Amend_01_Att_01_02_03_RFP_75N94024R00003_8_23_24_0001.pdf

Amendment 01 - RFP 75N94024R00003 August 23, 2024 Attachment 01

SECTION H - Special Contract Requirements - is revised to include:

20. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

GOVERNMENT INFORMATION PROCESSED ON GOCO OR COCO SYSTEMS

A. SECURITY REQUIREMENTS FOR GOVERNMENT-OWNED/CONTRACTOR-OPERATED

(GOCO )AND CONTRACTOR-OWNED/CONTRACTOR-OPERATED (COCO) RESOURCES

a. Federal Policies- The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P), Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

b. Assessment and Authorization (A&A)- A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) within three (3) months after contract award. The Contractor shall conduct the A&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

• System Security Plan (SSP) - due within 90 days after contract award. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and NIH policies and other guidance. The SSP shall be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system.

The Contractor shall update the SSP at least annually thereafter.

• POA&M - due 90 days after contract award, with the System Security Plan.The POA&M shall be documented consistent with the HHS Standard for Plan of Action and Milestones and NIH policies. All findings/weaknesses shall be documented in the POA&M and remediated/mitigated from the date the weaknesses are formally identified and documented by the timelines below:

◦ Critical within 30 days:

◦ High within 60 days;

◦ Medium within 1 year; and

◦ Low within 1 year.

The NIH will determine the risk rating of vulnerabilities. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, shall be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, NIH may require designated POA&M weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M shall be updated at least quarterly.

3. Information Security Continuous Monitoring - Upon the government issuance of an Authority to Operate (ATO), the Contractor (and/or subcontractor)-owned/operated systems that input, store, process, output, and/ or transmit government information, shall meet or exceed the Information Security Continuous Monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations , and HHS IS2P. The following are the minimum requirements for ISCM:

ii. Asset Management - Using any available Security Content Automation Protocol (SCAP)- compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS- owned information/ data. It is anticipated that this inventory information will be required to be produced at least 60 days after contract award. IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The Contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

iii. Configuration Management - Use available SCAP- compliant automated tools, per NIST IR 7511, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard HHS and government configuration baselines at least within 60 days. The Contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

iv. Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST- specified SCAP standards for vulnerability identification and management. The Contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP- compliant automated tools and report to the agency at least within 30 days of the contract award.

v. Patching and Vulnerability Remediation - Install vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within vendor and agency specified timeframes.

vi. Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

vii. Boundary Protection - The Contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities is routed through a Trusted Internet Connection (TIC).

• Government Access for Security Assessment - In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor's facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

i. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government's direction, without notice at any time during a weekday during regular business hours Contractor local time, to access Contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract.

The Government includes but is not limited to the U.S. Department of Justice, U.S.

Government Accountability Office, and the HHS Office of the Inspector General (OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, SQL injection vulnerabilities, and any other known vulnerabilities.

ii. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the Contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

◦ Segregate Government protected information and metadata on the handling of Government protected information from other information. Commingling of information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

◦ Cooperate with inspections, audits, investigations, and reviews.

4. End of Life Compliance- The Contractor (and/or any subcontractor) must use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software need to be within one major version of the current version; deviation from this requirement will only be allowed via the HHS waiver process (approved by HHS CISO). The Contractor shall retire and/or upgrade all software/systems that have reached end-of-life in accordance with HHS End-of-Life Operating Systems, Software, and Applications Policy.

5. Desktops, Laptops, and Other Computing Devices Required for Use by the Contractor- The Contractor (and/or any subcontractor) shall ensure that all IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices, etc.) used to process information on behalf of HHS are deployed and operated in accordance with approved security configurations and meet the following minimum requirements:

i. Encrypt equipment and sensitive information stored and/or processed by such equipment in accordance with HHS and FIPS 140-3 encryption standards.

ii. Configure laptops and desktops in accordance with the latest applicable United States Government Configuration Baseline (USGCB), and HHS Minimum Security Configuration Standards;

iii. Maintain the latest operating system patch release and anti-virus software definitions within 15 days.

iv. Validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching and ensure changes in hardware and software do not alter the approved configuration settings; and

v. Automate configuration settings and configuration management in accordance with HHS security policies, including but not limited to:

• Configuring its systems to allow for periodic HHS vulnerability and security configuration assessment scanning; and

• Using Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capabilities to scan its systems at least on a monthly basis and report the results of these scans to the CO and/or COR, Project Officer, and any other applicable designated

POC.

6. Rights to Data. All contracts that require data to be produced, furnished, acquired, or used in meeting contract performance requirements, must contain terms that delineate the respective rights and obligations of the Government and the contractor regarding the use, reproduction, and disclosure of that data. Data rights clauses do not specify the type, quantity or quality of data that is to be delivered, but only the respective rights of the Government and the contractor regarding the use, disclosure, or reproduction of the data.

Accordingly, the contract must specify the data to be delivered.

7. Information and Communications Technology (ICT) Cybersecurity Supply Chain Risk Management (C-SCRM) requirements. The Contractor (and/or any subcontractor) must secure their ICT supply chain in compliance with HHS Policy for Cyber Supply Chain Risk Management and Public Law 115-232 § 889. At a minimum, they must implement the following:

i. Develop rules for suppliers' development methods, techniques, or practices;

ii. Use of secondary market components;

iii. Prohibit counterfeit products;

iv. Dispose and/or retain elements such as components, data, or intellectual property securely;

v. Ensure adequate supply of components;

vi. Require external providers handling federal information or operating systems on behalf of the federal government to meet the same security and privacy requirements as federal agencies;

vii. Require external providers to express security and privacy requirements (including the controls for systems processing, storing, or transmitting federal information) in contracts or other formal agreements;

viii. Establish Service Level Agreements (SLAs), patching vehicles and disclosure requirements in the case of a security incident or new vulnerability being discovered; and

ix. Ensure that the supplier applies same contractual requirements to any sub-contractors/suppliers that they involve in the provision of the product or service to the customer; and

x. Prohibit the use of covered telecommunications and video surveillance equipment or services.

Attachment 02

SECTION M - Evaluation Factors for Award

6. Section 508 and Electronic and Information Technology products or service requirements: The contract involves the production of reports, transition plans and data modules. Data exported as deliverables shall be accessible by those that use assistive technologies in addition to the reports and transition plans described within the SOW as deliverables. They shall be compliant and in conformance with the Revised Section 508 Standards of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

Additional information remediating and testing all deliverables and reports including guidance and specific checklists, by application, as well as completion of VPATs for Section 508 compliance and conformance, can be found at HHS Digital Accessibility & Section 508 and "HHS Accessibility Conformance Checklists" in excel or word format.

For additional information for completion of appropriate VPAT templates using the ARC tool that need to be completed please refer to ITIC.org VPAT under Resources as Word document. For further Information on the standards go to the ICT Accessibility 508 Standards and 255 Guidelines and GSA Section508.gov.

The government also requests that the creating documents prior to pressing into a pdf shall be remediated for Section 508 Compliance and Conformance and submitted along with any deliverable pdfs. The government will accept the solely the creating document if it is an Office 365 product along with the appropriate checklist if the contractor does not have a requirement by the government to produce a pdf as a deliverable. The appropriate HHS/VPAT checklist shall be submitted for both the creating documents and any pdf deliverables. For documents created using Adobe InDesign or applications not created using the Office 365 product, the creating documents and the resulting pdfs along with appropriate checklists for each item shall be submitted as deliverables.

https://www.hhs.gov/web/section-508/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.itic.org/policy/accessibility/vpat http://www.access-board.gov/ http://www.access-board.gov/ http://www.section508.gov/

Attachment 03

Statement of Work Pre-Clinical Contract Administration- Task Order 01

SAMPLE

I. BACKGROUND AND INTRODUCTION

NIAAA currently supports a preclinical medication efficacy testing program to foster discovery of medication targets and lead compounds to treat Alcohol Use Disorder (AUD). The program is currently supported by three contracts for the blind testing of reference compounds, compounds of interest, and proprietary compounds on alcohol consumption in preclinical rodent models: 1) Contract HHSN75N94019C00008 with the University of South Carolina (MUSC), to assess the effects of compounds in standardized models of alcohol dependence-induced alcohol intake using mice for subjects; 2) Contract HHSN75N94019C00009 with Indiana University which tests medications in alcohol preferring P and HAD1 rats selectively bred for alcohol preference;

and 3) Contract HHS75N94023C00014 with the Louisiana State University Health Sciences Center in Wistar rats using models of various aspects of AUD including excessive drinking, negative affect, and pain (awarded in 2023 with option periods through 2028).

Developing medications to treat AUD is a program priority for NIAAA. To achieve this mission, continued compound testing in standardized preclinical models of AUD is needed. As such, NIAAA’s Division of Treatment and Recovery/Medications Development Branch seeks to award a contract for the blind testing of compounds in preclinical models of AUD.

II. SCOPE

To provide assistance in study design review, development, literature review, activities associated with past, present, and future NIAAA pre-clinical studies.

III. TECHNICAL REQUIREMENTS

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities not otherwise provided by the Government, as needed to perform this Statement of Work. Specifically, the Contractor shall perform the activities and requirements below.

The Government estimates the time necessary for the Contractor(s) to complete the protocol reviews, protocol development, literature reviews, and query resolution, as outlined below. The request for services under this task may occur at any time during the period of performance.

Specifically, the Contractor shall:

The Principal Investigator shall provide review and analysis of new study designs (protocols) generated by NIAAA and/or develop or propose new ideas for studies for consideration by NIAAA as requested by the Contracting Officer Representative (COR).

A. STUDY DESIGN DEVELOPMENT

The Principal Investigator, Co-Investigators and Study coordinators shall assist NIAAA in development of new studies according to the paradigm selected.

B. INFORMAL CONSULTATION

The Principal Investigator shall provide informal consultation to NIAAA Program staff on issues related to pre-clinical laboratory paradigms when requested by the COR.

C. QUERY RESOLUTION

The contractor shall respond to queries from the NIAAA Program Staff regarding studies conducted under this contract.

D. ANIMAL CARE

In between studies, the contractor will be responsible for upkeep of animal care areas and facilities to ensure compliance with the terms of this award and Public Health Service policies on animal care and procurement.

IV. Reporting Requirements and Deliverables

Contractor shall prepare and submit required reports and deliverables specified in the Reporting and Deliverables table for this task order.

V. Section 508 and Electronic and Information Technology products or service requirements: The contract involves the production of reports, transition plans and data modules. Data exported as deliverables shall be accessible by those that use assistive technologies in addition to the reports and transition plans described within the SOW as deliverables. They shall be compliant and in conformance with the Revised Section 508 Standards of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

Additional information remediating and testing all deliverables and reports including guidance and specific checklists, by application, as well as completion of VPATs for Section 508 compliance and conformance, can be found at HHS Digital Accessibility &

Section 508 and "HHS Accessibility Conformance Checklists" in excel or word format.

For additional information for completion of appropriate VPAT templates using the ARC tool that need to be completed please refer to ITIC.org VPAT under Resources as Word document. For further Information on the standards go to the ICT Accessibility 508 Standards and 255 Guidelines and GSA Section508.gov.

The government also requests that the creating documents prior to pressing into a pdf shall be remediated for Section 508 Compliance and Conformance and submitted along with any deliverable pdfs. The government will accept the solely the creating document if it is an Office 365 product along with the appropriate checklist if the contractor does not have a requirement by the government to produce a pdf as a deliverable. The appropriate HHS/VPAT checklist shall be submitted for both the creating documents and any pdf deliverables. For documents created using Adobe InDesign or applications not created using the Office 365 product, the creating documents and the resulting pdfs along with appropriate checklists for each item shall be submitted as deliverables.

VI. Period of Performance

The period of performance of this task order will be twelve months, with six (6) twelve (12)-month options and is estimated to begin December 1, 2024.

Estimated performance periods are as follow:

Base: 12/1/2024 – 11/30/2025 Option Period 1: 12/1/2025 – 11/30/2026 Option Period 2: 12/1/2026 – 11/30/2027 Option Period 3: 12/1/2027 – 11/30/2028 Option Period 4: 12/1/2028 – 11/30/2029 Option Period 5: 12/1/2029 – 11/30/2030 Option Period 6: 12/1/2030 – 11/30/2031 https://www.hhs.gov/web/section-508/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.itic.org/policy/accessibility/vpat http://www.access-board.gov/ http://www.access-board.gov/ http://www.section508.gov/