40121R00003 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

DSAAG

Beltsville MD 20705 4041 Powder Mill Road

ATTN:

DHHS/FDA/OAGS/DSAAG

02/19/20210002

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

02/19/2021

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to respond to the Vendor questions that were received before the submission deadline and to make the updates to the solicitation and attachments listed in the response to the questions.

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

MICHAEL V. GEMMILL

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

Food and Drug Administration (FDA)

Center for Tobacco Product

Office of Compliance and Enforcement

Request for Proposal #: 75F40121R00003

Table of Contents

1. Background

2. Business and Technical Environment

3. Business Objectives

4. Scope of Work

5. Tasks

5.1. TRANSITION-IN

5.2. PROGRAM AND PROJECT MANAGEMENT

5.3. RECEIPT, REVIEW, AND PROCESSING OF RETAILER COMPLIANCE CHECK

INSPECTION DATA AND ASSOCIATED DOCUMENTS

5.4. TRANSITION-OUT

6. Place of Performance

7. Period of Performance

8. Government Points of Contact

8.1. Contracting Officer’s Authority

8.2. Contracting Officer’s Representative

9. Government Furnished Property

10. Travel Administration

11. Key Personnel

12. Security

13. Organizational Conflict of Interest

14. Do Not Compete

15. Non-Personal Services

16. Personnel Security Clearance requirements

17. 508 Standard Requirements

18. Inspection and Acceptance

19. General Invoicing Instructions

20. Federal Acquisition Regulation (FAR) Clauses

21. Health and Human Services Acquisition Regulation (HHSAR) Clauses

22. Contract Provisions

23. Proposal Preparation Instructions:

24. Basis of Award and Evaluation Criteria

This Request for Proposal (RFP) announcement constitutes the only solicitation that will be issued;

proposals are being requested and a written solicitation will not be issued. This requirement is being solicited as a competetive 8(a) small business set aside, and the Government contemplates a single award, hybrid Time and Material/Firm Fixed Price, IDIQ contract will result from this solicitation. The associated North American Industrial Classification System (NAICS) code for this procurement is 541611. Its associated Small Business Size Standard is $16.5 Million.

1. BACKGROUND

The FDA Center for Tobacco Product’s (CTP), Office of Compliance and Enforcement (OCE) has the authority to regulate tobacco products, manufacturers, and retailers. OCE regulates tobacco products, manufacturers, and retailers through a variety of enforcement methods. These methods include inspections of manufacturers and retailers, reviewing product regulatory submissions and notifications, and finding and analyzing print and electronic advertising, labeling, and promotions.

OCE is seeking data collection, review, compiling, and analysis services to enable OCE staff to effectively focus attention on the decisions and actions required to enforce tobacco regulations.

2. BUSINESS AND TECHNICAL ENVIRONMENT

In performing these services the contractor will be required to review and understand FDA guidance regarding the Tobacco Control Act and apply that understanding in the analysis of compliance records.

All services tasked through this IDIQ will be performed at the contractor’s facilities. On a task by task basis, the FDA will provide access to Government databases and systems. The majority of the work will be performed electronically. There is no need for the storage of a large volume of paper files. In providing services, the Contractor shall follow FDA/CTP-provided Standard Operating Procedures which are regularly reviewed and updated.

3. BUSINESS OBJECTIVES

Through this IDIQ, the Government seeks to achieve the following objectives:

Consolidate interrelated tasks to improve the efficiency and effectiveness of the FDA/CTP enforcement mission

Create infrastructure to manage the growth in enforcement related activities anticipated by CTP over the next five years

4. SCOPE OF WORK

This scope of work encompasses the following task areas:

Transition-In Program and Project Management Receipt, Review, and Processing of Retailer Compliance Check Inspection Data and

Associated Documents Transition-Out

5. TASKS

In performing services, the contractor will review and understand FDA guidance regarding the Tobacco Control Act and apply that understanding in the analysis of compliance records.

In performing services, the Contractor shall abide by Program changes needed to maintain efficiency of Program operations and accuracy of compliance check inspection data and evidence. Such changes may include, but are not limited to, template updates and order of procedures. The Government will issue tasks under this IDIQ to provide the following types of services:

5.1. TRANSITION-IN

Transition-In services provide orderly transition from the incumbent Contractor to the successor Contractor. The successor Contractor shall work toward the Government’s goal of ensuring minimal disruption to the current operational activities.

The Contractor shall provide Transition-In support during the transition period. The transition in period may be up to 60-90 days. Upon completion of transition in period, the Contractor shall assume full operating accountability and responsibility for all tasks.

Representative transition activities under this task area include but are not limited to:

Develop a Transition-In Plan to ensure full operating accountability and responsibility of the task order

Conduct and coordinate all on-boarding activities and obtain secure badging for all Contractor personnel

Engage in regularly scheduled meetings Participate in Transition-In meetings

Participate in knowledge transfer activities such as “shadowing” Ensure contractor key personnel are available to work immediately after Task

Order awards

5.2. PROGRAM AND PROJECT MANAGEMENT

Program management services provide overall management of the Task issued under this IDIQ, including the coordination and response to Task requests. Project management services address the management of each individual Task to ensure the appropriate execution of technical and management activities. Project Management also includes budget, schedule, and quality management of the Task.

Representative activities include:

Develop, maintain, and implement an approved quality assurance plan (QAP) for each task order. The QAP shall include quality assurance and quality control activities.

The Contractor shall provide reports on progress as specified under the individual task order.

The contractor shall perform project and program management activities for the collection, review, and analysis of relevant data for compliance reports and regulatory submissions. These management activities shall establish control, management, monitoring, and notification mechanisms and shall include working with and reporting to the COR and COR designees to ensure that tasks are executed.

Representative activities include but are not limited to:

Prepare a Contract Management Plan and Task Order Management Plan for each task order describing the technical approach, communication mechanisms, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout task order duration

Manage and coordinate requirements and requirements execution across all tasks Plan, organize, secure, and manage resources with appropriate knowledge and skills Maintain quality control through repeatable, managed processes Collect system and performance metrics associated with each task area, as will be defined in each Task Order Track and manage cost Proactively inform the designated COR and COR designee of any issues, problems and recommendations that should be addressed in order for the overall effective accomplishment of task order goals. Recommendations for actions that need to be taken by FDA or other contractors, shall be clearly defined and communicated to the COR or COR designee and have identified dates for completion

Provide monthly status reports to the COR and COR designee. Within the first thirty (30) days after task order award, the Contractor shall design, and the COR will approve a standard reporting format that includes the following types of information at a minimum:

o Status and progress of tasks by task order o Cost and schedule variances against agreed-upon baselines o Significant risks to scheduled deliverables and plans to mitigate them o Issues, recommendations and escalation o Progress against task order service level metrics o Recommendations for changes or additional activities to ensure that the tasks support progress on the overall objectives in section 3 o Specific metrics as described in a Plan of Action and Milestones (POAM), if associated with a specific Task Order Prepare materials for and participate in meetings including but not limited to:

o Project reviews, management briefings, stakeholder presentations, cross-agency information exchanges and other similar meetings o Disclosures as required by the conflicts of interest clause regarding financial relationships, plans to mitigate potential conflicts of interest, and any updates to organizational conflict of interest policies and procedures related to this requirement

5.3. RECEIPT, REVIEW, AND PROCESSING OF RETAILER COMPLIANCE CHECK

INSPECTION DATA AND ASSOCIATED DOCUMENTS

The Tobacco Control Act requires FDA to contract, where feasible, with states and U.S.

territories to inspect tobacco retailers. CTP receives and reviews inspection results from these programs to determine if administrative or enforcement action is necessary. As tasked, the Contractor shall provide services supporting the reception and review of inspection results to recommend administrative or enforcement action as necessary.

Representative activities include:

Shipping, receipt, data entry, review, compilation, and processing of documents associated with the Tobacco Retailer Compliance Check Inspection Program including inspection data.

Review activities may include compiling information into templates provided by

FDA, and research or verification of provided data via internet, mail, e-mail, or telephone.

Processing documents may include, data entry, uploading documents and creating cases in databases identified by the FDA. Documents associated with the Tobacco Retailer Compliance Check Inspection Program include, but are not limited to: inspection reports, administrative or enforcement notices and follow-ups, and details regarding tobacco retail establishments. These documents vary in length; however, the typical range is from one (1) page to twenty-five (25) pages.

Receiving documents from Retailers may include generating, scanning, uploading, or compiling documents, and tracking delivery of mailings.

Certain tasks under Task 5.3 will require delivery of documents to FDA’s White Oak campus in Silver Spring, Maryland, once a week. Couriered documents must be delivered to the contractor’s physical location so that they are processed the same day.

5.4. TRANSITION-OUT

Services to facilitate the transition of contracted activities and services to the Federal Government or to a follow-on Contractor at the end of the contract period of performance. The transition out period is thirty (30) days.

The Contractor shall provide transition out activities, to include, but not be limited to, a transition out plan, leading Technical Exchange Meetings (TEMs) with the successor to impart knowledge of all processes, systems, applications, and databases. During this period, the Contractor shall ensure no degradation in support provided under the task order. Between the COR designated turnover date and the end of the contract period of performance, the outgoing Contractor shall ensure all task order activities are closed out and provide sustainment support to complete the transition.

Representative activities under this task area include but are not limited to:

Providing FDA with current versions of all documentation developed, maintained, or updated under this contract, to include the native format for attachments and diagrams (e.g., Visio), with applicable configuration management information Providing FDA with a current inventory of all Government-owned assets used by the Contractor along with full support in the reconciliation of this inventory

Providing the successor with the ability to “shadow” and participate in knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

6. PLACE OF PERFORMANCE

Work is performed at a location designated by the contractor

7. PERIOD OF PERFORMANCE

The period of performance is a base period of one year plus four one-year option periods from the date of award.

Each Task Order will have its own individual period of performance.

8. GOVERNMENT POINTS OF CONTACT

Contracting Officer Michael Gemmill michael.gemmill@fda.hhs.gov

IDIQ Contracting Officer’s Representative (COR)

TBD

8.1. CONTRACTING OFFICER’S AUTHORITY

a. The Contracting Officer (CO) has responsibility for ensuring the performance of all necessary actions for effective contracting; ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this IDIQ and is the only person authorized to approve changes to any of the requirements under this IDIQ and resulting orders, and notwithstanding any mailto:michael.gemmill@fda.hhs.gov provision contained elsewhere in this IDIQ, this authority remains solely with the CO.

b. No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this IDIQ. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the IDIQ. The Government will not reimburse the Contractor for any work not authorized by the Contracting Officer, including work outside the scope of the IDIQ.

8.2. CONTRACTING OFFICER’S REPRESENTATIVE

The Contracting Officer (CO) may designate other Government personnel (known as the Contracting Officer’s Representative) to act as their authorized technical representative for IDIQ administration functions which do not involve changes to the anything within the IDIQ SOW, scope, price, schedule, or terms and conditions of the IDIQ. The COR may be changed at any time by the Government without prior notice to the Contractor by a unilateral modification to the contract.

The responsibilities and limitations of the COR are as follows:

1. The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and other responsibilities, which may or may not be specified in the

IDIQ.

2. The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the IDIQ pricing, terms or conditions. Any Contractor request for changes shall be referred to the CO directly or through the COR. No such changes shall be made without the expressed prior authorization of the CO. The CO may designate assistant or alternate CORs to act for the COR by naming such assistant/alternate(s) in writing and transmitting a copy of such designation to the Contractor.

The Contractor shall immediately contact the CO if there is any question regarding the authority of an individual to act on behalf of the CO under this IDIQ.

9. GOVERNMENT FURNISHED PROPERTY

All Government Furnished Property (GFP), to include information, material, and equipment, will be specified within the individual Task Orders. All GFP is the property of the Government and will not be transferred to any individual or agency, public or private, without the express written approval of the Contracting Officer, except as required for the specific performance of the Task Orders.

Each Task Order will identify Government Furnished Equipment and Government Furnished Information, as wel as the FDA Property Manager.

10. TRAVEL ADMINISTRATION

No travel is anticipated under this IDIQ. However, any travel costs incurred by the contractor within the Washington/Baltimore Metro area is considered local travel and will not be reimbursed. If travel is required, all requests for travel shall be submitted to the CTP COR and CO and must be approved in advance. All costs shall be in accordance with the Federal Travel Regulations and the Contractor will be reimbursed based on number of trips, number of persons traveling, lodging, per diem, air/rail, / car transportation. No Contractor travel expenses shall be reimbursed for ordinary, day-to-day performance under this contract.

Federal Travel Regulation: http://www.gsa.gov/portal/content/104790

11. KEY PERSONNEL

The contract Project Director is considered Key Personnel.

Additional requirements for Key Personnel will be specified in the individual Task Orders pursuant to Health and Human Services Acquisition Regulation (HHSAR) Clause 352.237-75, Key Personnel.

Name: TBD Email: TBD Phone: TBD

12. SECURITY

During the course of performance FDA will provide the contractor with data that is strictly confidential and shall not be disclosed to other than authorized individuals and organizations.

Contractor personnel shall sign the provided FDA Form 3398 - Commitment to Protect Non-Public Information within five days of receiving the form and prior to commencing any work involving information under issued tasks. The Form will specify all information designated as non-public.

Where task orders require Contractor access to FDA systems using FDA provided laptops or access to FDA Document Control Centers and Mailrooms, all contractor personnel utilizing those systems shall complete and sign the equip85, eArrive, and HHS 745 forms in order to be badged and gain systems access. The Contractor shall ensure the completion of these forms. Badging may take 21-31 business days and the Contractor shall reflect that in the timeline for a task order.

Confidentiality Definitions

a. Confidential Commercial Information:

Confidential commercial information is valuable data or information which is used in one's business and, if voluntarily submitted by the information's owner to FDA, is of a type customarily not disclosed to the public by the person to whom the information belongs or, if http://www.gsa.gov/portal/content/104790 not voluntarily submitted, is information which, if disclosed by FDA would be likely to cause substantial harm to the competitive position of the person to whom the information belongs or impair the agency's ability to obtain similar data in the future. Examples of records that may fall within the definition of confidential commercial information either in part or in their entirety include information in an application to market an unapproved product, or in an Establishment Inspection Report containing the results of an inspection of a regulated company.

b. Disclosure:

Disclosure means releasing, transferring, providing access to, or otherwise divulging to the public nonpublic information by any means of communication--including photographic, written, oral, electronic (including databases), or mechanical.

c. Nonpublic information:

Nonpublic information includes but is not limited to trade secret, confidential commercial, predecisional, or other information, such as personal privacy information about an individual, information provided by a confidential informant, techniques and procedures for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law, information that could reasonably be expected to endanger the life or physical safety of an individual, or information, which if disclosed, could reasonably be expected to interfere with enforcement proceedings (“open investigatory”). Information includes oral information, documents, photographs, data, and other records, in written (paper) or electronic form or other medium, which are either created or obtained by FDA and under FDA's control at the time the information is shared with the Contractor.

d. Personal privacy information:

Information about an individual, which, if disclosed, would constitute a clearly unwarranted invasion of personal privacy.

e. Pre-decisional information:

Pre-decisional information refers to information that is created by FDA in the course of its decision-making process and is not available to the general public. Pre-decisional information includes non-factual information contained in inter- or intra-agency records prepared during the process of FDA's deliberations and proposed policies before final adoption. A document that FDA considers to be pre-decisional may include confidential commercial or trade secret information.

f. Sponsor/ submitter:

A sponsor/submitter is an individual, partnership, corporation, or association that owns or submitted the nonpublic confidential commercial or trade secret information that is submitted to FDA. (Often a sponsor/submitter is the manufacturer of a product).

g. Trade secret information:

A trade secret is information that may consist of any commercially valuable plan, formula, process, or device that is used for the making, preparing, compounding, or processing of trade commodities and that can be said to be the end product of either innovation or substantial effort. There must be a direct relationship between the trade secret and the productive process. Trade secret information might be found in the same records that contain confidential commercial information.

FDA 1350 Access to Non-Public Information

All contractor and subcontractor employees are required to sign the Contractor's Commitment to Protect Non-Public Information Agreement form provided as an attachment to this contract (Attachment F). If a person who has signed this agreement resigns, is dismissed, or is otherwise no longer working on this contract, the contractor shall notify the FDA COR and Contracting Officer. Any new contractor and subcontractor employees assigned to this contract shall sign the form, and the contractor shall submit ten (10) days prior to commencement of work to the Contracting Officer.

The prime contractor, subcontractors, and consultants shall not be provided nor possess non- public information in any form unless written approval and a facility clearance have been granted.

Briefings

A FDA representative (typically, the COR or Regional Radiological Health Representative (RRHR):) will conduct an orientation briefing for the contractor/contractor employees. The briefing will stress: (1) the importance of protecting non-public information; (2) specified computer/ADP requirements as outlined in the DHHS Automated Information Systems

Security Program Handbook; and (3) the consequences of unauthorized disclosure of non-public information. Briefing updates will be conducted annually.

The contractor shall brief all contractor employees, subcontractors and consultants regarding the sensitivity of the information to be handled under the contract and of the responsibility to protect it. The briefing shall stress that the information is non-public and shall not be disclosed to any unauthorized source. The contractor shall conduct an updated briefing annually and shall submit a report to the FDA COR within ten (10) days after the briefing which includes: an outline of the briefing, a copy of any briefing materials, date briefing was conducted and the names of the attendees.

FDA 1354 Physical Security Requirements for Releasing Non-Public Information

Under the provisions of Title 21, United States Code, Section 331(j), the contractor shall establish and maintain comprehensive security measures for controlling access to non-public information released under a contract involving the processing of such information.

This clause applies to the contractor, any subcontractors, and any consultants. Non-public information will be released to only those persons authorized under this contract.

For transmittal of documents the contractor shall adhere to the following:

1. Documents to be transmitted internally shall be transmitted on a person-to-person basis between approved employees only.

2. Documents to be transmitted outside the contractor's facility shall be double-wrapped with the inner wrapping marked "FDA Privileged Information - Access Controlled".

The names and addresses of the sender and addressee shall be typed on both the inner and outer wrappings.

3. Documents to be transmitted back to the FDA or to another address designated by the FDA shall be transmitted by an approved employee or by U. S. Registered mail (return receipt requested). It shall be double-wrapped or wrapped by such a method as specifically approved in writing by the FDA Physical Security Office.

4. A receipt log shall be maintained for all external transmittals.

5. The contractor shall follow up all transmittals in order to obtain signed receipt within five (5) business days of transmittal. Failure of recipient to furnish such receipt shall be reported to the FDA Physical Security Office within ten (10) business days of transmittal.

If the contractor facilities have a current certification from the Defense Contract

Administration Services/Defense Logistics Agency (DCAS/DLA) as a "Secret" or higher classification, such rating will satisfy the FDA security requirements for the contractor's facility. Loss of such certification during the period of the contract will be cause for a possible issuance of a Stop Work Order pending review by the FDA's Physical Security Staff of the contractor's facility.

The contractor shall notify the FDA Physical Security Office in the event the DCAS/DLA rating is expected to be terminated.

Pending the outcome of any subsequently required investigation, additional requirements on the contractor shall include, but not be limited to, the following: restrictions on access to data by contractor employees, subcontractor employees, and consultants; special storage requirements; restrictions on transmission and disclosure of information; changes in periods of retention and in methods of destruction of source documents or related material; and disclosure statements for all contractor employees, subcontractor employees, and consultants.

The FDA Physical Security Staff may review the contractor's facility and assess the contractor's compliance. Recommendations for bringing noncompliant areas into compliance will be provided to the contractor by the FDA Physical Security Office.

The Contractor shall make any changes necessary within thirty (30) days after written notice from the FDA Physical Security Office in order to comply with FDA security requirements.

When appropriate changes have been made the Contractor shall contact the FDA Physical Security Office to request further review by the FDA. The FDA Physical Security Office will notify the Contractor in writing of the outcome of the second inspection. Failure of the contractor to satisfy FDA security requirements within thirty (30) days after the first written notification from the Contracting Officer may be cause for termination of the contract.

The contractor shall designate a Security Representative to act as liaison between the contractor and the FDA on all security-related matters. This includes personnel changes, personnel terminations, disciplinary actions, etc. The name of the Security Representative shall be provided in the offeror's proposal.

The contractor shall ensure compliance with IT security requirements, including the following:

DHHS Information Security and Privacy Program http://www.hhs.gov/ocio/securityprivacy/index.html

Federal Information Security Management Act (FISMA) http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf

National Institute of Standards and Technology (NIST) SP800-53 http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-http://www.hhs.gov/ocio/securityprivacy/index.html http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

01-2010.pdf

FDA Security Authorization process, which closely resembles NIST SP800-37 http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

Format and Media: The Contractor shall furnish deliverables in a manner consistent with the FISMA and NIST security requirements of the information provided. For example, the contractor shall not send Sensitive Personal Identifying Information via e-mail across the internet.

SECURITY REQUIREMENTS FOR PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR

PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location.

In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ ] Low [ X ] Moderate [ ] High Overall Risk Level: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that task orders may involve:

[X ] No PII [ ] Yes PII Specific security requirements will be specified in individual task orders

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level may potentially be : [ ] Low [ ] Moderate [ ] High Specific PII Impact Level will be specified in individual task orders

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information

[PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send FDA approved notifications to affected individuals as directed by FDA’s SOP.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the FDA Systems Management Center, COR, CO, and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour of discovery/detection, and consistent with the applicable FDA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of…