Attachment A - Draft Statement of Work.docx

U.S. FOOD AND DRUG ADMINISTRATION

STATEMENT OF WORK

Scientific and Regulatory Support Services (SRS) Indefinite Delivery/Indefinite Quantity (IDIQ) Contract

TABLE OF CONTENTS

1.0 BACKGROUND

The Food and Drug Administration (FDA) is a science-based regulatory agency critically important to the stability of the nation's public health and health care systems. FDA protects and promotes the health and safety of all Americans by enhancing the availability of safe medical products, foods, and animal products, and by promoting innovation that addresses unmet medical and public health needs.

FDA decisions must be based on the best available scientific data and employ the best tools and methods available to ensure products meet the highest quality standards, while fostering innovation in the products it regulates. In support of its regulatory mission, FDA conducts scientific research across a broad range of disciplines including vaccines, drug safety, food safety, medical devices, biologics, toxicology, radiological products, and more. FDA's science is increasingly data-centric, complex, and collaborative, involving multidisciplinary groups across its Centers and Offices.

Within the Center for Drug Evaluation and Research (CDER), the Office of Computational Science (OCS), established under the Office of Translational Sciences, supports the data management, technical, and analytic needs of the regulatory review process. OCS manages and supports analytical tools, data standards, and computing infrastructure that form the backbone of modern regulatory review for medical products.

This combined SOW integrates the full scope of FDA's Scientific Support Services requirements with the Regulatory Review Support needs of FDA, creating a unified acquisition vehicle to deliver comprehensive scientific and regulatory review support services across all FDA Centers and Offices.

2.0 OBJECTIVES

The objectives of this combined IDIQ are to:

Provide access to an experienced set of scientific and technical professionals who will apply best practices and innovative processes across FDA Centers and Offices;

Support FDA's ability to modernize and transform its regulatory review approach to meet the challenges of advances in medical products;

Support the receipt, processing, management, and reviewer access to study data in standardized format in compliance with FDA Study Data Standards Resources;

Define requirements for and continue to develop the IT infrastructure needed to keep pace with evolving science and technology;

Provide resources for FDA's review tool development, process improvements, best practice development, and consultation needs; and Deliver scientific services that represent industry best practices, shared across all offices, divisions, and branches within the FDA to achieve improvement and advancement in scientific processes and procedures.

3.0 SCOPE OF WORK

The following scientific-related professional services and regulatory review support activities will be available across all FDA Centers and Offices:

Research and technical guidance related to policy across medical disciplines;

Consulting regarding improvements to IT and information management systems in support of scientific and regulatory review processes;

Scientific investigations, procedures, plans, clinical data analysis, and reporting;

Drafting of scientific documentation suitable for public dissemination;

Laboratory technical and administrative support;

Full-spectrum regulatory review support including data standards, statistical computing, knowledge management, training, and customer service support;

Outreach and communications support;

AI-augmented scientific and regulatory analysis leveraging emerging technologies;

Program and project management; and Transition support activities.

The scope does NOT include procurement of IT hardware unless specifically authorized in individual task orders, nor the development or implementation of custom IT systems or software. Specific details for all work will be defined and provided in each Task Order issued under this vehicle.

4.0 TASK AREAS

Independently, and not as agents of the Government, the Contractor shall perform tasks that provide scientific-related professional services and regulatory review support services for the FDA. The task areas to be performed under this combined vehicle are defined below. The labor categories to be applied to the task areas are detailed in Appendix 1.

Task Area 1 — Program and Project Management

The Contractor shall perform program and project management activities for the IDIQ and all Task Orders. These activities shall establish control, staffing management, monitoring, and notification mechanisms, and shall include working with Government IT Project Managers and Business Program Managers to ensure projects stay on track and that important milestones are met. The Contractor shall develop, maintain, and update a Program Management Plan (PMP) at the IDIQ level and a Task Order Management Plan (TOMP) for each Task Order, consistent with FDA's Enterprise Performance Life Cycle (EPLC) process and guidelines.

Representative activities include, but are not limited to:

Coordinating all required on-boarding and off-boarding activities (e.g., HHS-745, E-QIP, FDA 3398, FDA 3530, NAR forms);

Developing, reviewing, and maintaining the PMP and TOMP documentation;

Creating and managing work plans, project schedules, and work breakdown structures (WBS);

Tracking and managing cost expenditures and Capital Planning and Investment Control (CPIC) compliance for designated IT spend;

Preparing and posting required Status Reports on an FDA management system as directed by the COR;

Conducting weekly and quarterly project team meetings with all stakeholders;

Managing resources, including subcontractors;

Reporting program and Task Order level metrics;

Developing and implementing a proactive Quality Assurance Plan (QAP), updated annually;

Assisting FDA in responding to data calls and reporting requirements;

Coordinating contract kickoff meetings within 15 working days of award; and Proactively informing Contracting Officer Representatives (CORs) and Contracting Officers (COs) of any issues, problems, or recommendations.

Task Area 2 — IT Architecture and Integration Services

The Contractor shall provide high-level IT architecture consultation and integration advisory services to support integrated, end-to-end automated regulatory review solutions. The focus of this task area is exclusively advisory and analytical — the Contractor shall NOT develop, code, or implement IT systems or software under this task area. The goal is to provide strategic guidance on a stable evolutionary progression from the current state to an envisioned target state by recommending tools and technologies that work together to satisfy the current and future review processes and needs of FDA reviewers and scientific staff.

Conducting feasibility studies and advisory analyses to determine the most feasible solutions for developing and managing an integrated platform to support OCS services, systems, and tools;

Performing business analysis and modeling to recommend business solutions and strategies that promote data sharing and reuse of design components, data, workflows, and patterns;

Providing business process reengineering advisory support to develop current state (as-is) and future state (to-be) business models for regulatory review activities;

Recommending strategies to address business/mission needs, integration, interface, and interoperability challenges within and across technical environments;

Advising on the design of proposed system interfaces and system integration plans to ensure alignment with FDA standards and industry best practices;

Developing advisory integration and interoperability strategies for evolving, phasing-out, and phasing-in systems and tools;

Providing technology architecture advisory support consistent with OCS and FDA Enterprise Architecture standards, policies, and guidelines;

Authoring white papers and/or alternative analyses on new technologies or data management strategies;

Identifying functional gaps and efficiencies and coordinating recommendations with the Office of Information Management and Technology (OIMT); and Planning and conceptualizing pilots or prototypes at a strategic level to test new technology concepts that could benefit OCS/CDER, without performing hands-on development or implementation.

Task Area 3 — Statistical Computing Support

The Contractor shall provide statistical computing technical support using statistical analysis and visualization software, including but not limited to SAS, R, R Shiny, Python, C++, and other statistical programming or scripting languages. Statistical computing support requirements generally arise as specific requests from reviewers for assistance with study data analysis or statistical support for FDA exploratory research. The Contractor shall also provide statistical programming support to facilitate the management, integration, and harmonization of study data from disparate sources to support up-to-date analysis of drug safety data at the FDA.

Developing and testing SAS macros, templates, and utilities for the standard analysis and reporting of clinical and non-clinical study data, post-marketing data, and device data;

Analyzing requirements and developing programs in SAS, R, R Shiny, or other statistical programming languages to generate tables, listings, figures, and analysis-ready datasets for use by reviewers;

Providing technical support for the development of customized scripts to automate data input, curation, retrieval, manipulation, and/or analytical functions;

Supporting and maintaining a community repository of analysis scripts, including validation of methods and computations to ensure accuracy and correctness of resulting outputs; and Providing statistical programming support to reviewers for statistical simulation and modeling, SAS macro library maintenance, integration of analysis datasets across studies, and meta-analyses of safety results.

Task Area 4 — Data Standards

The Contractor shall provide subject matter expertise to support FDA's development, harmonization, testing, adoption, and implementation of open data and exchange standards for the regulatory review process and development of regulatory science. Data standard code lists and dictionaries that may be required include ISO, LOINC, SNOMED-CT, MedDRA, ICH E2B XML R2 and R3, CDISC SDTM, ADaM and SEND, IDMP, FAERS Product Dictionary, and WHO-Drug.

Gathering information and status of the regulatory review process framework specific to CDER and involved scientific disciplines;

Performing analysis of data formats, assets, standards, and regulatory review processes, including tools for data management, analysis, and reporting;

Identifying and documenting unique data requirements for each scientific discipline involved in the regulatory review process;

Developing, maintaining, or reviewing information modeling standards using open health-based standards such as HL7, CDA, and CDISC;

Developing and documenting a clear set of standards identification, development, review, and adoption processes;

Testing and documenting data and exchange standards with multidisciplinary focus groups to ensure processes are transparent, efficient, and meet task order requirements;

Providing technical support to FDA staff implementing standards management processes and terminology maintenance processes (e.g., terminology change control board); and Assessing and implementing technologies to utilize or replace data standards used in conjunction with eStudy data.

Task Area 5 — Knowledge and Records Management

The Contractor shall provide Knowledge Management (KM) and Records Management (RM) services consistent with the Presidential Records Management Initiative as implemented by each FDA Center. The goal is to develop, evolve, and maintain FDA KM capabilities required to improve collaboration, management, retrieval, and reuse of regulatory review artifacts and to improve transparency in decision-making across the full lifecycle of regulated products.

Conducting specialized KM assessments to baseline existing processes and determine more efficient and effective alternatives;

Developing the KM strategy and implementation plan aligned with the Records Management file plan for each office;

Developing and implementing a solution for storage and retrieval of analyses used for regulatory review to improve internal transparency, consistency, and knowledge sharing;

Providing strategic, technical, and management support to FDA's Records Management Initiative;

Developing a knowledge management and delivery plan for analysis scripts and reviewer service outputs;

Maintaining the general scientific IT knowledge management infrastructure (e.g., SharePoint scientific content) and managing inventory of scientific software licenses for designated offices; and Performing document management including identification of key documentation, file management per Agency/Center/Office file plans, establishing and maintaining file inventories, and disposition of files.

Task Area 6 — Data Management and Data Quality

The Contractor shall maintain and enhance the functionality, sustainability, and security of databases, data warehouse/repository environments, and other data delivery/management products, tools, and information resources of the FDA review communities. The Contractor shall develop, deploy, maintain, support, evolve, and fully document metadata, data relationships, database structures, interfaces, data acquisition and transformation processes, custom reports, and reporting tools designed to support regulatory review analytical activities.

Designing, developing, maintaining, and implementing data management architecture, policies (including governance), practices, and procedures to manage the full lifecycle of systems supporting data standards and analytical tools;

Developing and maintaining Standard Operating Procedures (SOPs) for loading and curation of study data into OCS-maintained tools (e.g., Janus, OCS Data Central, Study Data Platform, Analysis Studio);

Performing data curation activities such as terminology mapping, unit conversion, data editing, formatting corrections, and addressing data type and formatting issues;

Providing assistance to reviewers in integrating and filtering data from multiple studies within or across sponsor submissions to create custom datasets for analysis;

Providing data architecture support including recommending new data standards, developing logical data models, evaluating physical data models, and developing implementation strategies;

Performing data quality and validation activities;

Providing business and technical support to the Data Validation Platform (DataFit); and Providing technical support to FDA's Data Management Governance activities.

Task Area 7 — Business Analysis Support

The Contractor shall provide business analysis support to identify scientific computing needs; assess the impact of changes in the review process and technology; analyze and capture requirements; communicate with stakeholders about requirements; and monitor the development of solutions to ensure they meet requirements. The Contractor shall support the analysis, evaluation, and/or documentation of improvements to existing programs and business processes and recommend solutions for regulatory review process enhancements and support tools.

Analyzing and documenting as-is and to-be business processes/workflows required for the efficient delivery of OCS regulatory review and research support activities;

Facilitating requirements gathering sessions and communicating with stakeholders to elicit requirements and identify desired results;

Distilling complex business processes and requirements into actionable user stories with acceptance criteria;

Ensuring that business implications of applying new technology to the review environment are adequately addressed in solutions under consideration;

Overseeing system implementation and testing activities through user acceptance to validate performance and ensure business requirements are met effectively;

Providing business analysis support for OCS IT capital planning and management activities;

Providing ongoing reviews of existing processes and procedures to identify areas where improvements can be made; and Collaborating with the training team for knowledge transfer.

Task Area 8 — Training

The Contractor shall develop and execute a training strategy to provide the FDA reviewer community and scientific staff with advanced skills necessary to use analytical tools and data standards. The Contractor shall plan, develop, deliver, evaluate, track, and measure training programs for effectiveness in meeting business goals and objectives. The Contractor is expected to be well versed in multiple training development and delivery modalities to meet the needs of the FDA community.

Performing training assessments, evaluations, and analyses;

Developing training plans, training materials, user guides, and quick reference guides;

Developing and providing on-demand, web-based, and instructor-led training;

Updating training materials in line with updates to data standardization efforts and tools/analytics;

Developing watch-and-learn training resources utilizing eLearning software (e.g., Camtasia, Adobe Captivate and Presenter);

Developing interactive training modules utilizing software such as Adobe Presenter or Moodle;

Verifying that all personnel possess the education, experience, and training necessary for successful performance of contract requirements; and Providing direct user support via consultations, in-person, virtual, online, and phone.

Task Area 9 — Reviewer Customer Service Support

The Contractor shall provide customer and service delivery support to the FDA reviewer community through a variety of support delivery methods. The Contractor shall provide support to identify, diagnose, and resolve customer inquiries and technical issues related to FDA review tools and services. Providing specific support to reviewers to address unique needs as they apply analytics to their review of standardized and non-standardized data is essential for them to be successful and efficient.

Managing and providing tiered support for users through remote assistance, phone, in-person (deskside), email, instant messaging, or other approved collaboration tools;

Providing, enhancing, and maintaining a centralized hub of information and support for tools, services, and trainings for users;

Providing service request management, tracking, trending, analysis, and reporting;

Providing project teams with analytical information including customized reports to support informed decisions about tools, services, and training resources;

Assessing the support implications of FDA review tools and services as they relate to submissions;

Identifying, capturing, tracking, and reporting on customer service opportunities, trends, and feedback;

Providing data standards support and data curation support for reviewers with data loading issues;

Providing standard and custom analyses to reviewers of all disciplines utilizing a suite of tools to facilitate analysis and decision making (inclusive of clinical, non-clinical, and site inspectors); and Supporting the development of new services intended to support regulatory review, including requirements gathering, development, and deployment of services.

Task Area 10 — Outreach and Communication Support

The Contractor shall provide subject matter expertise to support FDA's outreach and communications efforts in support of regulatory review and scientific activities. Communications may be targeted to executive, medical, scientific, statistical, technical, professional, and/or non-professional staff. Communication mediums may include MS Office, Prezi, electronic display boards, graphics software, electronic rotator banners for websites, posters, reports, and advertisements.

Providing guidance and assistance in the development of outreach programs, identifying target populations, and developing tailored outreach materials;

Testing outreach material with focus groups and modifying based on feedback;

Assessing, designing, developing, and implementing program websites and web pages;

Assessing, designing, and developing communication graphics;

Developing, designing, and implementing program SharePoint sites and workspaces;

Using interactive and innovative presentation software to develop outreach program presentation support;

Providing guidance and expertise to identify and support the best platforms, communication technologies, and other vehicles to effectively disseminate information;

Supporting cross-Office and external (outside of FDA) communication needs; and Providing technical writing support for internal and external documents and publications.

Task Area 11 — AI-Augmented Scientific and Regulatory Analysis

The Contractor shall leverage Artificial Intelligence (AI), Machine Learning (ML), and advanced analytical technologies to augment and enhance FDA's scientific research, regulatory review analysis, and data-driven decision-making capabilities. This task area is focused exclusively on the application and advisory use of AI/ML tools and techniques to enhance scientific and regulatory analytical workflows — it does NOT include the development, programming, coding, or implementation of AI/ML systems or IT infrastructure. The Contractor shall apply best-in-class AI/ML capabilities to support FDA subject matter experts, scientists, and reviewers in extracting actionable insights from complex regulatory and scientific data.

Applying Natural Language Processing (NLP) and document AI techniques to analyze, summarize, and extract structured information from large volumes of regulatory submissions, scientific literature, and adverse event reports;

Leveraging Machine Learning (ML) and predictive analytics to support signal detection, safety trend analysis, and risk assessment in pre-market and post-market regulatory review workflows;

Using Generative AI (GenAI) and Large Language Models (LLMs) to support literature synthesis, regulatory document drafting assistance, and scientific question-answering under appropriate human oversight and governance frameworks;

Applying AI-driven data visualization and pattern recognition tools to enhance reviewer understanding of complex clinical, non-clinical, and real-world evidence datasets;

Supporting FDA subject matter experts in evaluating the scientific validity, regulatory implications, and limitations of AI/ML-based findings, ensuring outputs are independently validated before use in regulatory decisions;

Providing advisory analysis on emerging AI/ML technologies (e.g., deep learning, computer vision, reinforcement learning) relevant to regulatory science, including evaluating their applicability to FDA review contexts;

Assisting in the development of AI governance frameworks, responsible AI use guidelines, and human-in-the-loop review processes to ensure scientific integrity and regulatory compliance in AI-assisted workflows;

Supporting FDA-wide scientific knowledge synthesis by applying AI tools to aggregate, analyze, and surface insights from disparate data sources, including genomics, proteomics, and toxicological data; and Providing subject matter expertise on the regulatory implications of AI/ML-generated evidence, supporting FDA's ability to assess sponsor submissions that leverage AI/ML methodologies.

Task Area 12 — Research, Technical Guidance, Scientific Investigations, and Publishing

This task area consolidates foundational scientific support functions encompassing research, technical guidance, scientific investigations, and publishing across FDA Centers and Offices.

Research and Technical Guidance The Contractor shall provide scientific research support that will inform or result in technical guidance and expertise related to regulatory, pharmaceutical, public health, and manufacturing functions across the FDA Centers. Research areas include, but are not limited to, emerging technologies such as continuous manufacturing, 3D printing, nanotechnology, biosimilars, and biologics.

Scientific Investigations, Procedures, and Analysis The Contractor shall provide support for scientific investigations evaluating the feasibility and capability for various regulatory policies and actions including Standard Operating Procedures (SOPs), Manuals of Policy and Procedures (MAPPs), and Guidance documents. Scientific investigations may also involve surveillance and testing of pre- and post-market drugs and drug products.

Conducting data collection, database development and management, analysis (e.g., computational experiments/research, meta-analysis), and method development;

Performing critical reviews and technical surveys of industry capability and technology gaps not currently addressed by existing policies and actions;

Reviewing and editing clinical data plans, conducting data collections, performing data analysis, and writing assessment reports addressing data quality, sufficiency, and integrity; and Supporting the development and review of SOPs, MAPPs, and FDA-agency level and Center/Office guidance products.

Publishing The Contractor shall prepare and submit material to the Government for consideration to publish or present health research and consultation related to drug shortages and access due to quality and manufacturing issues, and public health emergencies related to drug quality, surveillance, and manufacturing processes that may have negative impacts on public health.

Task Area 13 — Laboratory Technical and Administrative Support

The Contractor shall provide support to assist, operate, maintain, calibrate, and repair various laboratory systems, instrumentation, and equipment. Examples include but are not limited to benchtop bioreactor systems, cell and biochemical analyzer systems, bio-layer interferometers, and protein purification systems.

Providing laboratory project-specific support tasks;

Assisting with upkeep of inventory of lab supplies;

Supporting sample collection, management, and analysis; and Performing data analysis and other related laboratory support activities.

Task Area 14 — Transition Services

The Contractor shall facilitate smooth and orderly transition-in and transition-out of contracted activities and services to ensure minimum disruption to vital Government business. The Contractor shall cooperate fully in the transition. At the IDIQ/IDIQ level, the Contractor will provide a minimum of 30 days allocated to transition-in and transition-out activities.

Transition-In Activities The Contractor shall provide Transition-In support to ensure knowledge transfer occurs from FDA Staff and other contractors to the incoming Contractor. Upon completion of the Transition-In period, the Contractor shall assume full operating accountability and responsibility for all tasks.

Developing a full Transition-In Plan from the Draft Transition-In Plan submitted with the Quote/Proposal;

Coordinating all on-boarding activities and obtaining secure badging for team personnel;

Engaging in regularly scheduled transition meetings and conducting a formal Kickoff Meeting;

Participating in knowledge transfer activities including shadowing incumbent staff; and Becoming knowledgeable with the OIMT technical environment, FDA's EPLC processes, and change control procedures.

Transition-Out Activities The Contractor shall facilitate the transition of contracted activities and services to the Federal Government or a follow-on contractor. The incumbent Contractor shall lead transition activities and provide no degradation of support to the Government during this period.

Leading Technical Exchange Meetings (TEMs) with the successor contractor to impart knowledge transfer of processes, projects, systems, applications, and databases;

Providing the successor contractor with shadow opportunities to facilitate information and process transfer;

Providing FDA with current versions of all documentation including native formats for diagrams and attachments;

Providing all licensing, renewal information, asset management records, software documentation, and training materials;

Providing a current inventory of all Government-owned assets used by the Contractor; and Providing full documentation of custom code, reports, process automations, scripts, and configurations with applicable configuration management information.

5.0 DELIVERABLES

All deliverables will be specified and detailed by the FDA in specific task orders. The Contractor shall guarantee that all required materials shall be delivered in an immediately usable and acceptable condition.

Deliverable Review Cycle: The COR will review and provide feedback on deliverables within ten (10) working days of receipt. The Contractor will have five (5) working days to review and incorporate feedback and resubmit. This 10/5-day cycle repeats until Government acceptance.

Deliverable Submission Requirements:

All deliverables shall be submitted in electronic formats (e.g., Microsoft Office, Adobe PDF);

FDA does NOT accept documents containing the use of macros;

Documents submitted via email must not include .exe, .mso, or any executable file types; and All artifacts (e.g., scripts, software, source code, documentation) developed under this contract shall become the property of the Government.

6.0 PERSONNEL

The Contractor shall ensure that all support personnel are adequately trained, possess the credentials specified in the appropriate labor categories, and are otherwise fully qualified to provide the high level of support required by this SOW prior to being assigned to Task Orders.

Key Personnel: The Program Manager IV shall be considered key personnel for the IDIQ/IDIQ contract. Additional key personnel may be designated at the task order level. At least 30 days prior to diverting any key personnel to other programs or contracts (or as soon as possible if an individual must be replaced), the Contractor shall notify the CO and submit comprehensive justification. The Contractor shall not divert or replace any key personnel without the written consent of the CO.

Training: All Contractor personnel must complete applicable FDA Information Security Awareness, Privacy, and Records Management training before performing any work under this contract and annually thereafter. The Contractor is responsible for ensuring all personnel maintain continuing educational requirements and qualifications.

Personnel Replacements: If any Contractor personnel require removal for misconduct, security reasons, or failure to perform satisfactorily, the Contractor shall provide a qualified replacement.

Non-Personal Services: No personal services shall be performed under this contract in accordance with FAR SuIDIQrt 37.1. All work requirements shall flow only from the COR to the Contractor's Project Manager. The Contractor shall not perform any inherently governmental functions.

7.0 PERIOD OF PERFORMANCE

The period of performance for this combined IDIQ/IDIQ contract consists of five (5) one-year ordering periods and an additional six (6)-month option period in accordance with FAR Clause 52.217-8, Option to Extend Services. Individual task orders may not exceed five (5) years (inclusive of option periods). The performance period end date of the last option period on individual task orders may not extend more than twelve (12) months beyond the last ordering period end date.

8.0 PLACE OF PERFORMANCE

The place of performance will be FDA Centers and Offices, predominantly in the Washington, DC Metropolitan area with concentrations in the Maryland locations of Bethesda, College Park, Laurel, Rockville, White Oak, Calverton, and Silver Spring. Specific place of performance, including telework authorization, will be specified in each individual task order. Normal hours of operation are Monday through Friday, 8:00 AM – 5:00 PM Eastern Time, except on Federal Government Holidays.

9.0 TRAVEL

Any travel undertaken under this IDIQ/IDIQ shall be in accordance with the Federal Travel Regulations (FTR). Travel must be approved in advance in writing by the COR. Costs associated with approved travel shall be reimbursed at actual cost or by established Government per diems, whichever is less. Local travel within the Washington, DC Metropolitan area shall not be reimbursed. Specific travel requirements will be defined at the task order level.

10.0 OTHER DIRECT COSTS (ODC)

Any Other Direct Costs (ODCs) will be specified in the individual task orders and must be clearly identified, explained, and substantiated in task order proposals.

11.0 GOVERNMENT FURNISHED EQUIPMENT / INFORMATION (GFE/GFI)

FDA will provide accounts (e.g., email, collaboration, SharePoint), laptops, PIV badges, and other equipment as required per individual task order. FDA will provide Development, Test, Pre-Production, and Production environments to accomplish the stated work. Government Furnished Information (GFI) will be accessible through the FDA network and paper copies as needed. The Contractor and Government shall maintain an inventory of all Government furnished equipment. At the end of the period of performance or termination of the task order or employee, the Contractor shall immediately return badges and all Government-owned property to the Task Order COR.

12.0 TECHNICAL STANDARDS AND GUIDELINES

Current standards and guidelines that must be followed include:

HHS Enterprise Performance Life Cycle (EPLC) — including waterfall and agile methodologies;

FDA Master Approved Technology (MAT) List — all proposed technologies not on the MAT List must receive approval before implementation;

FDA Security Authorization Process — in accordance with FISMA, OMB, and HHS requirements;

NIST SP 800-53 — Security and Privacy Controls for Federal Information Systems and Organizations;

NIST SP 800-37 — Guide for Applying the Risk Management Framework to Federal Information Systems;

Federal Information Security Management Act (FISMA);

FDA 3250 Series of Staff Manual Guide (SMG) Policies and HHS security policies;

FDA Project Management (PM) Processes — including Project Management Body of Knowledge (PMBOK);

Section 508 Standards — all electronic and information technology (EIT) must meet applicable accessibility standards at 36 CFR 1194;

FDA Data Quality Standards — for e-submissions and regulatory review (https://www.fda.gov/industry/study-data-standards-resources); and FDA Change Control and Configuration Management processes.

13.0 SECURITY AND PRIVACY REQUIREMENTS

All Contractor personnel shall comply with applicable federal laws, HHS policies, and FDA's Information Security and Privacy Policy (IS2P). Key requirements include:

Information Security Categorization: Confidentiality – Moderate; Integrity – Moderate; Availability – Moderate; Overall Risk Level – Moderate (per FIPS 199);

Controlled Unclassified Information (CUI) shall be handled in accordance with Executive Order 13556 and NIST SP 800-171;

All Contractor employees shall complete FDA's non-disclosure agreement (FDA 3398 Form) prior to performing work;

Incident Response: The Contractor shall report all suspected or confirmed information security and privacy incidents to the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery;

HSPD-12 Compliance: All personnel shall comply with Homeland Security Presidential Directive-12 and obtain PIV cards;

Position Sensitivity Designation: Tier 2 (Sensitive Moderate Risk/Public Trust) for all personnel, unless otherwise specified in a task order;

FedRAMP Compliance: All cloud service providers used under this contract must have a FedRAMP-compliant Authorization to Operate (ATO); and Encryption: All sensitive federal data shall be encrypted at rest and in transit using FIPS 140-2 validated solutions.

14.0 SECTION 508 COMPLIANCE

All electronic and information technology (EIT) developed, acquired, or maintained under this contract must comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d), and the standards set forth in 36 CFR Part 1194. Applicable standards include: E101.2 (Equivalent Facilitation), E203 (Access to Functionality), E204 (Functional Performance Criteria), E205 (Electronic Content), E208 (Support Documentation and Services), Chapter 6 (Support Documentation and Services), and 302 Functional Performance Criteria. Remediation of non-compliant materials is the responsibility of the Contractor at its own expense.

15.0 CONTRACT TYPES

The authorized contract types for orders issued under this combined vehicle are:

Firm-Fixed-Price (FFP);

Labor-Hour (LH); and Hybrid (combination of FFP and LH).

16.0 GOVERNMENT POINTS OF CONTACT

17.0 CONTRACTOR PERFORMANCE EVALUATIONS

In accordance with FAR 42.15, FDA will complete annual and final contractor performance evaluations utilizing the Contractor Performance Assessment Reporting System (CPARS) at https://www.cpars.gov/. Annual evaluations will coincide with the anniversary date of the contract. Final performance evaluations will be completed upon contract expiration. Evaluations will be stored for a 3-year period in CPARS.

18.0 PAYMENT AND INVOICING

All invoice submissions for goods and services must be made electronically through the U.S. Department of Treasury's Invoice Processing Platform (IPP) system at www.ipp.gov, in accordance with HHSAR Clause 352.232-71, Electronic Submission of Payment Requests (Feb 2022). Invoices that include labor hour line items must include supporting documentation to substantiate the number of labor hours invoiced for each labor category. Payment of invoices will be made based upon Government acceptance of the entire task or the tangible product deliverable(s) invoiced.