RFQ_75N91024Q00077_00001.pdf

RFQ# 75N91024Q00077_00001

1.0 SERVICES AND PRICES

1.1 BACKGROUND

The U.S. Department of Health and Human Services (HHS), National Cancer Institute (NCI), Center for Cancer Genomics (CCG) unifies NCI’s activities in cancer genomics by aiming to synthesize research in different fields of cancer genomics – structural, functional, and computational – to improve patient outcomes. CCG programs and collaborations generate cancer genomic and clinical data and make these data available for widespread use by the research community. To this end, in June 2016, CCG launched the Genomic Data Commons (GDC), an integrated database to house multiple large-scale cancer genomics datasets with supporting analytical tools.

The GDC is a growing, multi-petabyte collection of data generated by CCG Offices and other cancer genomic programs housed on a “big data” cloud-capable technology stack designed and built under contract by CCG. The GDC was named one of the ten initiatives highlighted under President Biden’s Cancer Moonshot that supports the goal of making a decade’s worth of cancer research progress in five years.

The GDC currently includes data from The Cancer Genome Atlas (TCGA) and Therapeutically Applicable Research to Generate Effective Treatments (TARGET) programs, Human Cancer Models Initiative (HCMI), Clinical Proteomic Tumor Analysis Consortium (CPTAC), and others. Data from additional internal and external NCI-sponsored programs are continually being added to the GDC. A key requirement of data entering the GDC is that they must be harmonized into a single standard for maintenance and eventual comparability during analyses. As more data is added to the GDC, the system’s value to the research community multiplies.

To support the continued growth of the GDC, CCG Office of the Director requires bioinformatics Subject Matter Expert service in the clinical and basic cancer research field with specific expertise, as well as knowledge of the GDC. Work performed under this purchase order will assist CCG in the continuing development and enhancement of the GDC, among other bioinformatics projects.

1.2 OBJECTIVE

The objectives of this acquisition are to ensure the continued success of the GDC, a complex database and analytical software system that manages petabytes of cancer genomic data. Much of the success of the GDC to date is dependent on understanding the nature of the data going into it, the lessons learned from prior systems holding cancer genomic data and understanding modern architectures of systems capable of managing such data.

1.3 TYPE OF ORDER

This is a hybrid time and materials and firm fixed price purchase order.

1.4 CONSIDERATION AND PAYMENT

In consideration of satisfactory performance of the work as described in the SOW, the Contractor shall be compensated in accordance with the fixed price and fixed loaded hourly rates for actual hours incurred. The fully loaded rates shall be all inclusive of the direct labor rate, fringe benefits, applicable indirect cost rates for each labor category. Additionally, the contractor shall be reimbursed the actual cost of materials directly chargeable to this purchase order in accordance with FAR 52.212- 4; Alt 1. If option periods are exercised, funding will be obligated by modification to the purchase order. Funds are only available for use for the contract line item (CLIN) to which they are obligated.

Unused funds from one CLIN may not roll over for use in other periods. The base period and option periods are priced as follows:

BASE PERIOD: (JUNE 3, 2024 TO JUNE 2, 2025)

CLIN 1: Bioinformatics Subject Matter Expert Services in the Clinical and Basic Cancer Research Field, in Support of the NCI Center for Cancer Genomics (T&M)

CLIN 2: Optional Task 1: Travel and Participation at the American Association of Cancer Research (AACR) Meeting (T&M)

CLIN 3: Optional Task 2: Travel and Participation at other meeting/conference (T&M)

Base Period – T&M Component

Labor Categories Fixed Loaded Rates

Estimated Hours/Amount

Estimated Total

Labor Subtotal $ CLIN 1 Ceiling (Not-to-exceed)

Materials Description Quantity Rate Estimated Total CLIN 2: Optl. Task 1 (Not-to-exceed)

$4,000.00

CLIN 3: Optl. Task 2 (Not-to-exceed)

$4,000.00

Base Period T&M Total Amount $

OPTION PERIOD 1: (JUNE 3, 2025 TO JUNE 2, 2026)

CLIN 4: Bioinformatics Subject Matter Expert Services in the Clinical and Basic Cancer Research Field, in Support of the NCI Center for Cancer Genomics (T&M)

CLIN 5: Optional Task 1: Travel and Participation at the American Association of Cancer Research (AACR) Meeting (T&M)

CLIN 6: Optional Task 2: Travel and Participation at other meeting/conference (T&M)

Option Period 1 – T&M Component

Estimated

CLIN 4 Ceiling (Not-to-exceed)

Materials Description Quantity Rate Estimated Total CLIN 5: Optl. Task 1 (Not-to-exceed)

$4,090.00

CLIN 6: Optl. Task 2

$4,090.00

Option Period 1 T&M Total Amount $

OPTION PERIOD 2: (JUNE 3, 2026 TO JUNE 2, 2027)

CLIN 7: Bioinformatics Subject Matter Expert Services in the Clinical and Basic Cancer Research Field, in Support of the NCI Center for Cancer Genomics (T&M)

CLIN 8: Optional Task 1: Travel and Participation at the American Association of Cancer Research (AACR) Meeting (T&M)

CLIN 9: Optional Task 2: Travel and Participation at other meeting/conference (T&M)

CLIN 10: Optional Task 3: Continuity of Services Transition Services (Phase out) (FFP) $____________

Option Period 2 – T&M Component

Estimated

CLIN 7 Ceiling (Not-to-exceed)

Materials Description Quantity Rate Estimated Total CLIN 8: Optl. Task 1 (Not-to-exceed)

$4,182.03

CLIN 9: Optl. Task 2

$4,182.03

Option Period 2 T&M Total Amount $

1.5 CEILING PRICE

The hours and total price per labor category of the labor hour component of this purchase order are for budgeting purposes only. The number of hours actually used for each category may exceed or be less than the estimate by category as long as the ceiling price for each CLIN is not exceeded. The ceiling for each CLIN is identified in Section 1.4. The Government shall not be obligated to pay any amount in excess of the ceiling price, nor is the Contractor obligated to continue performance if to do so would exceed the ceiling price. Therefore, if the applicable tasks require additional time, effort, or cost to complete than originally anticipated, the Contractor shall exceed the total ceiling price of the applicable CLIN at its own risk. In the event the Government chooses to exercise optional CLINS, unused funds from a previous CLIN may not be used to fund any services taking place in a subsequent CLIN. The ceiling price may be modified by the Government if it is determined that the estimated hours are insufficient for the work required.

2.0 DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

2.1 TITLE

Acquisition of Bioinformatics Subject Matter Expert Services in the Clinical and Basic Cancer Research Field, in Support of the NCI Center for Cancer Genomics.

2.2 SCOPE

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified staff, material, equipment, and facilities, not otherwise provided by the Government as needed to complete the tasks herein. The scope of work includes support for the following CCG critical programs:

− Genomic Data Commons (GDC), − Clinical Data Center (CDC) and Biospecimen Core Resource (BCR), and − CCG Cancer Characterization Programs

2.3 PURCHASE ORDER REQUIREMENTS

2.3.1 Task 1 - General CCG GDC Support

The Contractor shall support CCG’s goal to integrate structural, functional, and computational tools with multiple cancer genomic datasets, and make them broadly available via data commons to the research community. CCG GDC support may include the following tasks:

Establish and maintain appropriate communication channels between Contractor personnel and Government personnel through regular virtual/physical meetings, clear and timely written reporting, and responsiveness to emerging issues as needed. Virtual meetings shall be held via an NCI-provided teleconferencing solution such as Microsoft Teams, WebEx, or standard telephone conferencing line. Specifically, the Contractor shall support the GDC committees and working groups, including the Project Team, Steering Committee, Engineering Review Board, Change Review Board, Clinical Data Working Group, Standard Operating Procedures (SOP) Working Group, and others as requested.

Provide meeting minutes of all meetings, technical meetings, etc. between the Contractor and the Government, detailing decisions made and next steps as requested.

Support the GDC and CCG’s oversight of the continued development and utilization of the

GDC. Services shall include but are not limited to providing input regarding genomic data integrity, quality control of submitted data, application of genomic data and bioinformatics, and proper handling of patient clinical data.

Provide input and guidance regarding the detailed technical requirements of the GDC pipelines, GDC data, GDC analysis tools, and other GDC and CCG projects to support verification of the status of requirements. This may include working regularly with vendor technical teams.

Support CCG’s implementation of systems architecture requirements, including data models, data processing pipeline, and polyglot / NoSQL databases/persistence systems. Specifically, the Contractor shall provide technical support to ensure that clinical data and models are harmonized as data are imported from diverse cancer genomic programs. The Contractor shall liaise with the CCG Program Office, to ensure harmonization of data elements collected on projects when studying the same cancer.

Provide information and lessons learned on TCGA, TARGET/CGCI, BLGSP, HCMI, and other programs related to data standards, data policies and technical specifications, including history, current example, and opportunities for improvement. The Contractor shall provide information/clarification regarding technical issues related to the importation of legacy data from the current CCG data systems into the GDC. This task shall be accomplished through verbal communication and/or written support in the form of notes, writing and editing documents, etc. as needed.

Present information regarding the GDC to 3rd parties considering deposition of their data therein. Tasks may include identifying data and providing input regarding data appropriateness and feasibility for the GDC. The Contractor shall establish communications and collaboration between 3rd parties, the CCG Director, and the GDC Program Manager, as requested. Current GDC data guidelines shall be followed.

Collaborate with the applicable NCI Divisions Officer and Centers (DOCS), as directed by the

Contracting Officer’s Representative (COR), to incorporate Government-approved projects into the GDC. Inform GDC Project Team plans with relevant information gleaned from Division of Cancer Epidemiology and Genetic’s (DCEG) deployment of U Chicago’s Generation 3 Data Commons software within the context of Center for Biomedical Informatics and IT’s (CBIIT) Cancer Research Data Commons (CRDC) environment.

Review appropriate protections needed on issues related to human subject enrollment and sample accrual for genomics programs, including human subjects’ protections, Material Transfer Agreements (MTA), Health Insurance Portability and Accountability Act (HIPAA), and data access and use policies, to ensure data can be made available to the research community. Tasks may include drafting and editing of Institutional review board (IRB) protocols, informed consents, Data Use Agreements, and other materials and services as needed.

Participate, as requested by CCG, in support of the Cancer Models Development Centers

(CMDC) comprising the NCI commitment to the Human Cancer Models Initiative (HCMI).

Specifically, provide technical support for CMDC clinical data submission from CDC to the GDC, biospecimen data submission from the Biospecimen Processing Center (BPC) the GDC, and population of data into the HCMI Searchable Catalog.

Provide Subject Matter Expertise and consultation to the CCG Director, Clinical Data

Collection (CDC) program, BPC program, cancer characterization programs by participating virtually/in person in programs or initiatives as specified in the statement of work. The Contractor shall provide verbal input and document editing services as requested.

Submit monthly status reports to the COR summarizing tasks accomplished, issues encountered, etc. as directed by the COR, during the applicable reporting period.

2.3.2 Task 2 – CCG Biospecimen Core Resource (BCR) Support

The Contractor shall provide technical support for clinical data and biospecimen service ongoing operations. Support may include the following tasks:

Support CDC and BCR to ensure that, from the perspective of bioinformatics, clinical informatics, and IT issues, all technical requirements for submission of data to the GDC are met. Tasks may include facilitating communication regarding data standards between CDC, BCR, and GDC.

Submit monthly status and accomplishment reports, as well as activity reports on CDC and

BCR Informatics Processes and Issues, as needed.

2.3.3 Task 3 – CCG Cancer Characterization Programs Support

The Contractor shall provide technical guidance and services to support the closure of completed programs and ongoing activities of new programs. Support may include the following tasks:

Support the CCG Office with technical expertise in the collection of clinical and biospecimen data, including providing guidance on semantics, standardization, and compliance with GDC submission requirements for all projects.

Attend in-person/virtual meetings as required. Meetings may include but are not limited to:

GDC specific Meetings:

Weekly Project Team meetings, to occur on Fridays.

Milestone meetings, projected to occur every 10 weeks. In-person attendance is projected to occur every 3rd meeting only.

GDC Standard Operating Procedures (SOP) Working Group meetings, projected to occur on the 1st Thursday of every month to draft, edit, and/or review the

SOP.

GDC Technical Discussion meetings, to occur on an ad-hoc basis when discussion is required.

CDC, GDC and/or BPC data semantics meetings, to occur biweekly on Wednesdays.

Moonshot Meetings:

HCMI Clinical Data Working Group meetings, projected to occur on Thursdays.

HCMI Full Analysis Working Group meetings, projected to occur biweekly on

Fridays.

HCMI Expression and WGS subgroups, projected to occur on an ad-hoc/biweekly basis, on Mondays and Fridays.

HCMI Steering Committee meetings

CCG Meetings:

CCG Staff meetings, to occur on Tuesdays.

Clinical Data Center (CDC), Biospecimen Processing Core (BPC) standing meetings, to occur biweekly on Wednesdays.

Genomics Characterization Centers (GCC) Projects Update call standing meetings to occur monthly, every 3rd Tuesday.

LymphoDB meeting with BPC:

Ad-hoc, estimated to occur every 2 weeks to review abstraction results.

Submit monthly status reports to the COR summarizing tasks accomplished.

2.3.4 Task 4 – Travel and Participation at Meetings/Conferences

The Contractor may be required to participate in the below meetings, during each performance period. The Contractor shall not travel or perform any services in support of the following meetings/conferences without prior written Contracting Officer approval.

American Association of Cancer Research (AACR):

Sponsor: Am. Assoc. Cancer Research Name: AACR Annual Meeting Location: TBD Dates: TBD

Other meetings as requested:

Sponsor TBD Name: TBD Location: TBD Dates: TBD

2.3.5 Task 5 – Transition Services (Phase Out)

The Contractor shall develop and submit a draft transition-out plan to the COR within 90 calendar days prior to the purchase order’s expiration date. The plan shall include a technical and management transition approach that is clear and complete including the timeline and resources required for transitioning from the incumbent to an incoming Contractor. The Contractor shall identify how it will coordinate with the incoming Contractor and/ or Government personnel to transfer knowledge. The plan shall detail the planned transition methodology in a logical sequence to ensure a smooth transition of all tasks and/or subtasks without interruption or degradation of service levels. The approved, final transition-out plan shall be followed to ensure an orderly, secure, efficient, and expedient transition of all contract activities by the purchase order’s expiration date.

2.4 INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY REQUIREMENTS

A. BASELINE SECURITY REQUIREMENTS

1. Applicability- The requirements herein apply whether the entire task order (hereafter "order"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality , which means preserving authorized restrictions on access and disclosure, based on the security terms found in this order, including means for protecting personal privacy and proprietary information;

• Integrity , which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability , which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this order or to which the Contractor may otherwise have access under this order. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov .

d. Comply with the Privacy Act requirements.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [X ] Low [ ] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/ order involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be:

[ ] No PII [ ] Low [X] Moderate [ ] High mailto:fisma@hhs.gov

4. Controlled Unclassified Information (CUI)- CUI is defined as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/ order, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a Need-To-Know basis;

c. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this order and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the order. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pd f . A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

7. Internet Protocol Version 6 (IPv6)- All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8. Government Websites- All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9. Task Order Documentation- The Contractor shall use provided templates, policies, forms and other agency documents provided by the Contracting Officer and the Contracting Officer's Representative to comply with order deliverables as appropriate.

10. Standard for Encryption- The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative within 15 days of the validation.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the order.

11. Contractor Non-Disclosure Agreement (NDA)- Each Contractor (and/or any subcontractor) employee having access to non-public government information under this order shall complete the NIH non-disclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pd f , as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)- The Contractor shall assist the NIH Office of the Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this order to determine whether or not a full PIA needs to be completed.

The NIH PIA guide is located at:

https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.p df.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the NIH Office of the SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. TRAINING

1. Mandatory Training for All Contractor Staff- All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf

Contractor Information Security Awareness, Privacy, and Records Management training course at http://irtsectraining.nih.gov/ before performing any work under this order.

Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this order. All provided training shall be compliant with HHS training policies.

2. Role-based Training- All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-based Training https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.

aspx

3. Training Records- The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this order in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after order award and annually thereafter or upon request.

C. RULES OF BEHAVIOR

1. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the order comply with the HHS Information Technology General Rules of Behavior, and comply with the NIH Information Technology General Rules of Behavior https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx , which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov.

2. All Contractor employees performing on the order must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the order and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed Rules of Behavior must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. INCIDENT RESPONSE

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an http://irtsectraining.nih.gov/ https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.aspx https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx http://irtsectraining.nih.gov/ information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cyber security and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for other than an authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as "a suspected or confirmed incident involving PII".

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this order so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send NIH approved notifications to affected individuals individuals in accordance with https://ocio.nih.gov/InfoSecurity/IncidentResponse/Pages/ir_guidelines.aspx .

3. Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT) via email at IRT@mail.nih.gov , COR, CO, the NIH Office of the SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, order information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and https://ocio.nih.gov/InfoSecurity/IncidentResponse/Pages/ir_guidelines.aspx https://ocio.nih.gov/InfoSecurity/IncidentResponse/Pages/ir_guidelines.aspx mailto:IRT@mail.nih.gov

c. encrypt sensitive information in attachments to email, media, etc.

4. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information HHS and NIH incident response policies when handling PII breaches.

5. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

This may also involve physical access to contractor facilities during a breach/incident investigation within an hour of discovery.

POSITION SENSITIVITY DESIGNATIONS:

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/ order:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation

(MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

F. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. (For additional information, see HSPD-12 policy at:

https://www.dhs.gov/homeland-security-presidential-directive-12).

https://www.dhs.gov/homeland-security-presidential-directive-12

Roster-

a. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this BPA. The Contractor shall describe the areas it will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this order.

Any revisions to the roster as a result of staffing changes shall be submitted within seven

(7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_ 10-15-12.xlsx .

b. If the Contractor is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

c. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

d. The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the order and if they have previously been the subject of national agency checks or background investigations.

e. All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this order. Contractors may begin work after the fingerprint check has been completed.

f. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14.

Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this order have a reasonable chance for approval.

g. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the order price of no more that the cost of the additional investigation(s).

h. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

i. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

j. Within 7 calendar days after the Government's final acceptance of the work under this order, or upon termination of the order, the Contractor shall return all identification badges to the Contracting Officer or designee.

G. PURCHASE ORDER INITIATION AND EXPIRATION

1. General Security Requirements- The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the order. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology or and in accordance with the HHS Contract Closeout Guide (2012).

HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html

2. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the order) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the order, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Notification- The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within fifteen days before an employee stops working under this order.

5. Contractor Responsibilities Upon Physical Completion of the Task Order - The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this order to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during order performance, in accordance with HHS and/or NIH policies.

6. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this order within 2 days of the employee's exit from the order. All documentation shall be made available to the CO and/or COR upon request.

H. RECORDS MANAGEMENT AND RETENTION

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/NIH policies and shall not dispose of any records unless authorized by HHS/NIH.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/NIH policies.

2.5 SECTION 508 ACCESSIBILITY STANDARDS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-

220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. Remediation of any materials that do not comply or conform with the applicable Section 508 requirements as set forth below, shall be the responsibility of the Contractor.

Products, platforms, and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at Revised 508 Standards and 255 Guidelines (access-board.gov) (https://www.access-board.gov/ict/).

Per Section 508 and as mandated under HHS Policy for Section 508 Compliance and Accessibility of Information and Communications Technology (ICT) (07/2020) all Information and Communication Technology (ICT) products or services, including but not limited to documents or electronic files provided to the NIH/NCI under contract must be conformant with Section 508 standards and accessible to persons with disabilities. Conformance shall be confirmed by use of material provided at HHS OS Factsheets & Reference Guides (Accessibility Technical Resources | HHS.gov) and verified through the use of the Accessibility Conformance Checklists | HHS.gov (based on conformance with WCAG 2.0 or better and the Section 508 Refresh ); in addition, contractors and vendors are encouraged to make use of the instructional materials and checklists at GSA Section 508.gov’s Create https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html https://www.hhs.gov/web/section-508/os-technical-resources/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.section508.gov/create/

Accessible Digital Products | Section508.gov.

Per Section 508 and as mandated under HHS Policy for Section 508 Compliance and Accessibility of Information and Communications Technology (ICT) (07/2020) all documents or electronic files provided to the NIH NCI under contract must be conformant with Section 508 standards and accessible to persons with disabilities. Conformance shall be confirmed by use of material provided at HHS OS Factsheets & Reference Guides and verified through the use of the HHS Checklist Documents (WCAG 2.0 Refresh); in addition, contractors and vendors are encouraged to make use of the instructional materials and checklists at GSA Section 508.gov’s Create Accessible Digital Products.

3.0 INSPECTION AND ACCEPTANCE

3.1 INSPECTION AND ACCEPTANCE CRITERIA

Pursuant to FAR clause 52.212-4, all work described in the SOW to be delivered under this purchase order is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the NCI Contracting Officer’s Representative (COR), specified in section 5.1 below, who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

4.0 PERFORMANCE/DELIVERABLES AND DELIVERY SCHEDULE

4.1 PERIOD OF PERFORMANCE

The period of performance shall consist of one (1), 12-month base period, plus two (2), 12-month option periods as follows:

Base Period: June 3, 2024 – June 2, 2025 Option Period 1: June 3, 2025 – June 2, 2026 Option Period 2: June 3, 2026 – June 2, 2027

Option Periods may be exercised in accordance with FAR Clause 52.217-9, entitled "Option to Extend the Term of the Contract."

The Government may elect to exercise the Optional CLINS outlined in section 1.4 during the applicable period of performance. Optional CLINS may be exercised in accordance with FAR 52.217-7, entitled “Option for Increased Quantity – Separately Priced Line Item.”

4.2 PLACE OF PERFORMANCE

All services shall be performed at the Contractor’s facility unless onsite services or meeting…