RFP 75N91023R00042_Final w attach.pdf

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1.Requisition or other Purchase Authority: Public Law 92.218 as amended.

2. Request for Proposal (RFP) Number: 75N91023R00042

3. Issue Date:

May 1, 2024

4. Set Aside:

[X] No [ ] Yes See Part IV Section L

5. Title: Childhood Cancer Data Initiative (CCDI): Research Molecular Characterization

6. ISSUED BY:

Office of Acquisitions National Cancer Institute National Institutes of Health 9609 Medical Center Drive Rockville, MD 20850

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of Proposals," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of Proposals," until 3 PM Eastern Time on June 14, 2024. Offers will be valid for 120 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.”

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING

AND DELIVERY OF PROPOSALS."

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HER

DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS,

THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH

subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors—Competitive Acquisition," LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) prior to award of a contract. Offerors must access the CCR through The System for Award Management (SAM) at https://www.sam.gov/SAM/ .

11. FOR INFORMATION CALL:

Julia Tilton Phone: (240) 276-5576 e-mail: julia.tilton@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

The cutoff date for questions is May 8, 2024, at 3PM, EST.

Questions shall be submitted via email to Julia Tilton at julia.tilton@nih.gov, and shall reference the RFP number in the subject line of the email.

Erin Felent Contracting Officer

Office of Acquisitions, NCI erin.felent@nih.gov http://www.sam.gov/SAM/ mailto:julia.tilton@nih.gov mailto:julia.tilton@nih.gov mailto:erin.felent@nih.gov

RFP Number: 75N91023R00042

RFP Table of Contents

PART I - THE SCHEDULE

SECTION A - SOLICIATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE…………………………………………………………………………..8

SECTION F - DELIVERIES OR PERFORMANCE…………………………………………………………………………..9

SECTION G - CONTRACT ADMINISTRATION DATA…………………………………………………………………….11

SECTION H - SPECIAL CONTRACT REQUIREMENTS………………………………………………………………….14

PART II - CONTRACT CLAUSES…………………………………………………………………………………………….25

SECTION I………………………………………………………………………………………………………………………25

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS…..……………………………………43

SECTION J - LIST OF ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS…………44

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS……………………………………..63

SECTION M - EVALUATION FACTORS FOR AWARD…………………………………………………………………...89

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The goal of this acquisition is to support research molecular characterization of biospecimens in support of, but not limited to, the ongoing research programs conducted under the Childhood Cancer Data Initiative (CCDI).

Characterization of genes, proteins, metabolites, and other related markers will include performance of measurements such as genomic and transcriptomic sequencing, analysis of protein expression and post-translational modifications (PTMs) in tissues, and other complex, state of the art, non-clinical-grade assays. Biological materials will be obtained from a variety of sources and geographical locations and delivered to the Contractor for characterization, data analysis, and deposition of data in CCDI-specified data repositories. The NCI/CBIIT requires technical support for these studies.

ARTICLE B.2. PRICES

The final contract will contain the price provisions agreed upon by the Government and the Offeror.

ARTICLE B.3. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE I.2.

ADDITIONAL CONTRACT CLAUSES, this contract consists only of the Base Period specified in the Statement of Work as defined in SECTIONS C and F, for the price set forth in ARTICLE B.2. of this contract.

b. Pursuant to FAR Clause 52.217-6 set forth in ARTICLE I.2. ADDITIONAL CONTRACT CLAUSES of this contract, the Government may, by unilateral contract modification, require the Contractor to perform the Option Period(s) specified in the Statement of Work as defined in SECTIONS C and F of this contract. If the Government exercises this/these option(s), notice must be given before the expiration date of the contract.

Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The fixed price of this contract will be increased as set forth in paragraph c., below.

c. Upon the delivery and acceptance of the Option Item described in SECTION C of the contract and identified in the schedule of charges below, the Government shall pay the Contractor the unit price(s) set forth below:

Option Period

Description of Option Item(s) -or- Option Service(s)

Unit Price

Total Price of

TBD TBD TBD TBD

Period

Description of Option Item(s) -or- Option Service(s)

Unit Price

Total Price of

ARTICLE B.4. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated January 22, 2024 attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports/deliverables required herein shall be submitted in electronic format via email as attachments to the following designated NCI Distribution Mailbox:

ncibrancheinvoices@mail.nih.gov.

These reports shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: Accessibility Conformance Checklists | HHS.gov, as part of HHS’s HHS Accessibility & Section 508 | HHS.gov as well as at Create Accessible Digital Products | Section508.gov, from GSA Section508.gov.

The subject line of the email should read as follows:

Deliverable Name_Contract Number_Vendor’s Name_Due Date

Note: Each email submission shall contain only one (1) deliverable. If the attached file for the Deliverable exceeds 50 MB; the contractor shall divide the deliverable into 50 MB each. All deliverables should be limited to 5 (five) file attachments or less. We understand that in some cases more than five (5) attachments may be necessary.

All data transfer of PII or sensitive information to the NCI is to be encrypted.

. a. Technical Progress Reports

1. Quarterly Progress Report

Per the SOW, the Contractor shall deliver primary and derived data generated from this project. Provide a brief summary of all data delivered to NCI according to CCDI program’s Data Management and Sharing guidelines. Reporting shall include any identifiers associated with samples and datasets with URL links whenever possible.

The report shall be provided by the 15th calendar day of the month following the reporting period. A quarterly report will not be required for the period when the annual report is due. Tracking of samples and progress may be accomplished through the use of a system for ongoing monitoring, with activities occurring during the reporting period included in quarterly reports. Specifically, the following shall be included in the progress report:

1. Detailed tracking for every sample received during the month. Details for each sample include but are not limited to:

i. Sample ID code;

ii. Sample source;

iii. Quantity and format of sample as received (e.g., number of vial, number of aliquots, volume or weight of each vial);

mailto:ncibrancheinvoices@mail.nih.gov https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/index.html https://www.hhs.gov/web/section-508/index.html https://www.section508.gov/create/ https://www.section508.gov/

iv. Detailed tracking of characterizations/assays performed on samples including progress and dates of completion for each molecular characterization activity prescribed for the sample, status and dates of data delivery; and

v. Status, quantity, and format of residual sample, including return to sender as applicable.

2. Description of any issues that arise during the reporting period and mitigation strategies.

3. Details specific to any subcontractor(s), if applicable.

4. Overall summary progress for the project.

2. Annual Progress Report

This report shall include a summation of the results of the entire contract work for the annual period covered. The annual report will also include a comprehensive list of all activities that have taken place within the reporting year as detailed in monthly reports with status updated for the annual report. Reports shall be due annually on or before the anniversary date of contract award. An annual report will not be required for the period when the Final Report is due.

3. Final Report

This report is to include a summation of the work performed and results obtained for the entire contract period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved. A Final Report shall be due 15 days prior to the expiration date of the contract.

b. Other Reports/Deliverables

1. NIST SP 800-171 Rev2 Controlled Unclassified Information (CUI) System Security Plan (SSP) - Due within 90 days after contract award. The SSP shall comply with the NIST SP 800-171 Rev2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final. The SSP shall be consistent with and detail the CUI Plan of Action template https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev- 2/final/documents/CUI-SSP-Template-final.docx. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

2. NIST SP 800-171 Rev2 Controlled Unclassified Information (CUI) Security Assessment Plan of Action (POA) - Due 90 days after the contract award. The security assessment shall be conducted by the assessor and be consistent with NIST SP 800-171 Rev2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final). The Assessor will supply a plan of action report using the CUI Plan of Action template https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev-2/final/documents/CUI-Plan-of-Action-Template-final.docx outlining failed controls from the assessment and plans for remediation.

3. Section 508 Checklist The Contractor must submit a Section 508 checklist in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer Representative (COR). Checklists for Section 508-Conformance Reports for electronic documents, files, videos, etc., are based on HHS’s Accessibility Compliance Checklists. These HHS checklists shall be submitted for all reports, files, or other documents submitted as part of this contract. Note that one representative Section 508 Conformance Report per file type shall suffice

– that is, one Microsoft Word checklist shall represent all Word files submitted under this contact, one Microsoft PowerPoint checklist shall represent all PowerPoint files submitted under this contact, one Adobe PDF checklist shall represent all PDF files submitted under this contact, etc. This applies for each reporting period.

https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev-2/final/documents/CUI-SSP-Template-final.docx https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev-2/final/documents/CUI-SSP-Template-final.docx https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev-2/final/documents/CUI-Plan-of-Action-Template-final.docx https://csrc.nist.gov/CSRC/media/Publications/sp/800-171/rev-2/final/documents/CUI-Plan-of-Action-Template-final.docx https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/sites/default/files/hhs-508-word-checklist.xlsx https://www.hhs.gov/sites/default/files/hhs-508-powerpoint-checklist.xlsx https://www.hhs.gov/sites/default/files/hhs-508-pdf-checklist.xlsx https://www.hhs.gov/sites/default/files/hhs-508-pdf-checklist.xlsx

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the Contracting Officer's Representative (COR) is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Institutes of Health National Cancer Institute Office of Data Sharing (ODS) Center for Biomedical Informatics and Information Technology (CBIIT) 9609 Medical Center Drive Bethesda, MD 20892

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The anticipated period of performance of this contract shall be from January 31st, 2025 - January 30th, 2026. The actual start date may be sooner if the Government is able to make an award prior to the anticipated Period of Performance.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below:

Option Option Period of Performance

ARTICLE F.2. DELIVERIES

Satisfactory performance of the final contract shall be deemed to occur upon performance of the work described in the Statement of Work Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the stated delivery schedule:

a. The items specified below as described in the REPORTING REQUIREMENTS Article in SECTION C of this contract will be required to be delivered F.o.b. Destination as set forth in FAR 52.247-35, F.o.b. DESTINATION, WITHIN CONSIGNEES PREMISES (APRIL 1984), and in accordance with and by the date(s) specified below [and any specifications stated in SECTION D, PACKAGING, MARKING AND SHIPPING, of this contract]:

Item Description Due Date Delivery To

(1) Quarterly Progress Report Due 15th of every quarter following the reporting period.

ncibrancheinvoices@mail.nih.gov CO and COR

(2) Annual Progress Report Annually on the anniversary date of contract award.

ncibrancheinvoices@mail.nih.gov CO and COR

(3) Final Report Due 15 days before the completion date of the contract.

ncibrancheinvoices@mail.nih.gov CO and COR

(4) Contractor - Employee Non- Disclosure Agreement(s)

Prior to performing any work on the contract.

ncibrancheinvoices@mail.nih.gov

COR

(5) NIST SP 800-171 Rev2 Controlled Unclassified Information (CUI) Plan of Action and Milestones (POA&M)

Due 90 days after contract award.

ncibrancheinvoices@mail.nih.gov

COR

mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov

RFP Number: 75N91024C00042

Item Description Due Date Delivery To

(6) Controlled Unclassified

Information (CUI) System Security Plan (SSP)

Due 90 days after contract award.

ncibrancheinvoices@mail.nih.gov

COR

(7) Section 508 Checklist Due with the first quarterly progress report, and then bi-annually thereafter.

ncibrancheinvoices@mail.nih.gov

COR

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEB 1998).

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989).

Alternate I (April 1984) is not applicable to this contract.

mailto:ncibrancheinvoices@mail.nih.gov http://www.acquisition.gov/?q=browsefar

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER REPRESENTATIVE (COR)

The following Contracting Officer Representative (COR) will represent the Government for the purpose of this contract:

TBD at the time of award.

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015).

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days' notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of clause).

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title TBD Project Manager/Director

TBD

TBD

Laboratory Operations Manager Informatics Project Manager

ARTICLE G.3. INVOICE SUBMISSION

1. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

The Contractor must submit invoices to the Department of Treasury's Invoice Processing Platform (IPP) at https://www.ipp.gov with a copy to the approving official, as directed below.

One courtesy copy of the original invoice shall be submitted electronically as follows:

The Central Point of Distribution:

NCI OA Branch E - ncibrancheinvoices@mail.nih.gov and to the Contracting Officer and Contracting Officer Representative

For inquiries regarding the status of invoices, contact OFM Customer Service via email at ofm_customer_service@mail-cmp.niceincontact.com or via phone at 301-496-6088. To send your inquiries via other available communication methods refer to the OFM Customer Service website at https://ofm.od.nih.gov/Pages/ Customer-Service.aspx.

Note: The OFM Customer Service is open Eastern Standard Time Monday - Friday from 8:30 a.m. to 5:00 p.m. and is closed between 12:00 p.m. to 1:00 p.m.

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

i. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is National Cancer Institute

ii. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, Unique Entity Identifier (UEI), or VIN, contact the Contracting Officer. Note: The Contractor shall not include TIN if it is a Social Security Number.

iii. Unique Entity Identifier (UEI). The UEI is located in the System for Award Management (SAM) and replaces the Dun & Bradstreet Data Universal Numbering System (DUNS) number. The UEI number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid UEI number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [ Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, UEI, or VIN, contact the Contracting Officer.

iv. Invoice Matching Option. This contract requires a two-way match.

v. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

vi. The Contract Title is: Childhood Cancer Data Initiative: Research Molecular Characterization

vii. Contract Line Items as follows:

http://www.ipp.gov/ mailto:ncibrancheinvoices@mail.nih.gov https://ofm.od.nih.gov/Pages/Customer-Service.aspx https://ofm.od.nih.gov/Pages/Customer-Service.aspx

Line Item # Line Item Description

TBD TBD

3. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

ARTICLE G.4. PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS

SUBCONTRACTORS, FAR 52.232-40 (Nov 2021).

a. Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice

b. The acceleration of payments under this clause does not provide any new rights under the prompt Payment Act.

c. Include the substance of this clause, include this paragraph c, in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

(End of clause).

ARTICLE G.5. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually as follows on the anniversary date of the contract.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

https://www.cpars.gov http://www.cpars.gov/

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. HUMAN SUBJECTS

It is hereby understood and agreed that research involving human subjects shall not be conducted under this contract, and that no material developed, modified, or delivered by or to the Government under this contract, or any subsequent modification of such material, will be used by the Contractor or made available by the Contractor for use by anyone other than the Government, for experimental or therapeutic use involving humans without the prior written approval of the Contracting Officer.

ARTICLE H.2. HUMAN MATERIALS

The acquisition and supply of all human specimen material (including fetal material) used under this contract shall be obtained by the Contractor in full compliance with applicable State and Local laws and the provisions of the Uniform Anatomical Gift Act in the United States, and no undue inducements, monetary or otherwise, will be offered to any person to influence their donation of human material.

ARTICLE H.3. HUMAN MATERIALS (ASSURANCE OF OHRP COMPLIANCE)

The acquisition and supply of all human specimen material (including fetal material) used under this contract shall be obtained by the Contractor in full compliance with applicable State and Local laws and the provisions of the Uniform Anatomical Gift Act in the United States, and no undue inducements, monetary or otherwise, will be offered to any person to influence their donation of human material.

The Contractor shall provide written documentation that all human materials obtained as a result of research involving human subjects conducted under this contract, by collaborating sites, or by subcontractors identified under this contract, were obtained with prior approval by the Office for Human Research Protections (OHRP) of an Assurance to comply with the requirements of 45 CFR 46 to protect human research subjects. This restriction applies to all collaborating sites without OHRP-approved Assurances, whether domestic or foreign, and compliance must be ensured by the Contractor.

Provision by the Contractor to the Contracting Officer of a properly completed "Protection of Human Subjects Assurance Identification/IRB Certification/Declaration of Exemption", Form OMB No. 0990-0263(formerly Optional Form 310), certifying IRB review and approval of the protocol from which the human materials were obtained constitutes the written documentation required. The human subject certification can be met by submission of a self-designated form, provided that it contains the information required by the "Protection of Human Subjects Assurance Identification/IRB Certification/Declaration of Exemption", Form OMB No. 0990-0263(formerly Optional Form 310).

ARTICLE H.4. NEEDLE EXCHANGE, HHSAR 352.270-12 (December 2015).

The Contractor shall not use any funds obligated under this contract to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

(End of clause).

ARTICLE H.5. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.6. LIMITATION ON USE OF FUNDS FOR PROMOTION OF LEGALIZATION OF

CONTROLLED SUBSTANCES

The Contractor shall not use contract funds to support activities that promote the legalization of any drug or other substance included in schedule I of the schedules of controlled substances established under section 202 of the Controlled Substances Act, except for normal and recognized executive-congressional communications. This limitation shall not apply when the Government determines that there is significant medical evidence of a therapeutic advantage to the use of such drug or other substance or that federally sponsored clinical trials are being conducted to determine therapeutic advantage.

ARTICLE H.7. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.8. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

ARTICLE H.9. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

ARTICLE H.10. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-6, Option for Increased Quantity and FAR Clause 52.217-9 Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given at least 30 days prior to the expiration date of this contract, and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

ARTICLE H.11. SUBCONTRACTING PROVISIONS

a. Small Business Subcontracting Plan

1. In accordance with FAR 19.704 and FAR Clause 52.219-9, the submission of a subcontracting plan by other than small business offeror( s) is a requirement as a part of the proposal submission process and is to be submitted separately from the technical and cost proposals. An offeror's subcontracting plan must be determined to be acceptable, by the Contracting Officer, prior to the contract award.

2. The failure of any Contractor or subcontractor to comply in good faith with FAR Clause 52.219-8, entitled " Utilization of Small Business Concerns" incorporated in this contract and the attached Subcontracting Plan, will be a material breach of such contract or subcontract and subject to the remedies reserved to the Government under FAR Clause 52.219-16 entitled, "Liquidated Damages- Subcontracting Plan.

b. Subcontracting Reports

1. An offeror is to submit their respective subcontracting plan electronically using the U.S. Department of Health and Human Services (HHS) Small Business Customer Experience (SBCX) system at https:// osdbu.hhs.gov. The direct link for plan submission is https://osdbu.hhs.gov/subcontracting/6ac4f6cc- 54c2-46db-9e5c-19630a937e20. The offeror shall follow the instructions outlined in the SBCX Industry Guide at: https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j to successfully submit their subcontracting plan by the proposal submission deadline.

https://osdbu.hhs.gov/subcontracting/6ac4f6cc-54c2-46db-9e5c-19630a937e20 https://osdbu.hhs.gov/subcontracting/6ac4f6cc-54c2-46db-9e5c-19630a937e20 https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j

2. The official point of receipt for determining timely submission of an offeror's subcontracting plan is the

SBCX system and/or email notification. Once the subcontracting plan is successfully submitted in the SBCX system the offeror should receive an email notification and confirmation message of completion upon submission.

3. If an offeror's subcontracting plan is not confirmed as received within the SBCX system by the proposal submission date specified in the solicitation, it will be considered late in accordance with subparagraph (c)

(3) of FAR Clause 52.215-1, Instructions to Offeror-Competition Acquisition. Disposition of late submittals of a subcontracting plan by an offeror via the SBCX system is at the discretion of the Contracting Officer.

4. Any technical questions regarding the use of the SBCX system may be submitted via email message to the SBCX help desk at client.support@apexlogic.com. The client support hours of operation are Monday

- Friday, 6:00 a.m. - 8:00 p.m. Eastern Standard Time (EST). Note: help desk tickets can be submitted 24 hours a day / 7 days a week and a representative will respond within the presented client support hours of operation for assistance.

5. Individual Subcontract Reports (ISR)

The Contractor must submit the following Subcontracting reports electronically via the Subcontracting Reporting System (eSRS) at https://www.esrs.gov/.

Regardless of the effective date of this contract, the Report shall be due on the following dates for the entire life of this contract:

April 30th October 30th Expiration Date of Contract

6. Summary Subcontract Report (SSR) Regardless of the effective date of this contract, the Summary Subcontract Report must be submitted annually on the following date for the entire life of this contract:

October 30th

For both the Individual and Summary Subcontract Reports, the Contracting Officer must be included as a contact for notification purposes at the following e- mail address:

TBD

Contracting Officer

ARTICLE H.12. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT

PROCUREMENTS

ARTICLE H.12.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

a. Baseline Security Requirements

1. Applicability. The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and mailto:client.support@apexlogic.com http://www.esrs.gov/ storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

● Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

● Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

● Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

■ Confidentiality:

■ Integrity:

■ Availability:

[X] Low [ ] Moderate [ ] High

[ ] Low [X] Moderate [ ] High

[X] Low [ ] Moderate [ ] High

■ Overall Risk Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/ NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

3. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

4. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

ii. Based on information provided by the ISSO, system/ data owner, or other security or privacy representative, it has been determined that this solicitation/ contract involves:

[X] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/ or information handled under this contract to determine whether or not a full Privacy Impact Assessment ( PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

5. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term " handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323.

The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

7. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement https://ocio.nih.gov/sites/external/files/2024-01/Nondisclosure04082020.pdf, as applicable.

Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

b. Incident Response

1. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. In accordance with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

https://ocio.nih.gov/sites/external/files/2024-01/Nondisclosure04082020.pdf

c. Contract Initiation and Expiration

1. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

2. Contractor Responsibilities upon Physical Completion of the Contract. The Contractor (and/ or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup…