Partial_Combined_Synopsis_Solicitation_for_reference.pdf

COMBINED SYNOPSIS / SOLICITATION

COMPETITIVE

Title: Cybersecurity Service Program Support for the National Center for Advancing Translational Sciences (NCATS)

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. This acquisition is conducted under the authority of 42 U.S.C. 287(a).

(ii) The solicitation number is 75N95020R00009 and the solicitation is issued as a request for proposal (RFP).

This acquisition is for a commercial item or service and is conducted under the authority of the Federal Acquisition Regulation (FAR) Part 12—Acquisition of Commercial Items, and is expected to exceed the simplified acquisition threshold.

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-07 dated July 2, 2020.

(iv) The associated NAICS code is 541519 Other Computer-Related Services, and the small business size standard is $30 million. This requirement is set aside for small businesses.

(v) Schedule of Services:

This is anticipated to be an indefinite delivery/indefinite quantity contract using primarily fixed-price task orders, with the possibility of time-and-materials task orders if determined to be in the best interest of the Government.

(vi) Background:

NCATS has previously obtained cybersecurity support services using in-house resources. NCATS has now established a Cybersecurity Services (CSS) Division within the Information Technology Resources Branch (ITRB) to manage the NCATS-wide Cybersecurity Service Program. The support services provided under this contract will primarily consist of direct support to the CSS Division on a fixed-price basis, with the first task order to provide for full-time level of effort that will address the contract management and program management tasks described in the attached Statement of Work. Additional task orders may be issued on a fixed-price level of effort, fixed price completion, or time-and-materials basis.

(vii) Delivery is in accordance with the attached Schedule, f.o.b. destination, at:

The National Center for Advancing Translational Sciences (NCATS) 9800 Medical Center Drive Rockville, MD 20850

The ordering period will be from September 1, 2020 through August 31, 2023.

(viii) The provision at FAR clause 52.212-1, Instructions to Offerors – Commercial Items, applies to this acquisition and is incorporated by reference. Additional instructions are contained in the Schedule, Section L. This solicitation requires delivery of proposals as stated in Attachment 1, "Packaging and Delivery of Proposals for Use with the NIH Electronic Contract Proposal Submission (eCPS) Website." If your proposal is not received by the contracting officer or her designee at the place and time specified for the Office of Acquisitions, then it will be considered late and handled in accordance with subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors – Competitive Acquisition," located in Section L.1. of this solicitation.

(ix) Evaluation factors are provided in the Schedule, Section M. All non-price factors will be evaluated in accordance with FAR Subpart 12.602 “Streamlined evaluation of Offers.”

The price factor will be evaluated in accordance with FAR Subpart 12.209.

(x) Offerors are to include a completed copy of the provision at FAR clause 52.212-3, Offeror Representations and Certifications—Commercial Items, with offers.

(xi) The FAR clause at 52.212-4, Contract Terms and Conditions – Commercial Items, applies to this acquisition. Additional terms and conditions are included in the Schedule.

(xii) FAR clause at 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders–Commercial Items, applies to this acquisition. Clauses applicable to this acquisition are identified in the Schedule.

(xiii) Additional requirements and terms and conditions determined by the contracting officer to be necessary for this acquisition are included in the Schedule and attachments. In the event of a conflict or inconsistency between the FAR clauses 52.212-1, 52.212-4, and 52.212-5 and the Schedule, the Schedule shall take precedence.

(xiv) The Defense Priorities and Allocations System (DPAS) is not applicable to this requirement.

(xv) The Dun & Bradstreet Number (DUNS), the Taxpayer Identification Number (TIN), and the certification of business size must be included in the response. All offerors must have an active registration in the System for Award Management (SAM) www.sam.gov.

Proposals must reference solicitation number 75N95020R00009 and be submitted through the NIH Electronic Contract Proposal Submission website in accordance with Attachment 1, "Packaging and Delivery of Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website." Proposals must be submitted no later than 2:00 p.m. Eastern time on Monday, August 17, 2020. Offers will be valid for 120 days unless a different period is specified by the offeror on the attachment entitled, "Proposal Summary and Data Record,” NIH 2043.

Questions may be submitted by email to the contract specialist no later than 9:00 a.m.

Eastern time on Monday, July 27. INCLUDE THE SOLICITATION NUMBER IN THE

SUBJECT LINE OF THE EMAIL TO ENSURE IT IS APPROPRIATELY IDENTIFIED.

The Government will provide answers on or about Tuesday, August 4.

Direct questions by email to Stuart Kern, Contract Specialist, stuart.kern@nih.gov, tel.

301-402-3334.

http://www.sam.gov/ mailto:stuart.kern@nih.gov

RFP Number : 75N95020R00009

- 1 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NOTICE OF SMALL BUSINESS SET-ASIDE

c. NAICS CODE AND SIZE STANDARD

d. TYPE OF CONTRACT AND NUMBER OF AWARDS

e. COMMITMENT OF PUBLIC FUNDS

f. COMMUNICATIONS PRIOR TO CONTRACT AWARD

g. RELEASE OF INFORMATION

h. PREPARATION COSTS

i. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

5. Alternate Proposals

6. Evaluation of Proposals

7. Potential Award Without Discussions

8. Use of the Metric System of Measurement

9. Privacy Act - Treatment of Proposal Information

10. Selection of Offerors

11. Certification of Filing and Payment of Taxes

12. Past Performance Information

- 2 -

13. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS. . . 52

14. Electronic Information Technology Accessibility Notice, HHSAR 352.239-73 (December 2015)

15. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Information Other than Cost or Pricing Data

4. Salary Rate Limitation

5. Total Compensation Plan

6. Other Administrative Data

7. Qualifications of the Offeror

8. Subcontractors

9. Proposer's Annual Financial Report

10. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. MANDATORY QUALIFICATION CRITERIA

4. EVALUATION OF OPTIONS

5. TECHNICAL EVALUATION FACTORS

6. PAST PERFORMANCE FACTOR

- 3 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Center for Advancing Translational Sciences (NCATS) requires dedicated cybersecurity services to apply information security, privacy, and risk management measures to safeguard the confidentiality, integrity, and availability of the scientific systems and collaborative platforms that make up the NCATS virtual research organization.

ARTICLE B.2. PRICES/COSTS

1. This is an Indefinite Quantity contract as contemplated by FAR 16.504 negotiated using the procedures at FAR Subpart 13.5. The Contractor shall be reimbursed by the Government in an amount not less than a total of $5,000 (minimum) nor more than a total of $6,900,000 (maximum) for successful performance of this contract.

2. The prices set forth in this ARTICLE will cover the contract period 9/1/2020 through 8/31/2023.

3. The Government will issue task orders that are fixed-price level of effort, fixed-price completion, and time and materials, based on the work described in SECTION C of this contract.

4. The ceiling price does not constitute a commitment, implied or otherwise, that the Government will expend the entire amount indicated above.

ARTICLE B.3. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

- 4 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated June 14, 2020, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

a. Technical Progress Reports

1.Twice-Monthly Performance Report

The Contractor shall document the efforts performed in the completion of each task in a detailed twice monthly report and presentation. The report shall include the content identified in the SOW any additional information that NCATS deems necessary. The report shall include the following items and any additional information that NCATS deems necessary:

• Individual project status to include objectives met, work completed, and work outstanding;

• Weekly resource challenges;

• Issues and obstacles impeding progress and recommended solutions;

• Status of deliverables/milestones;

• Status and plan for activities relating to Very Important Persons (VIPs) and critical service tickets;

• Resource planning/status;

• Topics or issues identified by the COR.

2. Weekly Support Report

Due each Monday, the Contractor shall provide a status update on all active, pending, and recently completed tasks for all equipment support activities.

3. Monthly Support Report

Within fifteen (15) days following the end of each month, the Contractor shall deliver a report that describes all of the equipment support activities conducted during the reporting period, and the activities planned for the ensuing reporting period. The first reporting period consists of the first full month of performance plus any fractional part of the initial month. Thereafter, the reporting period shall consist of each calendar month.

http://www.hhs.gov/web/508/index.html

- 5 -

4. Weekly Programming Report

Due each Monday, the Contractor shall provide a status update on all active, pending, and recently completed tasks for all software development activities.

5. Monthly Programming Report

Within fifteen (15) days following the end of each month, the Contractor shall deliver a report that describes all of the software development activities conducted during the reporting period, and the activities planned for the ensuing reporting period. The first reporting period consists of the first full month of performance plus any fractional part of the initial month. Thereafter, the reporting period shall consist of each calendar month.

6. Monthly Budget and Labor Summary

Within fifteen (15) days following the end of each month, the Contractor shall provide a report summarizing the labor hours and budget expended per labor category for each month.

7. Technical Documentation

On an ongoing basis, the contractor shall document the systems, software, and procedures supported or developed during the contract and as requested by the Government.

8. Incident and Breach Report

The Contractor shall report all incidents, to include but not limited to unintended disclosures of information, as soon as possible but no later than one hour after the incident is discovered.

9. Final Management Plan

The Contractor shall finalize their Draft Management Plan (required with proposal submission) within fifteen (15) days following the effective date of the contract. The Final Management Plan shall reflect any changes, additions, or revisions to the Draft Management Plan as required by NCATS.

10. Final Transition-In Plan

The Contractor shall finalize their Draft Transition-In Plan (required with proposal submission) within three (3) days following the Contract Kick-Off Meeting. The Final Transition-In Plan shall reflect any changes, additions, or revisions to the Draft Transition Plan as required by NCATS.

11. Transition-Out Plan

The Contractor shall develop a Draft Transition-Out Plan that shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. The contractor shall provide the COR with the Draft Transition- Out Plan no later than ninety (90) days prior to the expiration of the contract. The Contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

- 6 -

• Program and project management processes;

• Points-of-contact (includes Key Stakeholders);

• Location of technical, program, and project management documentation and software tools;

• Status of ongoing technical initiatives;

• Appropriate contractor to contractor coordination to ensure a seamless transition;

• Transition of Key Personnel;

• Identifying schedules and milestones;

• Identifying actions required of the Government;

• Establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings.

The Draft Transition-Out Plan shall include:

• Coordination with Government representatives;

• Review, evaluation, and transition of current support services;

• Transition of historic data to new contractor systems;

• Transfer of hardware warranties and software licenses (if applicable);

• Transfer of all necessary business and/or technical documentation;

• Orientation phase and program to introduce Government personnel, programs, and users to the contractor's team, tools, methodologies, and business processes;

• Disposition of contractor-purchased Government owned assets, including facilities, equipment, furniture, phone lines, computer equipment, etc.;

• Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance;

• Personnel out-processing procedures, turn-in of all Government keys and ID/access cards;

• Upon receipt of Government approval of the Draft Transition-Out Plan, the Contractor shall execute the Final Transition-Out Plan.

12. Draft Final Report

At least thirty (30) days prior to contract expiration, the Contractor shall provide a report comprehensively describing the work performed and results obtained for the entire contract period of performance.

13. Final Report

On or before contract expiration, the Contractor shall provide a final report comprehensively describing the work performed and results obtained for the entire contract period of performance.

This report shall incorporate and address comments on the Draft Final Report that will be provided by the COR.

b. Other Reports/Deliverables

1. Source Code and Object Code

- 7 -

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

2. Information Security and Physical Access Reporting Requirements

The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract. Note: Each report listed below includes a reference to the appropriate subparagraph of this article.

a. Information Security Plan

An Information Security Plan consistent with Article H.6 shall be submitted to the Contracting Officer within 30 days following the effective date of any task order and updated annually on the anniversary date of the contract.

b. Roster of Employees Requiring Suitability Investigations

The Roster of Positions Requiring Suitability Investigations required by Article H.6 shall be submitted to the Contracting Officer and the COR along with the offeror's proposal.

c. Contractor Non-Disclosure Agreement

Contractor Non-Disclosure Agreements required by Article H.6 shall be submitted to the Contracting Officer and COR prior to performing any work under this contract.

e. Security Awareness, Privacy, and Records Training

Training records required by Article H.6. shall be submitted to the Contracting Officer and the COR prior to performing any work under a task order.

f. Rules of Behavior

Training records required by Article H.6 shall be submitted to the Contracting Officer and the COR prior to performing any work under this contract.

- 8 -

g. Incident Response

The Contractor shall report any incidents subject to Article H.6 within 24 hours of the occurrence.

h. Sanitization

The Contractor shall provide certification related to sanitization of records as required by Article H.6 to the Contracting Officer and COR upon the expiration of this contract.

i. Notification of Employee Departure

The Contractor shall notify the Contracting Officer, COR, and system Information Systems Security Officer (ISSO) within 15 days before an employee stops working under this contract.

j. Employee Separation Checklist

The NIH Contractor Employee Separation Checklist required by Article H.6 shall be submitted to the Contracting Officer and COR within two days of an employee's exit from the contract.

- 9 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

- 10 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the NCATS Contracting Officer's Representative is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Center for Advancing Translational Sciences (NCATS) Information Technology Resources Branch (ITRB) 9800 Medical Center Drive Rockville, MD 20850

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

FAR Clause 52.246-6, Inspection Time-and Material and Labor Hour (May 2001).

Alternate I (April 1984) is not applicable to this contract.

- 11 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

The ordering period for this contract shall be from 9/1/2020 through 8/31/2023.

ARTICLE F.2. DELIVERIES

Satisfactory performance of the final contract shall be deemed to occur upon performance of the work described in the Statement of Work Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the stated delivery schedule:

1. The items specified below as described in the REPORTING REQUIREMENTS Article in SECTION C of this contract will be required to be delivered F.o.b. Destination as set forth in FAR 52.247-35, F.o.b.

DESTINATION, WITHIN CONSIGNEES PREMISES ( APRIL 1984), and in accordance with and by the date( s) specified below and any specifications stated in SECTION D, PACKAGING, MARKING AND SHIPPING, of this contract:

Item Description Delivery to Delivery Schedule

(1) Twice-Monthly Performance Report

COR Due the 1 st and 15 th of each month

(2) Weekly Support Report COR Due each Monday

(3) Monthly Support Report COR Due the 15 th of each month

(4) Weekly Programming Report

COR Due each Monday

(5) Monthly Programming Report

COR Due the 15 th of each month

(6) Monthly Budget and Labor Report

COR Due the 15th of each month

(7) Technical Documentation COR Upon request/as developed

(8) Incident and Breach Report

CO, COR As needed

(9) Final Management Plan CO, COR Within 15 calendar days following the effective date of the contract

(10) Final Transition-In Plan CO, COR Within 3 calendar days following contract kick-off meeting

(11) Transition-Out Plan CO, COR At least 90 calendar days prior to contract expiration

(12) Draft Final Report CO, COR At least 30 calendar days prior to contract expiration

(13) Final Report CO, COR On or before contract expiration

- 12 -

Item Description Delivery to Delivery Schedule

(14) Source Code and Object Code

COR On or before contract expiration

(15) IT Security Plan CO, COR Within 30 days following the effective date of the contract and updated annually

(16) Roster of Employees Requiring Suitability Investigations

CO, COR Due with Proposal

(17) Contractor Non-Disclosure Agreements

CO, COR Prior to performing any work under the contract.

(18) Security Awareness, Privacy, and Records Training

CO, COR Prior to performing any work under the contract

(19) Rules of Behavior CO, COR Prior to performing any work under the contract

(20) Incident Response IRT, CO, COR Within 24 hours of occurrence

(21) Sanitization CO, COR At expiration of contract

(22) Notification of Employee Departure

CO, COR, ISSO 15 days before departure

(23) Employee Separation Checklist

CO, COR Within 2 days of employee's exit from the contract

Note:

CO: Contracting Officer

COR: Contracting Officer's Representative

IRT: Incident Response Team, irt@nih.gov

ISSO: Information Systems Security Officer

2. The above items shall be addressed and delivered to:

Addressee Deliverable Item No Contracting Officer: TBD

8- 13; 15- 23

Contracting Officer's Representative: TBD 1- 23 Incident Response Team: irt@nih.gov 20 mailto:irt@nih.gov

- 13 -

Addressee Deliverable Item No Information Systems Security Officer: TBD 15, 20, 22

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY

1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is not applicable to this contract.

https://www.acquisition.gov/?q=browsefar

- 14 -

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

[to be specified prior to award]

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days' notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

To be determined prior to task order award

ARTICLE G.3. TASK ORDER PROCEDURE

This contract provides for the issuance of Task Orders on a negotiated basis as follows:

1. General

Only the Contracting Officer may issue Task Orders to the Contractor, providing specific authorization or direction to perform work within the scope of the contract and as specified in the Statement of Work. Unless specifically authorized by the Contracting Officer, the Contractor shall not commence work until a fully executed Task Order has been awarded. The Contractor may incur costs under this contract in performance of task orders and task order modifications issued in accordance with this ARTICLE.

- 15 -

No other costs are authorized unless otherwise specified in the contract or expressly authorized by the Contracting Officer.

2. Requesting Task Order Proposals.

The Contracting Officer or a designated individual may solicit responses to requirements from Contractors within a technical area covered by a task order requirement in writing. A Task Order Request for Proposals (TORFP) will be prepared and issued for each task order requirement.

Generally, the Task Order Request for Proposal (TORFP) will include but is not limited to the following:

1. Statement of Work;

2. Reporting Requirements and Deliverables;

3. Proposal Due Date and Location to Deliver Proposals;

4. Period of Performance of Task Order;

5. Anticipated type of Task Order;

6. Technical Proposal Instructions;

7. Business proposal Instructions

8. Evaluation Factors for Award

All contract clauses contained this contract shall be incorporated in the TORFP and the resultant task order.

If conflicts exist between the contract clauses and the information outlined in the task order, the contract language takes precedence over the information in the task order.

Evaluation and Award of Task Order Proposals

The Government will evaluate the Task Order proposals against the requirements of the TORFP.

Specifically, the technical evaluation factors, cost/price, past performance and any other factor specifically identified in the TORFP will be used for evaluation of each proposal. In addition, the TORFP will identify the basis for awarding the task order. Generally, technical factors will be significantly more important than cost or price However, each TORFP will specify how the award decision will be made.

Upon completion of evaluations, the Contracting Officer will issue a task order to the Contractor.

ARTICLE G.4. INVOICE SUBMISSION

a. Invoice Instructions for NCATS Fixed-Price Contracts are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

1. The original invoice shall be submitted to the following designated billing office:

National Institutes of Health

- 16 -

Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

2. One copy of the invoice shall be submitted to the following approving official:

NCATS Contracting Officer NIDA Office of Acquisitions 3 WFN Rm 03C18 MSC 6012 301 North Stonestreet Ave.

Bethesda, MD 20892

E-mail: [to be specified prior to award]

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

[Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

1. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is

NIDA_INV_NCATS .

2. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

3. DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

4. Invoice Matching Option. This contract requires a two-way match.

5. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

6. The Contract Title is:

NCATS Cybersecurity Support Services

- 17 -

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

c. The Contractor shall include the following certification on every invoice for reimbursable costs incurred with Fiscal Year funds subject to HHSAR Clause 352.231-70, Salary Rate Limitation in SECTION I of this contract.

For billing purposes, certified invoices are required for the billing period during which the applicable Fiscal Year funds were initially charged through the final billing period utilizing the applicable Fiscal Year funds:

"I hereby certify that the salaries charged in this invoice are in compliance with HHSAR Clause 352.231-70, Salary Rate Limitation in SECTION I of the above referenced contract."

ARTICLE G.5. PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS

SUBCONTRACTORS, FAR 52.232-40 (December 2013)

a. Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

b. The acceleration of payments under this clause does not provide any new rights under the prompt Payment Act.

c. Include the substance of this clause, include this paragraph c, in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

(End of Clause)

ARTICLE G.6. GOVERNMENT PROPERTY

If this RFP will result in the acquisition or use of Government Property provided by the contracting agency or if the Contracting Officer authorizes in the preaward negotiation process, the acquisition of property (other than real property), this ARTICLE will include applicable provisions and incorporate the HHS Publication, entitled, "HHS Contracting Guide for Contract of Government Property," which can be found at: http://oamp.od.nih.gov/sites/default/ files/appendix_q_hhs_contracting_guide.pdf.

ARTICLE G.7. ON-SITE CONTRACTOR ACCESS TO GOVERNMENT PROPERTY

The Contractor shall be held responsible for Government Property, regardless of dollar value, when:

• The contract requires contractor personnel to be located on a Government site or installation;

• The property utilized by contractor personnel is incidental to the place of performance; and,

• The property used by the contractor remains accountable to the Government

Responsibility includes physical presence, proper use and handling, normal maintenance, and reporting loss, damage or destruction.

Responsibility for government property shared by two or more contractors or located in space shared by two or more contractors, shall be determined and documented by the contractors involved. In cases where the parties cannot reach agreement on shared responsibility, the matter will be referred to the NIH Property Officer for resolution.

ARTICLE G.8. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

1. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work.

http://oamp.od.nih.gov/sites/default/files/appendix_q_hhs_contracting_guide.pdf http://oamp.od.nih.gov/sites/default/files/appendix_q_hhs_contracting_guide.pdf

- 18 -

In addition to the Final evaluation, Interim evaluation(s) may be prepared periodically as determined by the Contracting Officer.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

2. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov http://www.cpars.gov

- 19 -

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. HUMAN SUBJECTS

It is hereby understood and agreed that research involving human subjects shall not be conducted under this contract, and that no material developed, modified, or delivered by or to the Government under this contract, or any subsequent modification of such material, will be used by the Contractor or made available by the Contractor for use by anyone other than the Government, for experimental or therapeutic use involving humans without the prior written approval of the Contracting Officer.

ARTICLE H.2. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.3. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

ARTICLE H.4. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

ARTICLE H.5. OPTION PROVISION

Option provisions will only apply to Task Order awards made under this contract. There are no option provisions applicable to this parent ID/IQ award.

Task orders issued under this contract may include options. Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., a task order will consist only of the base quantity/period of work as set forth in the task order. Pursuant to FAR Clause 52.217-7 Option for Increased Quantity-Separately Priced Line Item and FAR Clause 52.217-9 Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the task order. If the Government exercises this option, (1) the estimated cost of the task order will be increased; or

(2) the price of the task order will be increased.

ARTICLE H.6. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT

PROCUREMENTS

ARTICLE H.6.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1. Applicability- The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

- 20 -

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

2. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

3. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

4. Comply with the Privacy Act requirements.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

mailto:fisma@hhs.gov

- 21 -

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4. Controlled Unclassified Information (CUI)- CUI is defined as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a Need-To-Know basis;

c. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

- 22 -

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

7. Internet Protocol Version 6 (IPv6)- All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8. Government Websites- All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer…