75N95021R00025.pdf

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: P.L. 99-158 as amended

2. Request for Proposal (RFP) Number:

75N95021R00025

3. Issue Date:

July 29,

4. Set Aside:

[X] No [ ] Yes See Part IV Section L

5. Title: 7 Tesla MRI Scanner for Clinical Aging Research

6. ISSUED BY:

Office of Acquisition National Institute on Drug Abuse National Institutes of Health National Institute on Aging Section

11601 Landsdown Street Bethesda, MD 20892

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposal," until 1:00 PM local time on August 25, 2021 . Offers will be valid for 120 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING AND DELIVERY OF THE PROPOSAL." If proposals are required to be delivered to two different locations, the OFFICIAL POINT OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF ACQUISITIONS.

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT

THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE

CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors--Competitive Acquisition, LOCATED IN SECTION

L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) prior to award of a contract. Offerors must access the CCR through The System for Award Management (SAM) at https://www.sam.gov.

11. FOR INFORMATION CALL: Renee Dougherty

PHONE: 301-827-8453

e-MAIL: renee.dougherty@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

All questions pertaining to this solicitation must be submitted to Renee Dougherty renee.dougherty@nih.gov and Karen Mahon at karen.mahon@nih.gov by 1:00 p.m. on August 9, 2021.

Renee Dougherty Contracting Officer Office of Acquisition renee.dougherty@nih.gov https://www.sam.gov/ mailto:renee.dougherty@nih.gov mailto:karen.mahon@nih.gov

RFP Number : 75N95021R00025

- 1 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - PURCHASE DESCRIPTION

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. COMMITMENT OF PUBLIC FUNDS

e. COMMUNICATIONS PRIOR TO CONTRACT AWARD

f. RELEASE OF INFORMATION

g. PREPARATION COSTS

h. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

5. Alternate Proposals

6. Evaluation of Proposals

7. Potential Award Without Discussions

8. Use of the Metric System of Measurement

9. Privacy Act - Treatment of Proposal Information

10. CERTIFICATION REGARDING TAX MATTERS (OCT 2020)

11. Past Performance Information

12. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

- 2 -

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Small Business Subcontracting Plan

4. HUBZone Small Business Concerns

5. Other Administrative Data

6. Subcontractors

7. Proposer's Annual Financial Report

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. TECHNICAL EVALUATION FACTORS

4. PAST PERFORMANCE FACTOR

- 3 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

7T Ultra-high-field MRI system for advanced magnetic resonance imaging and spectroscopy of Alzheimer's Disease.

ARTICLE B.2. PRICES/COSTS

The final contract will contain the price/cost provisions agreed upon by the Government and the Offeror.

ARTICLE B.3. PRICES

a. The total fixed price of this contract is $ .

b. Upon delivery and acceptance of the item(s) specified in the DELIVERY Article in SECTION F and described in SECTION C of this contract, the Government shall pay to the Contractor the total fixed price.

ARTICLE B.4. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

- 4 -

SECTION C - PURCHASE DESCRIPTION

ARTICLE C.1. PURCHASE DESCRIPTION

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to provide the item described in the Purchase Description, dated 07/28/2021, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

- 5 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

- 6 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

MedStar Harbor Hospital 3001 S Hanover Street Baltimore, MD 21225

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-2, Inspection of Supplies - Fixed Price (August 1996).

FAR Clause 52.246-16, Responsibility for Supplies (April 1984).

- 7 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. DELIVERIES

a. Satisfactory performance of this contract shall be deemed to occur upon performance of the work described in the Description Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the Items specified in the Delivery Schedule which are described in SECTION C of this contract.

b. Deliveries required by the Contractor shall be made F.o.b. destination as set forth in FAR Clause 52.247-35, F.o.b. Destination, Within consignees Premises (April 1984) [and any specifications stated in SECTION D, PACKAGING AND MARKING AND SHIPPING, of this contract] to the address/addressee listed below:

c. Delivery Address

MedStar Harbor Hospital

3001 S Hanover Street

Baltimore, MD 21225

d. Deliveries shall be made at a time when minimal disruption to the hospital's normal operation will occur, such as weekends, holidays, or evenings and installed in coordination with the Contracting Officer’s Representative (COR) at the time the equipment is ready.

ARTICLE F.2. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY

1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is not applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

- 8 -

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be specified prior to award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract.

The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. The Contractor shall submit invoice to the National Institutes of Health (NIH)/Office of Financial Management (OFM) via email at invoicing@nih.gov with a copy to the approving official, as directed below. The Contractor must follow step-by-step instructions as stated in the NIH/OFM Electronic Invoicing Instructions for NIH Contractors/Vendors, which is included as an attachment in Section J of this contract. The invoice shall be transmitted as an attachment via email to the address listed above in one of the following formats: Word, or Adobe Portable Document Format (PDF). The Contractor must submit only one invoice per email. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your invoice unless specified elsewhere in the contract or requested by the Contracting Officer.

The Contractor shall submit a copy of the electronic invoice to the following Approving Official (Contracting Officer) and Contracting Officer's Representative:

Approving Official: Contracting Officer

Name- Email Address-

Contracting Officer's Representative

Name- Email Address-

- 9 -

For inquiries regarding the status of invoices, contact OFM Customer Service via email at ofm_customer_service@incontactemail.com or via phone at 301-496-6088. To send your inquiries via other available communication methods refer to the OFM Customer Service website at https:// ofm.od.nih.gov/Pages/Customer-Service.aspx.

Note: The OFM Customer Service is open Eastern Standard Time Monday - Friday from 8:30 a.m. to 5:00 p.m. and is closed between 12:00 p.m. to 1:00 p.m.

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

ARTICLE G.3. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart

42.15. The Final performance evaluation will be prepared at the time of completion of work.

Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation.

The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov

- 10 -

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.2. SUBCONTRACTING PROVISIONS

a. Small Business Subcontracting Plan

1. The Small Business Subcontracting Plan, dated is attached hereto and made a part of this contract.

2. The failure of any Contractor or subcontractor to comply in good faith with FAR Clause 52.219-8, entitled "Utilization of Small Business Concerns" incorporated in this contract and the attached Subcontracting Plan, will be a material breach of such contract or subcontract and subject to the remedies reserved to the Government under FAR Clause 52.219-16 entitled, "Liquidated Damages-Subcontracting Plan."

b. Subcontracting Reports

The Contractor shall submit the following Subcontracting reports electronically via the "electronic Subcontracting Reporting System (eSRS) at http://www.esrs.gov.

1. Individual Subcontract Reports (ISR)

Regardless of the effective date of this contract, the Report shall be due on the following dates for the entire life of this contract:

April 30th October 30th Expiration Date of Contract

2. Summary Subcontract Report (SSR)

Regardless of the effective date of this contract, the Summary Subcontract Report shall be submitted annually on the following date for the entire life of this contract:

October 30th

For both the Individual and Summary Subcontract Reports, the Contracting Officer shall be included as a contact for notification purposes at the following e-mail address:

Contracting Officer

ARTICLE H.3. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT

PROCUREMENTS

ARTICLE H.3.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

- 11 -

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

■ Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

■ Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

■ Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, NIH SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

■ Confidentiality: [X] Low [ ] Moderate [ ] High

■ Integrity: [ ] Low [X] Moderate [ ] High

■ Availability: [X] Low [ ] Moderate [ ] High

■ Overall Impact Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality,

- 12 -integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/NIH privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements.

PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

■ If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

■ The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/ contract, must be:

i. Marked appropriately;

- 13 -

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171,Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor.

Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use NIH provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

- 14 -

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.)

and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR, if applicable.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http:// csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the NIH non-disclosure agreement at https://irtsectraining.nih.gov/NDA.aspx, as applicable. Contractors (and/ or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract.

All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and NIH Rules of Behavior at https:// irtsectraining.nih.gov/CSA/0301010_BehaviorRules.aspx

- 15 -

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send NIH approved notifications to affected individuals in accordance with https://us-cert.cisa.gov/incident-notification-guidelines

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT) via email at IRT@mail.nih.gov, COR, CO, NIH SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

■ Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

■ Not include any sensitive information in the subject or body of any reporting e-mail;

and

■ Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/NIH and NIH privacy breach response policies when handling PII breaches.

- 16 -

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

To Be Determined

6. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within fourteen (14) calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

- 17 -

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within fifteen (15) days before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/ publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this contract within two (2) day of the employee's exit from the contract. All documentation must be available to the CO and/ or COR upon request.

9. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS Policy for Records Management and NIH policies and must not dispose of any records unless authorized by

HHS/NIH.

b. In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, he/she must document and report the incident in accordance with HHS/NIH policies.

10. High Value Asset (HVA)

If a system is identified as HVA,[23] the contractor must comply with the HHS Policy for the High Value Asset (HVA) Program and the DHS HVA Control Overlay[24] in addition to the above requirements.

- 18 -

ARTICLE H.4. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is: https://oig.hhs.gov/fraud/report-fraud/ and the mailing address is:

US Department of Health and Human Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489 Washington, D.C. 20026

- 19 -

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

THE FOLLOWING ARTICLE I.1. GENERAL CLAUSE LISTING(S) WILL BE APPLICABLE TO MOST CONTRACTS

RESULTING FROM THIS RFP. HOWEVER, THE ORGANIZATIONAL STRUCTURE OF THE SUCCESSFUL

OFFEROR(S) WILL DETERMINE THE SPECIFIC GENERAL CLAUSE LISTING TO BE CONTAINED IN THE

CONTRACT(S) AWARDED FROM THIS RFP:

The complete listing of these clauses may be accessed at:

https://oamp.od.nih.gov/DGS/reference-material-prospective-offerors-and-contractors

ARTICLE I.1. GENERAL CLAUSES FOR A NEGOTIATED FIXED-PRICE SUPPLY CONTRACT

- 20 -

ARTICLE I.2. AUTHORIZED SUBSTITUTIONS OF CLAUSES

Any authorized substitutions and/or modifications other than the General Clauses which will be based on the type of contract/Contractor will be determined during negotiations.

It is expected that the following substitution(s) will be made part of the resultant contract:

a. FAR Clauses 52.215-15, Pension Adjustments and Asset Reversions (October 2010); 52.215-18, Reversion or Adjustment of Plans for Post Retirement Benefits (PRB) Other Than Pensions (July 2005); and, 52.215-19, Notification of Ownership Changes (October 1997), are deleted in their entirety.

b. FAR Clause 52.249-4, Termination for Convenience of the Government (Services) (Short Form) (April 1984), is deleted in its entirety and FAR Clause 52.249-2, Termination for Convenience of the Government (Fixed Price) (April 2012) is substituted therefor.

- 21 -

ARTICLE I.3. ADDITIONAL CONTRACT CLAUSES

Additional clauses other than those listed below which are based on the type of contract/Contractor shall be determined during negotiations. Any contract awarded from this solicitation will contain the following:

This contract incorporates the following clauses by reference, (unless otherwise noted), with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

a. FEDERAL ACQUISITION REGULATION (FAR) (48 CFR CHAPTER 1) CLAUSES

1. FAR Clause 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (March 2020).

"(c) Waiver of evaluation preference [ ] Offeror elects to waive the evaluation preference."

2. FAR Clause 52.219-28, Post-Award Small Business Program Rerepresentation (November 2020).

52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

1. The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services-Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

a. Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25 , Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

b. Prohibition.

a. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to-

i. Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

- 22 -

ii. Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

b. Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

Nothing in the prohibition shall be construed to-

i. Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

ii. Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

c. Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) ( https://www.sam.gov ) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

d. Representation. The Offeror represents that-

a. It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

b. After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that-

It [ ] does, [ ] does not not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

e. Disclosures.

a. Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

- 23 -

i. For covered equipment-

A. The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a…