RFQ updated.pdf

75F40125Q00448 FDA Digital Surveillance & Intelligence Subscription Services

Food and Drug Administration

Combined Synopsis Solicitation

BACKGROUND, STATEMENT OF WORK, CONTRACT

ADMINISTRATION, AND CLAUSES

NAICS Code:

511210 (Software Publishers)/Product Service Code: D317 (IT and Telecom: Web-Based Subscription)

This is a combined synopsis/solicitation for commercial items prepared in accordance with the Federal Acquisition Regulation (FAR) format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. It is the Government's intent to issue a Firm Fixed Priced Purchase Order in accordance with FAR Part 13.

The solicitation number is 75F4012Q00448. This solicitation is issued as a Request for Quote (RFQ).

The solicitation document and incorporated provisions and clauses in effect through the Federal Acquisition Circular 2025-03, effective January 2025. FAR and HHSAR provisions and clauses referenced in this RFQ can be found on the following website:

https://www.acquisition.gov/browse/index/far

This requirement is being competed as a Total Small Business Set-Aside.

https://www.acquisition.gov/browse/index/far

1. Background FDA Centers and Offices face rapidly evolving challenges in monitoring public health threats and ensuring regulatory compliance in the digital environment. Traditional reporting systems capture only a fraction of real-world signals, leaving blind spots in adverse event detection and regulatory oversight. At the same time, pharmaceutical promotion, online marketplaces, and global supply chains are increasingly digital, creating new risks that demand continuous, automated monitoring.

To address these gaps, FDA requires subscription access to an integrated digital intelligence platform that supports five mission-critical use cases: (1) social listening for drug safety surveillance, (2) due diligence for bioterrorism investigations, (3) early warning for outbreaks and supply chain disruptions, (4) surveillance of illegal drugs and supplements, and (5) monitoring of online pharmaceutical advertising.

These capabilities will enable FDA to move from fragmented, manual monitoring toward proactive, real-time surveillance. The subscription platform will provide actionable insights, automated reporting, and compliance frameworks while ensuring adherence to FDA’s cybersecurity, privacy, and regulatory requirements. This integrated approach will create synergies across multiple FDA offices while maintaining the specialized functions needed to address each use case, strengthening FDA’s ability to fulfill its mission of protecting public health in an increasingly digital world.

2. Purpose The purpose of this task order is to acquire a commercially available license subscription to an integrated digital intelligence and surveillance platform with service support. The subscription shall provide access to API’s, dashboards, and data feeds that enable FDA to monitor, analyze, and respond to public health risks across digital channels.

This acquisition will allow FDA to transition from manual, fragmented monitoring processes to proactive, automated surveillance capabilities, ensuring timely detection of emerging risks and consistent compliance oversight. The platform must support five critical use cases:

1. Social Listening for Drug Safety Surveillance

2. Due Diligence for Bioterrorism Investigations

3. Early Warning for Outbreaks and Supply Chain Disruptions

4. Illegal Drugs and Supplements Surveillance

5. Pharmaceutical Advertising Monitoring

3. Requirements The Contractor shall provide FDA with subscription access to commercially available platform modules supporting the five use cases below. Subscriptions must include user licenses, API’s, dashboard access, regular data updates, and service support (training, bug fixes, system enhancements). The Contractor shall ensure the solution is available to FDA personnel through secure login credentials.

3.1 Functional Requirements (Use Case Modules)

• Social Listening Module: Must capture, aggregate, and analyze online discussions across social media, forums, and review sites; identify mentions of specific drugs and potential adverse events; and generate reports and visual dashboards.

• Due Diligence Module: Must provide entity screening, risk profiling, and relationship mapping for companies or individuals associated with bioterrorism investigations and import holds.

• Early Warning Module: Must continuously monitor online sources (health blogs, news outlets, supply chain alerts) to detect signals of outbreaks or disruptions, using anomaly detection and NLP methods.

• Illegal Drugs & Supplements Module: Must detect unlawful drugs and fraudulent dietary supplements marketed online, issue automated violation reports, and support FDA enforcement workflows.

• Advertising Monitoring Module: Must capture, catalog, and evaluate online pharmaceutical advertisements; assess compliance with FDA regulations (e.g., Form 2253, 21 CFR Parts 202 and 314); and generate compliance trend analyses.

3.2 Salient Characteristics:

• Ability to operate through an ensemble of highly specialized deep neural architectures engineered for distinct cognitive domains that collectively mirror human analytical capabilities.

• Ability to enable constant inter-model communication where neural architectures share insights and build consensus interpretations similar to collaborative processing between different cortical regions in human cognition.

• Ability to process audio and visual content from global news feeds, social media streams, and public broadcasts while interpreting contextual cues, crowd behaviors, and environmental indicators.

• Ability to continuously map complex relationships across seemingly unrelated data points, connecting pharmaceutical supply chain disruptions to emerging symptom clusters or linking social media sentiment shifts to behavioral changes.

• Ability to parse communications across multiple languages and cultural contexts while tracking how information and behaviors propagate through different community structures.

• Ability to process structured and unstructured datasets (from structured epidemiological databases to social conversations, darknet forum discussions.)

• Ability to map the social and digital geography of information flow across different communities and networks.

• Ability to predict where health threats are likely to emerge next and which populations are most vulnerable, enabling proactive rather than reactive public health responses.

• Ability to enable each user to individually train the system's neural networks to identify signals, patterns, and trends specific to their unique operational requirements and domain expertise through private customer instances.

• Ability to allow users to fine-tune models by providing labeled examples of what constitutes meaningful signal within their specific context, whether identifying pharmaceutical adverse events, infectious disease patterns, or dangerous health trends.

• Ability to learn each user's analytical priorities and prioritize different types of information based on historical decisions and feedback.

• Ability to continuously refine understanding of what constitutes actionable intelligence for particular users as they interact with findings, mark alerts as high-priority, dismiss false positives, or request deeper analysis.

• Ability to continually adapt its processing network to move with the speed of data as applications and platforms shift in usage patterns.

• Ability to move at digital velocity while maintaining analytical depth, identifying where critical health information is being generated, shared, and consumed across different population segments.

• Ability to surface the most relevant signals from vast global data while filtering out noise that might overwhelm human decision-makers.

• Ability to understand nuanced context that makes certain signals relevant to specific users, creating personalized AI analysts increasingly attuned to each user's analytical needs.

• Ability to provide secure web-based dashboards and role-based user licenses for FDA staff.

• Ability to offer data export in FDA-approved formats (CSV, JSON, XML, PDF/A).

• Ability to maintain ≥95% system uptime and real-time or near real-time data ingestion.

• Ability to provide complete audit logs of system usage, data sources, and alerts for traceability.

• Ablity to scale to support additional FDA users, higher data volumes, or expanded modules.

3.3 Service & Support Requirements

• Provide product enhancements, security updates, and bug fixes throughout the subscription term.

• Maintain a knowledge base, online support portal, and help desk with defined service-level response times.

• Provide onboarding support, configuration assistance, and technical advisory services.

• Deliver user training (remote or in-person) and updated user guides/manuals.

• Assign an account manager to coordinate with FDA program staff.

3.4 Deliverables

• Active subscription licenses for all five modules.

• User accounts and API keys provisioned within 10 business days of award.

• Monthly intelligence reports and automated alerts aligned to use cases.

• Quarterly updates on new features, enhancements, and resolved issues.

• Technical documentation covering APIs, dashboards, data structures, and entitlements.

4. Proposal Instructions The Government intends to evaluate Volume I (Technical Approach) and Volume II (Price) concurrently.

Both volumes must be submitted in full by the solicitation closing date.

The FDA is not responsible for any costs incurred in preparing the proposal documents described in this RFP. Offerors are reminded to clearly mark any proprietary information with the legend “Proprietary Information.” The Government reserves the right to evaluate only the information provided by the Offeror within each volume when formulating its evaluation. The Government also reserves the right to make an award decision without conducting discussions or post-submission communications with Offerors.

• Deadline: Volume I and Volume II proposals must be submitted by 9/18/2025, at 2:00 PM EST.

• Format: Electronic submission not exceeding 10 pages total (excluding appendices).

o The Offeror shall submit all electronic documents for Microsoft Office suite products without the use of “macros.” Executable file types (e.g., exe, mso) will not be accepted.

Submissions with macros, macro-referenced files, or executables will be deemed non-responsive, and no additional time will be given to correct the submission.

• Content:

o Volume I – Technical Approach: Provide an executive summary and describe the approach to:

Program and Project Management (cross-cutting across all use cases).

Development and implementation of the Social Listening Tool for Drug Safety

Surveillance.

Development and implementation of the Due Diligence System for Bioterrorism

Investigations.

Development and implementation of the Early Warning Web Scraping System for Outbreaks and Supply Chain Disruptions.

Development and implementation of the Illegal Drugs and Supplements

Surveillance Platform.

Development and implementation of the Pharmaceutical Advertising

Monitoring Tool.

Quality assurance, cybersecurity compliance, and system integration.

A proposed timeline demonstrating efficiency, scalability, and compliance with

FDA and HHS requirements.

o Volume II – Price: Provide a detailed cost proposal aligned with the technical approach, including assumptions, labor categories, and scalability considerations for potential expansion in subsequent phases.

• Questions: Submit inquiries to [Insert CO Name and Email Address] by [9/12/2025], at 2:00 PM EST. Responses will be posted publicly to ensure fairness. The subject line shall read:

“RFP for Digital Intelligence and Surveillance Tools – Questions.”

FDA may not answer questions received after this deadline and will not answer questions submitted by phone or to individuals other than the named contacts. Offerors are responsible for confirming receipt of proposals and/or questions by contacting the designated Contract Specialist/Contracting Officer.

5. Proposal Evaluation The Government will conduct a best value tradeoff evaluation considering both technical approach and price. Given that this procurement is a direct award to an Small Business the evaluation will be conducted at a high level to ensure compliance, feasibility, and alignment with FDA requirements.

• Volume I – Technical Approach will be evaluated for:

o Demonstrated understanding of FDA’s surveillance and monitoring requirements across all five use cases.

o Compliance with FDA, HHS, and federal cybersecurity/data security standards, including handling of sensitive data (e.g., CUI, PII, trade secrets).

o Feasibility, scalability, and robustness of the proposed solutions, including program management, quality assurance, and interoperability across multiple FDA offices.

o Clarity, efficiency, and realism of the proposed timeline.

• Volume II – Price will be evaluated for:

o Reasonableness and realism of proposed costs in relation to the technical approach.

o Ability to support scalability for potential expansion in future phases.

6. Contract Administrative Information The Contractor shall ensure that all support personnel are adequately trained, possess the credentials specified in the appropriate labor categories, and are otherwise fully qualified to provide the high level of support required by this SOW prior to being assigned to Task Orders awarded.

6.1. Place of Performance

The place of performance will be at the contractor location.

6.2. Contract Type

This is a Firm Fixed Price Contract.

6.3. Hours of Operations and Closing

For the purposes of this contract, normal business hours will be Monday through Friday, between the hours of 8:30 AM and 5:00 PM Eastern Time (ET).

The following are exceptions to normal business hours:

• Emergency responses to system outages and system releases after hours will be determined on a case-by-case basis.

• Friday night, weekend, and holiday release implementations shall not be considered overtime.

• The Contractor shall make every effort to modify their work week to incorporate any evening, weekend, or holiday work into their normal 40-hour week.

• The Contractor shall have the option to work during Government holidays and shall not be considered overtime

• The Contractor shall typically not work more than 10 hours in one day.

For any other unscheduled closings, the Contractor shall seek guidance from the COR.

The Contractor is not required to provide on-site services on Federal holidays. The Government is closed on the holidays listed below. Specific dates for these holidays can be found at the Office of Personnel Management (OPM) website located at:

https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal- holidays/#url=Overview

• New Year’s Day

• Birthday of Martin Luther King, Jr.

• Washington’s Birthday https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url%3DOverview https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url%3DOverview

• Memorial Day

• Juneteenth

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

For specific task orders, the Contractor shall take into consideration the above holidays when developing project plans/schedules. In addition, the Contractor shall obtain additional blackout dates from the COR.

6.4. Government Point of Contact

Contract Specialist Lilibeth Deato Lilibeth.deato@fda.hhs.gov

Contracting Officer

TBD

Contracting Officer’s Representative

TBD

6.5. Contracting Officer’s Authority

a) The Contracting Officer (CO) has responsibility for ensuring the performance of all necessary actions for effective contracting, ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this BPA and is the only person authorized to approve changes to any of the requirements under this BPA and resulting orders, and notwithstanding any provision contained elsewhere in this BPA, this authority remains solely with the CO.

b) No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this BPA. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the BPA. The Government will not reimburse the Contractor for any work not authorized by the Contracting Officer, including work outside the scope of the BPA.

7. Security and Privacy Requirements

7.1. Information Security and/or Physical Access Security Requirements

7.1.1. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

mailto:Lilibeth.deato@fda.hhs.gov

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information; Integrity, which means guarding against improper information modification or destruction, and ensuring information non- repudiation and authenticity;

and

b. Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X] Low [] Moderate [ ] High Integrity: [ X] Low [] Moderate [ ] High Availability: [X ] Low [] Moderate [ ] High Overall Risk Level: [X ] Low [] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes, PII Personally Identifiable Information (PII).

Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a Need-To-Know basis.

c. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for

Federal Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA- provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that the COR is able to access and read any encrypted data.

• Company and point of contact name;

• Contract information;

• Impact classifications/threat vector;

• Type of information compromised;

• A summary of lessons learned; and

• Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future.

7.1.2. Media Transport

1) The Contractor and its employees shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital and non-digital media (e.g., CD- ROM, tapes, etc.), mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards).

2) All information, devices and media must be encrypted with HHS/FDA- approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities. Storage devices must be approved on the FDA Master Approved Technologies (MAT) list.

7.1.3. Boundary Protection: Trusted Internet Connections (TIC)

1) The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities using cloud services is inspected by Trusted Internet Connection (TIC) processes.

2) The contractor shall route all external connections through a TIC.

3) Non-Repudiation. The contractor shall provide a system that implements FIPS 140-2 validated encryption that provides for origin authentication, data integrity, and, for high impact systems, signer non-repudiation.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

8. Section 508 Compliance Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access- board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov.

The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Sections apply to this procurement:

• E101.2 - Equivalent Facilitation

• E203 - Access to Functionality

• E204 - Functional Performance Criteria

• E205 - Electronic Content

• 302 - Functional Performance Criteria

• E208 Support Documentation and Services

• Chapter 6 - Support Documentation and Services

Contract Officer’s Authority _________________________________________________________

The Contracting Officer (CO) is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the http://www.access-board.gov/ http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/

RFQ; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract. No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this award. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the award. The Government will not reimburse the Contractor for any work not authorized by the Contracting Officer, including work outside the scope of the award.

The Contracting Officer’s Representative (COR) is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the contract and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

Clause- HHSAR 352.239-74 Electronic Information and Technology Accessibility (December 2015)

a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, or maintained under this contract or order must comply with the “Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 1194.

Information about Section 508 is available at http://www.hhs.gov/web/508.

b) The Section 508 accessibility standards applicable to this contract or order are identified in the Statement of Work or Specification or Performance Work Statement. The contractor must provide any necessary updates to the submitted HHS Product Assessment Template(s) at the end of each contract or order exceeding the simplified acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

c) The Section 508 accessibility standards applicable to this contract are:

i. E101.2 Equivalent Facilitation

ii. E203 Access to Functionality

iii. E204 Functional Performance Criteria

iv. E205 Electronic Content

v. 302 Functional Performance Criteria

vi. E208 Support Documentation Services

vii. Chapter 6: Support Documentation and Services http://www.hhs.gov/web/508

d) In the event of a modification(s) to this contract or order, which adds new EIT supplies or services or revises the type of, or specifications for, supplies or services, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards.

Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found under Section 508 policy on the HHS website: (http://www.hhs.gov/web/508). If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

e) If this is an Indefinite Delivery contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include EIT supplies or services will define the specifications and accessibility standards for the order. In those cases, the Contractor may be required to provide a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found at http://www.hhs.gov/web/508. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(End of clause)

Provision- HHSAR 352.239-73: Electronic and Information Technology Accessibility Notice (Dec 2015)

a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

b) Accordingly, any Quoter responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and- standards/communications-and-it/about-the-section-508-standards.

c) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at

352.239-74, Electronic and Information Technology Accessibility.

http://www.hhs.gov/web/508) http://www.hhs.gov/web/508 https://www.hhs.gov/web/508 http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-352-solicitation-provisions-contract-clauses/index.html#352.239-74

9. Travel None Contracting Officer and approval must be obtained by the Contracting Officer prior to reserving a rental vehicle.

9.1. Local Travel

Travel performed for personal convenience or daily travel to and from work at the Contractor’s facility or local Government facility (i.e., designated work site) within the Washington DC metro region shall not be reimbursed hereunder. “Local” is defined under this term as the travel destination located within the Washington, D.C., its surrounding metropolitan area, the Contractor’s facility and its surrounding area.

10. Invoicing Instructions HHSAR 352.232-71 Electronic Submission of Payment Requests (FEB 2022)

a. Definitions. As used in this clause—Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

b. Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

c. The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

d. If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of clause)

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

1. All Invoice submissions for goods and or services must be made electronically through the U.S.

Department of Treasury’s Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.htm

2. Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial items contracts. The IPP website address is:

https://www.ipp.gov.

3.

(1) The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank http://www.ipp.gov/vendors/index.htm https://www.ipp.gov/ of St. Louis (FRBSTL) within 3 – 5 business days of the contract award for new contracts or date of modification for existing contracts.

(2) Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

(3) The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

(4) If your company is already registered to use IPP, you will not be required to re-register.

(5) If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

4. Invoices that include Firm Fixed Price or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

5. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

(1) At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

- Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

- Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

- Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

- Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

- Fee – amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

6. Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(1) list of all invoices submitted to date under the subject award, including the following:

- invoice number, amount, & date submitted

- corresponding payment amount & date received

- total amount of all payments received to date under the subject contract or order

- and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

7. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

8. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

9. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

10. The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

11. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

11. Contract Clauses

HHSAR CLAUSES INCORPORATED BY REFERENCE

This contract incorporates one or more clauses by reference, noted in Title 48, Federal Acquisition Regulations System, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at: http://farsite.hill.af.mil/VFHHSARA.HTM.

352.203-70 Anti Lobbying (December 18, 2015) 352.208-70 Printing and Duplication (December 18, 2015)

352.222-70 Contractor Cooperation in Equal Employment Opportunity Investigations (December 18, 2015)

352.224-71 Confidential Information (December 18, 2015) 352.231-70 Salary Rate Limitation (December 18, 2015) 352.239-73 Electronic Information & Technology Accessibility Notice (December 15, 2015)

FAR CLAUSES

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) http://farsite.hill.af.mil/VFHHSARA.HTM

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Nov 2021) 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) 52.217-7 Option for Increased Quantity – Separately Priced Line Item (Mar 1989) 52.217-8 Option To Extend Services (Nov 1999( 52.217-9 Option To Extend The Term of the Contract (Mar 2000) 52.227-19 Commercial Computer Software License (Dec 2007) 52.232-39 Unenforceability of Unauthorized Obligations (Jun…