RFP_75N91023R00043_Final_0001.pdf

- 1 -

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: Public Law 92-918 as amended

2. Request for Proposal (RFP) Number:

75N91023R00043

3. Issue Date:

January 5, 2024

4. Set Aside:

[X] No

[ ] Yes See Part IV Section L

5. Title : Logistical and IT support for the NCI Central Institutional Review Board (CIRB)

6. ISSUED BY:

Office of Acquisitions National Cancer Institute National Institutes of Health 9609 Medical Center Drive Rockville, MD 20850

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposal," until 3 PM Eastern Time local time on February 16, 2024. Offers will be valid for 120 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING AND DELIVERY OF THE PROPOSAL." If proposals are required to be delivered to two different locations, the OFFICIAL POINT OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF ACQUISITIONS.

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors--Competitive Acquisition," LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) prior to award of a contract. Offerors must access the CCR through The System for Award Management (SAM) at https://www.sam.gov/SAM/.

11. FOR INFORMATION CALL: Lydia Castro-Perigo

PHONE: 240-276-6911

e-MAIL: lydia.perigo@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

The cutoff date for questions is 01/12/2024 at 4:00 pm, EST.

Questions shall be submitted via email to: Lydia Castro-Perigo at lydia.perigo@nih.gov. Please provide the specific paragraph reference (Section/sub-Section numbers from the solicitation).

Erin Felent Contracting Officer Office of Acquisitions, NCI erin.felent@nih.gov https://www.sam.gov/SAM/

RFP Number : 75N91023R00043

- 2 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. LEVEL OF EFFORT

e. COMMITMENT OF PUBLIC FUNDS

f. PROMOTING EFFICIENT SPENDING

g. COMMUNICATIONS PRIOR TO CONTRACT AWARD

h. RELEASE OF INFORMATION

i. PREPARATION COSTS

j. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

5. Alternate Proposals

6. Evaluation of Proposals

7. Potential Award Without Discussions

8. Use of the Metric System of Measurement

9. Privacy Act - Treatment of Proposal Information

10. Selection of Offerors

- 3 -

11. CERTIFICATION REGARDING TAX MATTERS (OCT 2020)

12. Past Performance Information

13. Electronic Information Technology Accessibility Notice, HHSAR 352.239-73 (December 2015)

14. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Requirements for Cost or Pricing Data or Information Other than Cost and Pricing Data

4. Salary Rate Limitation

5. Small Business Subcontracting Plan

6. Mentor Protege Program, HHSAR 352.219-70

7. HUBZone Small Business Concerns

8. Total Compensation Plan

9. Other Administrative Data

10. Qualifications of the Offeror

11. Subcontractors

12. Proposer's Annual Financial Report

13. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. EVALUATION OF OPTIONS

4. TECHNICAL EVALUATION FACTORS

5. EVALUATION OF ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY- SECTION

6. PAST PERFORMANCE FACTOR

7. SUBCONTRACTING PROGRAM EVALUATION CRITERIA

- 4 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The Logistical and IT support for the NCI Central Institutional Review Board (CIRB) is a project of the National Cancer Institute (NCI) to develop, implement, and manage a centralized model of Institutional Review Board (IRB) review for multi-site, NCI-sponsored clinical trails. The goal of the Initiative is two-fold: to streamline regulatory compliance and decrease the duplicative burden of protocol review that currently occurs at hundreds of local IRBs nationwide by providing a single, centralized review that can be utilized by local IRBs participating in NCI-sponsored multi-center trials; and to maintain and enhance the protection of research participants by providing consistent, expert IRB review at the national level.

ARTICLE B.2. ESTIMATED COST - OPTION

a. The estimated cost of the Base Period of this contract is $ .

b. The fixed fee for the Base Period of this contract is $ . The fixed fee shall be paid in direct ratio to the level of effort expended; that is, the percent of fee paid shall be equal to the percent of total effort expended.

Payment shall be subject to the withholding provisions of the clauses ALLOWABLE COST AND PAYMENT and FIXED FEE referenced in the General Clause Listing in Part II, ARTICLE I.1. of this contract.

c. The total estimated amount of the contract, represented by the sum of the estimated cost plus the fixed fee for the Base Period is $ .

d. If the Government exercises its option pursuant to the OPTION PROVISION Article in SECTION H of this contract, the Government's total estimated contract amount represented by the sum of the estimated cost plus the fixed fee will be increased as follows:

Estimated Cost

Fixed Fee

Estimated Cost Plus Fixed Fee

Base Period (Year 1)

Increased Capacity Option-Base Period

Option Period 1 (Year 2)

Increased Capacity Option-Option Period 1

Option Period 2 (Year 3)

- 5 -

Estimated Cost

Fixed Fee

Estimated Cost Plus Fixed Fee

Increased Capacity Option-Option Period 2

Option Period 3 (Year 4)

Increased Capcity Option-Option Period 3

Option Period 4 (Year 5)

Increased Capacity Option-Option Period 4

Total

Base Period and Option(s)

ARTICLE B.3. ESTIMATED COST - INCREMENTALLY FUNDED CONTRACT

a. The total estimated cost to the Government for full performance of this contract, including all allowable direct and indirect costs, is $ .

b. The following represents the schedule* by which the Government expects to allot funds to this contract:

Description Start Date of Period or Increment of Performance

End Date of Period or

Increment of Performance

Estimated Cost ($)

Fee ($) (as appropriate)

Estimated Cost Plus Fee ($) (as appropriate)

[Total] [Total] [Total]

*To be inserted after negotiation

c. Total funds currently obligated and available for payment under this contract are $ .

d. The Contracting Officer may issue unilateral modifications to obligate additional funds to the contract and make related changes to paragraphs b. and/or c., above.

e. Until this contract is fully funded, the requirements of the clause at FAR 52.232-22, Limitation of Funds, shall govern. Once the contract is fully funded, the requirements of the clause at FAR 52.232-20, Limitation of Cost, shall govern.

f. Payment of fee shall be subject to the withholding provisions of the clauses ALLOWABLE COST AND PAYMENT and FIXED FEE referenced in the General Clause Listing in Part II, ARTICLE I.1. of this contract.

- 6 -

ARTICLE B.4. PROVISIONS APPLICABLE TO DIRECT COSTS

This article will prohibit or restrict the use of contract funds, unless otherwise approved by the Contracting Officer. The following is a list of items that may be included in the resultant contract as applicable. 1) Conferences & Meetings, 2) Food for Meals, Light Refreshments & Beverages, 3) Promotional Items, 4) Acquisition, by purchase or lease, of any interest in real property; 5) Special rearrangement or alteration of facilities; 6) Purchase or lease of any item of general purpose office furniture or office equipment regardless of dollar value; 7) Travel Costs including Foreign Travel; 8) Consultant Costs; 9) Subcontract Costs; 10) Patient Care Costs; 11) Accountable Government Property; 12) Printing costs; and 13) Research Funding.

ARTICLE B.5. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

1. Indirect Rate Ceiling – The Government reserves the right to negotiate a ceiling rate for all Indirect Rates proposed.

- 7 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated September 1, 2023, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

b. The applicable Privacy Act System of Records Number is 09-25-0217 and shall be used in any design, development, or operation work to be performed under the resultant contract. Disposition of records shall be in accordance with SECTION C of the contract, and by direction of the Contracting Officer Representative (COR).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports shall be submitted electronically. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

These reports shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: https://www.hhs.gov/web/section-508/index.html and at: https://www.section508.gov/create/documents, "Create Accessible Documents."

All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

a. Technical Progress Reports

1. Monthly Progress Report

The contractor shall prepare and submit a monthly progress report. This report shall include a description of the activities and accomplishments performed during the reporting period. The report shall be provided by the 15th calendar day of the month following the reporting period.

Specifically, the following shall be included in the progress report:

1. Executive Summary

2. Overview of SOW Activity by Task

3. Help Desk Activity Summary

i. The Help Desk Activity Summary shall enumerate the number of inquiries received via email and phone and voicemail for the month; category of inquiry; average response time; and number of inquiries per category for the reporting month.

4. Enrollment Activity Summary

i. Aggregate and CIRB-specific breakouts with totals by month, year, and since inception of Initiative. The Enrollment Activity Report will track enrollment activities including the following:

total number of institutions enrolled; number of enrollment applications pending and where they are in the process; number of new applications received per month; number of new applications approved per month; number of Authorization Agreements signed per month;

master listing of enrolled signatory institutions; listing of signatory institution’s components https://www.hhs.gov/web/section-508/index.html https://www.section508.gov/create/documents

- 8 -and affiliates; listing of Cancer Centers enrolled; listing of NCORPs enrolled; additional data points, when requested . This report will be maintained and provided when requested by the COR or Alternate-COR.

5. New Studies Opened Summary

i. Aggregate and CIRB-specific breakouts with totals by month, year, and since inception of independent model.

6. Adult and Pediatric CIRB C-PIRAT Compliance with timeframes for following metrics:

i. 7 working days between Approval-on-Hold and CIRB Application Received

ii. 14 (Adult CIRBs) or 21 (PedCIRB) working days from Approval-on-Hold and CIRB meeting date

iii. 2 working days between date of CIRB outcome letter sent and CIB review of outcome letter

iv. If teleconference necessary, must be scheduled within 7 working days after CIRB review

v. 14 calendar days between CIB response sent and Study Chair response received

vi. The actual days required for each process step mentioned above and summary that states the % that met the CPIRAT criteria.

7. Compliance with timeframes for following metrics

i. 3 working days after CIRB meetings for distribution of approval letters

ii. 7 working days after CIRB meetings for distribution of outcome letters that are not approvals

iii. Minutes ready for vote at next meeting

iv. CIRB approval of new studies within 28 calendar days (when CIRB meets twice a month) or within 42 calendar days (when CIRB meets once a month)

v. CIRB approval of Study-Specific Worksheet within 3 working days

8. Quality Assurance Audit Reports

9. Status Report of IT Change Orders

10. Key Definitions Appendix

11. Repository PowerPoint slides updated monthly

2. Annual Progress Report

This report shall include a summation of the results of the entire contract work for the annual period covered.

The annual report will also include a comprehensive list of studies and status. This comprehensive report is designed to identify workload and will include the number of new studies, number of continuing reviews, and the number of amendments. Reports shall be due annually on or before the anniversary date of contract award. An annual report will not be required for the period when the Final Report is due.

3. Final Report

This report is to include a summation of the work performed and results obtained for the entire contract period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved. A Final Report shall be due 15 days prior to the expiration date of the contract.

- 9 -

4. Transition Plan for Transition-In and Transition-Out

a. Upon receipt of comments from the COR on the Draft Transition-In plan submitted as part of the proposal, the Contractor shall submit a final Transition-In plan to the COR within 7 days of contract award for formalization. This plan shall describe what is mentioned SOW section 3.1 Transition-In. This plan should also include any capture of the incumbent staff and hiring of new qualified staff, compiling a strong management team, transition of authority, duties, activities. and equipment. In addition, the Transition-In plan shall outline potential transition-in related risks and corresponding mitigation measures.

b. A draft Transition-Out plan shall be submitted to the COR no later than three (3) months prior to the end of the contract. The plan shall clearly describe the transition of authority, duties, activities, equipment, and function for the services to a new contract awarded to perform these services. The COR shall provide comments and the final Transition-Out plan shall be submitted to the COR within 15 days prior to the expiration date of the contract.

b. Other Reports/Deliverables:

1. Board Members’ Attendance, Completion of Assignments, and Continuing Education.

This spreadsheet/log tracks each CIRB member’s activity including attendance at meetings;

participation in continuing education annual webinar, and completion of primary reviewer assignments.

Submission of this spreadsheet/log is due annually separate from the Annual Progress Report.

2. Tracking Log of Accreditation Tasks.

This log identifies requirements to maintain AAHRPP accreditation and tracks progress on completion of each requirement upon the request of the COR.

3. New Work Processes – Documentation due within 90 calendar days of award. See SOW Task 1.M.

4. Help Desk Tracking Log of Interactions with Local Sites

This log/spreadsheet tracks communications through the CIRB Help Desk. Log/spreadsheet must contain inquiry contact information, communication receipt time and method received, synopsis of inquiry, priority level given, time response sent, total time between receipt of question and distribution of answer, Operations Office responder and resolution. The Help Desk Tracking Log is due upon request from the COR.

5. CIRB Board Member Education Day draft plan - Due 12/31 of the year preceding the meeting.

The draft plan shall include proposed agenda including topics and speakers, estimated budget including travel, hotel accommodations, transport from hotel to meeting place, web-based registration, conference room and hotel reservation, if applicable and all materials required for the meeting. See SOW Task 10.

6. Continuing Education Plan – Within 3 months of contract award

Report provides details of the continuing education needs for the board members. The plan shall include goals, objectives, planned topics, delivery approaches, time frame and method of evaluation for training throughout the year.

7. Evaluation Report of Local Operations – Within 6 months of award

Evaluate members of the local context board as well as topics for review and discussion. Provide details of member qualifications and member participation as well as an evaluation of the internal local context process. This report shall be due 6 months from the contract award and every six months following.

- 10 -

8. Quality Assurance (QA) Report – Due quarterly

A QA report outlining risks and opportunities to accurate, efficient, and effective CIRB operations shall be provided quarterly. The report shall include an assessment of each of the major CIRB operational functional areas. Each functional area shall have a risk/opportunity assessment and a strategy to address each risk/opportunity identified.

9. Project Management Plan – Due within 90 days of award and quarterly thereafter

The plan shall utilize professionally recognized standard tools and processes to track the progress of all activities. This includes a written plan to meet project requirements and that project requirements are tracked and fulfilled, and visual representation of the plan.

10. Ad Hoc Reports

The Contractor shall provide Ad Hoc reports at the request of the Contracting Officer’s Representative (COR). This could include but not limited to the final membership list for new Board due to COR 6 weeks prior to the first meeting of this CIRB, management reports, or assessments and recommendations to address new operational or regulatory issues.

11. Standard Operating Procedures

The Contractor shall ensure that all CIRB SOPs are in compliance with federal laws and regulations, and that all administrative activities and CIRB actions are in compliance with the CIRB SOPs. These SOPs shall be updated and due annually.

12. Source Code and Object Code

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

INFORMATION AND/OR PHYSICAL SECURITY

A. Assessment and Authorization (A&A)- A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) must work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) within four (4) months after contract award. The Contractor must conduct the A&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

For an existing ATO, Contracting Officer Representative must make a determination if the existing ATO provides appropriate safeguards or if an additional ATO is required for the performance of the contract and state as such.

NIH acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

B. A&A Package Deliverables - The Contractor (and/or any subcontractor) must provide an A&A project plan within 30 days of contract award to the CO and/or COR. The following A&A deliverables are required to complete the A&A package.

1. System Security Plan (SSP) - due within 60 days after contract award. The SSP must comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information

- 11 -

Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and NIH policies and other guidance. The SSP must be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP must provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor must update the SSP at least annually thereafter.

2. Security Assessment Plan/Report (SAP/SAR) - due 60 days after the contract award. The security assessment must be conducted by the assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and NIH policies. The assessor will document the assessment results in the SAR.

The NIH should determine which security control baseline applies and then make a determination on the appropriateness/necessity of obtaining an independent assessment. Assessments of controls can be performed by Contractor, government, or third parties, with third party verification considered the strongest. If independent assessment is required, include statement below.

Thereafter, the Contractor, in coordination with the NIH shall conduct/assist in the assessment of the security controls and update the SAR at least annually.

3. Independent Assessment - due 90 days after the contract award. The Contractor (and/or subcontractor) must have an independent third-party validate the security and privacy controls in place for the system(s). The independent third party must review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The Contractor must address all "high" deficiencies before submitting the package to the Government for acceptance. All remaining deficiencies must be documented in a system Plan of Actions and Milestones (POA&M).

4. Plan of Actions and Milestones (POA&M) - due 120 days after contract award. The POA&M must be documented consistent with the HHS Standard for Plan of Action and Milestones and NIH policies. All findings/weaknesses must be documented in the POA&M and remediated/mitigated from the date the weaknesses are formally identified and documented by the timelines below:

• Critical within 30 days;

• High within 60 days;

• Medium within 1 year; and

• Low within 1 year.

The NIH will determine the risk rating of vulnerabilities. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, must be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, NIH may require designated POAM weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M must be updated at least quarterly.

5. Contingency Plan and Contingency Plan Test - due 120 days after contract award. The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS and NIH policies. Upon acceptance by the System Owner, the Contractor, in coordination with the System Owner, must test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. Thereafter, the Contractor must update and test the Contingency Plan at least annually.

6. E-Authentication Questionnaire - The contractor (and/or any subcontractor) must collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods must follow OMB 04-04 and NIST SP 800-63, Rev. 2, Electronic Authentication Guidelines.

- 12 -

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

7. Privacy Impact Assessment (PIA) – The PIA is an analysis of how privacy information related to a federal information system is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (ii) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electron information system; and

(iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. It should be reviewed annually and updated as needed. The current document will be provided to the Contractor by the COR within 3 business days following award.

8. NCI Business Impact Analysis (BIA) –The BIA captures the mission essential functions supported by a system, identifies dependencies, and defines recovery time objective, recovery point objective, and maximum tolerable down time. The system owner or project manager completes the BIA. The completed BIA must be signed by the system owner and NCI ISSO. The current document will be provided to the Contractor by the COR within 3 business days following award.

C. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). To determine the designation, the Position Designation Tool (PDT) discussion is found at: https://ors.od.nih.gov/ser/dpsac/administrators/onboarding-new-staff/Pages/position-designation-tool.aspx and the link to access the tool is found at: https://pdt.nbis.mil/.

The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Tier 5: Critical Sensitive and Special Sensitive National Security, including Top Secret, SCI, and "Q" access eligibility.

[ ] Tier 5SR: Reinvestigation.

[ ] Tier 4: High Risk Public Trust (HRPT).

[ ] Tier 4SR: Reinvestigation.

[ ] Tier 3: Non-Critical Sensitive, National Security, including Secret and "L" access eligibility.

[ ] Tier 3SR: Reinvestigation.

[ ] Tier 2S with Subject Interview: Moderate Risk Public Trust (MRPT).

[ ] Tier 2SR: Reinvestigation.

[X] Tier 1: Low Risk, Non-Sensitive, including HSPD-12 Credentialing.

D. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12

Roster-https://ors.od.nih.gov/ser/dpsac/administrators/onboarding-new-staff/Pages/position-designation-tool.aspx https://ors.od.nih.gov/ser/dpsac/administrators/onboarding-new-staff/Pages/position-designation-tool.aspx https://pdt.nbis.mil/

- 13 -

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/ or CO within fourteen (14) calendar days after the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j

1. If the Contractor is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

2. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor must complete and submit the required forms within 30 days of the notification.

3. The Contractor must notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

4. All contractor and subcontractor employees must comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract. Contractors may begin work after the fingerprint check has been completed.

5. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14. Accordingly, the Contractor must ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

6. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

7. The Contractor must include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

8. The Contractor must direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

9. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor must return all identification badges to the Contracting Officer or designee.

E. CONTRACT INITIATION AND EXPIRATION

1. General Security Requirements- The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the Contractor must follow the HHS EPLC framework and methodology or and in accordance with the HHS Contract Closeout Directive (2018) located at: https://oamp.od.nih.gov/ https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j

- 14 -sites/default/files/DGS/contracting-forms/HHS-Closeout-Directive-2018.pdf. HHS EA requirements located at: https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf and NIH EA requirements are located at: https://ocio.nih.gov/PM/Pages/EPLC.aspx.

2. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals ( specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor ( and/ or any subcontractor) must provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/ or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

4. Notification - The Contractor ( and/ or any subcontractor) must notify the CO and/ or COR and system ISSO within fifteen days before an employee stops working under this contract.

5. Contractor Responsibilities Upon Physical Completion of the Contract- The Contractor (and/ or any subcontractors) must return all government information and IT resources ( i.e., government information in non- government- owned systems, media, and backup systems) acquired during the term of this contract to the CO and/ or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor- owned systems, including backup systems and media used during contract performance, in accordance with HHS and/ or NIH policies.

6. The Contractor ( and/or any subcontractor) must perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/ acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this contract within 2 days of the employee's exit from the contract. All documentation must be made available to the CO and/ or COR upon request.

7. Contractor Non- Disclosure Agreement (NDA)- Each Contractor ( and/ or any subcontractor) employee having access to non- public government information under this contract shall complete the NIH non- disclosure agreement: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/ Nondisclosure.pdf, as applicable. A copy of each signed and witnessed NDA must be submitted to the Contracting Officer ( CO) and/ or CO Representative ( COR) prior to performing any work under this acquisition for those contractors who are not in NED and therefore do not need to provide.

8. Vulnerability Scanning Reports - The Contractor must report the results of the required monthly special vulnerability scans, with remediation comments noted, no later than 10 days following the end of each reporting period. This report must be submitted under a separate cover on monthly basis.

9. Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) must afford the Government access to the Contractor's facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment ( to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

i. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government's direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract. The Government includes but is not limited to the U.S. Department of Justice, U.S. Government Accountability Office, and the HHS Office of the Inspector General https://ocio.nih.gov/PM/Pages/EPLC.aspx

- 15 -

(OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, SQL injection vulnerabilities, and any other known vulnerabilities.

ii. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

iii. Segregate Government protected information and metadata on the handling of Government protected information from other information. Commingling of information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

iv. Cooperate with inspections, audits, investigations, and reviews.

1. 10. Section 508 Annual Report

The Contractor must submit an annual Section 508 report in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer Representative (COR). The Section 508 Report Template and Instructions for completing the report are available at: https://www.hhs.gov/sites/default/files/web/508/contracting/technology/ section_508_annual_report.doc.

https://www.hhs.gov/sites/default/files/web/508/contracting/technology/section_508_annual_report.doc https://www.hhs.gov/sites/default/files/web/508/contracting/technology/section_508_annual_report.doc

- 16 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

- 17 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the Contracting Officer's Representative (COR) is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Institutes of Health National Cancer Institute Division of Cancer Treatment & Diagnosis (DCTD) Cancer Therapy Evaluation Program (CTEP) 9609 Medical Center Drive Bethesda, MD 20892

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-5, Inspection of Services - Cost-Reimbursement (April 1984).

- 18 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be from September 1, 2024 through August 31, 2025.

a. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below:

Option Option Period of Performance

Option Period 1

September 1, 2025 – August 31, 2026 Option Period 2 September 1, 2026 – August 31, 2027 Option Period 3 September 1, 2027 – August 31, 2028 Option Period 4 September 1, 2028 – August 31, 2029

ARTICLE F.2. DELIVERIES

Satisfactory performance of the final contract shall be deemed to occur upon performance of the work described in the Statement of Work Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the stated delivery schedule:

a. The items specified below as described in the REPORTING REQUIREMENTS Article in SECTION C of this contract will be required to be delivered F.o.b. Destination as set forth in FAR 52.247-35, F.o.b. DESTINATION, WITHIN CONSIGNEES PREMISES (APRIL 1984), and in accordance with and by the date(s) specified below [and any specifications stated in SECTION D, PACKAGING, MARKING AND SHIPPING, of this contract]:

Item Description Due Date Delivery To a.1. Monthly Progress Report Due 15th of the month following the reporting period.

ncibrancheinvoices@mail.nih.gov CO and COR a.2. Annual Progress Report Annually on the anniversary date of contract award.

ncibrancheinvoices@mail.nih.gov CO and COR a.3. Final Report Due 15 days before the completion date of the contract.

ncibrancheinvoices@mail.nih.gov CO and COR a.4.a. Final Transition-In Plan 7 business days after contract award.

ncibrancheinvoices@mail.nih.gov

COR

a.4.b. Transition-Out Plan Draft is due 3 months prior to expiration date of the contract and final plan is due 15 days before the expiration date of the contract.

ncibrancheinvoices@mail.nih.gov

COR

b.1. Board Members’ Attendance, Completion of Assignments, and Continuing Education.

Due on contract award anniversary date and every year thereafter.

COR or approved designees b.2. Develop and Maintain a Tracking Log of Accreditation Tasks.

Due six months after contract award.

COR or approved designees mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov

- 19 -

Item Description Due Date Delivery To b.3. New Work Processes Due within 90 calendar days of award.

COR or approved designees b.4. Help Desk Tracking Log of Interaction with Local Sites

Upon request from COR or Alternate-COR.

COR or approved designees b.5. Ed Day draft plan. Due 12/31 of the year preceding the bi-annual Education Day meeting.

COR or approved designees b.6. Continuing Education Plan Within 3 months of contract award.

COR or approved designees b.7. Evaluation of Local Operations

Within 6 months of award and 6 months thereafter.

COR or approved designees b.8. QA Report Quarterly COR or approved designees b.9. Project Management Plan Within 90 days of contract award then quarterly.

COR or approved designees b.10. Ad Hoc Reports Upon request from COR or Alternate-COR.

COR or approved designees b.11. Standard Operating Procedures

Due within 100 days of contract award and then annually on the anniversary date of contract award.

COR or approved designees b.12. Source Code and Object Code

Upon expiration date of the contract.

ncibrancheinvoices@mail.nih.gov COR or approved designees

A. Assessment and Authorization (A&A)

Within 4 months of contract award or extended timeline if granted by NCI ISSO.

ncibrancheinvoices@mail.nih.gov COR and NCI ISSO

B. A&A Project Plan Within 30 days of contract award.

COR and as requested to the Office of NCI ISSO

B.1. System Security Plan

(SSP)

Within 60 days of contract award.

COR and as requested to the Office of NCI ISSO

B.2. Security Assessment Plan/ Report (SAP/SAR)

Within 60 days of contract award.

COR and as requested to the Office of NCI ISSO

B.3. Independent Assessment Within 90 days of contract award.

COR and as requested to the Office of NCI ISSO

B.4. Plan of Actions and Milestones (POA&M)

Within 120 days of contract award.

COR and as requested to the Office of NCI ISSO

B.5. Contingency Plan and Contingency Plan Test

Within 120 days of contract award.

COR and as requested to the Office of NCI ISSO

B.6. E-Authentication Questionnaire

Within 30 days of contract award.

COR and as requested to the Office of NCI ISSO

B.7. Privacy Impact Assessment (PIA)

Within 3 days of contract award.

COR and as requested to the Office of NCI ISSO

B.8. NCI Business Impact Analysis (BIA)

Within 3 days of contract award.

COR and as requested to the Office of NCI ISSO

D. Roster of Employees Requiring Suitability Investigations

14 calendar days after effective date of contract award and then within 7 calendar days of an staffing changes impacting the roster.

ncibrancheinvoices@mail.nih.gov

COR

E.4. Notification of Departing Employees

15 days prior to the employee stops working under this contract.

ncibrancheinvoices@mail.nih.gov COR and NCI ISSO mailto:ncibrancheinvoices@mail.nih.gov mailto:ncibrancheinvoices@mail.nih.gov

- 20 -

Item Description Due Date Delivery To E.6. Employee Separation

Checklist Shall be completed within 2 days of employees exit from the contract.

Documentation shall be provided upon request.

ncibrancheinvoices@mail.nih.gov

COR

E.7. Contractor - Employee Non-Disclosure Agreement(s)

Prior to performing any work on the contract.

ncibrancheinvoices@mail.nih.gov

COR

E.8. Vulnerability Scanning Reports

No later than 10 days following the end of each reporting period.

ncibrancheinvoices@mail.nih.gov

COR

E.10. Section 508 Annual Report Due annually at the end of the base and each option period.

ncibrancheinvoices@mail.nih.gov

COR

ARTICLE F.3. LEVEL OF EFFORT

a. During the period of performance of this contract, the Contractor shall provide TBD direct labor Hours . The labor Hours Exclude vacation, holiday, and sick leave. These labor Hours Exclude subcontractor labor Hours . It is estimated that the labor Hours are constituted as specified below and will be expended approximately as follows:

Labor HOURS

Year 1 Year 2 Year 3 Year 4 Year 5 Base and Options to Extend the Term of the Contract Options for Increased Capacity

Totals

b. The Contractor shall have satisfied the requirement herein if not less than 90% nor more than 110% of the total direct labor Hours specified herein are furnished. These terms and conditions do not supersede the requirements of either the "Limitation of Cost" or "Limitation of Funds" clause.

c. In the event fewer Hours than the minimum specified number of direct labor Hours in the total categories are used by the Contractor in accomplishing the prescribed work and the Government has not invoked its rights…