75N95022R00005 Attachment 4 SOW Amendment 2.pdf

STATEMENT OF WORK 1

STATEMENT OF WORK

Screening of Investigational Therapeutics to Treat, Modify or Prevent Epilepsy for the NINDS

Epilepsy Therapy Screening Program (ETSP)

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work.

BACKGROUND AND OBJECTIVES

The NINDS Epilepsy Therapy Screening Program (ETSP), until recently known as the Anticonvulsant Screening Program (ASP), was established in 1975 to address a critical need for new anti-seizure medications and to promote industry interest in their development. Since its inception, the program has been supported through contracts awarded to the University of Utah. The screening process involves researchers from academia and industry in the U.S. and abroad (“ETSP participants”) submitting compounds to the ETSP for investigation in a series of animal (rodent) seizure (acute and chronic) and epilepsy models. These tests are performed blinded by the contract laboratory and on a confidential basis through a written agreement between the NINDS and the ETSP participant at no cost to the ETSP participant. The NINDS ETSP program office reports test results to participants and provides advice on future steps for promising compounds, while protecting confidentiality and intellectual property. Approximately, 32,000 compounds have been screened to date, and the ETSP has contributed to bringing 11 anti-seizure drugs to market since 1990, with a major role in some and a minor role in others.

The ETSP program is routinely reviewed, most recently in 2020, by Working Groups commissioned by the National Advisory Neurological Disorders and Stroke (NANDS) Council. The 2012 and 2015 Working Groups’ review reports recommended prioritizing treatments for drug resistant epilepsy and disease prevention and modification (anti-epileptogenesis) over the identification of additional undifferentiated anti-seizure drugs. The new name of the program given in 2015 emphasizes that a major focus is going beyond the symptomatic treatment of seizures to identifying agents that have the potential to prevent seizure development or disease progression. Additional details on the reports containing the Working Group’s recommendations are available for review at https://www.ninds.nih.gov/Current-Research/Focus-Research/Focus-Epilepsy/ETSP.

SCOPE

The Contractor during the performance period of the contract shall perform various preclinical pharmacological evaluations of potential therapeutic agents for the treatment of epilepsy and related disorders and conduct supporting pharmacokinetic studies using normal or epileptic animals. On an “as needed” basis, Contractor shall also adapt, develop, validate, and implement new models to support the ETSP mission.

https://www.ninds.nih.gov/Current-Research/Focus-Research/Focus-Epilepsy/ETSP

STATEMENT OF WORK 2

TECHNICAL REQUIREMENTS

This contract will support the conduct of preclinical pharmacological evaluations of potential therapeutic agents (small molecules, natural products, synthetic peptides, biologics and referred to hereafter as ETSP “investigational compounds”) for the treatment of epilepsy and related disorders.

The contract may also require evaluation of biomedical devices for the treatment of epilepsy and related disorders. This contract shall require the Contractor to conduct studies evaluating investigational compounds in the following performance areas: 1) established workflow for drug resistant epilepsy, 2) models of disease prevention and modification (anti-epileptogenesis), and 3) pharmacokinetic studies. In addition, the Contractor shall be required to perform ancillary studies and optional tasks to support the evolving requirements of the ETSP.

The Government expects the preponderance of work to be performed by the prime Contractor. Given factors including the complexity of the tasks, need for uniformity and consistency of results, protection of intellectual property rights, and management of controlled substances, the operational pieces must be well coordinated and controlled which is more likely to be successfully accomplished when the work is performed within the same organization. It is recognized that some subcontracting may be required where the Contractor does not have the capability to perform certain tasks in-house.

In any event, the Contractor, despite the use of subcontracting shall be responsible for full and complete performance of all aspects of the Statement of Work (SoW).

I. PERFORMANCE AREAS

A. PERFORMANCE AREA 1 – Established Workflow for Drug Resistant Epilepsy

Objective:

Implement both acute and chronic seizure models in a workflow for evaluation of investigational compounds for the treatment of drug resistant epilepsy. The models listed below at minimum are required for the drug resistant epilepsy workflow.

Technical Requirements:

Workflow for Performance Area 1 - Based on the recommendations of the NANDS Working Group (report available for review at (https://www.ninds.nih.gov/Current-Research/Focus-Research/Focus- Epilepsy/ETSP), further discussions with ETSP External Consulting Board (ECB) members and other scientific input, the screening paradigm below shall be implemented for the identification of investigational compounds for the treatment of drug resistant epilepsy. The models and approximate number of investigational compounds expected to be screened annually are also described below.

The estimates of the numbers of tests required for each model are approximate numbers and provided for use when estimating the cost proposal only.

STATEMENT OF WORK 3

Workflow for Drug Resistant Epilepsy

Codes containing a number and letter combination (1a, 1b etc.) in the above workflow diagram correspond to models listed below.

1. Implement acute seizure models, identification phase of the screening workflow

a. 6 Hz electrical stimulation seizure model, mouse and rat (Approximately 100 investigational compounds time of peak effect determinations and approximately 80 ED-50 determinations in mice and 30 time of peak effect and ED-50 determinations in rats annually)

b. Maximal electroshock seizure model, mouse and rat (Approximately 100 investigational compounds time of peak effect determinations and approximately 80 ED-50 determinations in mice and 30 time of peak effect and ED-50 determinations in rats annually)

2. Implement behavioral tolerability screens

a. Rotarod assessment, mouse (Approximately 80 investigational compounds annually)

b. Minimal motor impairment assessment, rat (Approximately 30 investigational compounds annually)

STATEMENT OF WORK 4

c. Locomotor activity assessment, rat (Approximately 30 investigational compounds annually)

d. Modified Irwin test, rat (Approximately 20 investigational compounds annually)

3. Implement chronic seizure models, identification phase of the screening workflow

a. Corneal kindling seizure model, mouse (Approximately 35 investigational compounds annually)

b. Spontaneously bursting hippocampal slice from post-kainic acid status epilepticus rat, in vitro model (Approximately 10 investigational compounds annually)

4. Implement chronic seizure models, differentiation phase of the screening workflow - acute dosing

a. Intra-hippocampal kainate-induced spontaneous, recurrent, electrographic hippocampal paroxysmal discharges measured with EEG monitoring, mouse (Approximately 20 investigational compounds annually)

b. Lamotrigine-resistant amygdala kindling seizure model, rat. Behavioral seizure scores and the duration of EEG afterdischarge are primary endpoints (Approximately 15 investigational compounds annually)

5. Implement chronic seizure models, differentiation phase of the screening workflow - subacute dosing

a. Intra-amygdala kainate-induced spontaneous recurrent seizures measured with video- EEG monitoring, mouse (Approximately 12 investigational compounds annually)

b. Post-kainic acid status epilepticus-induced spontaneous recurrent seizures measured with video-EEG monitoring, rat: phase I pilot study with sub-chronic dosing by intraperitoneal (i.p.) or subcutaneous (s.c.) administration (Approximately 12 investigational compounds annually)

c. Post-kainic acid status epilepticus-induced spontaneous recurrent seizures measured with video-EEG monitoring, rat: phase II study with oral dosing administered via an automated feeding system (Approximately 6 investigational compounds annually)

6. Implement ancillary drug resistant epilepsy models

a. Benzodiazepine resistant lithium-pilocarpine status epilepticus model, rat (Approximately 6 investigational compounds annually)

b. Theiler’s Murine Encephalomyelitis Virus (TMEV) model, mouse (Approximately 15 investigational compounds annually)

c. Dravet syndrome model, mouse (Approximately 15 investigational compounds

STATEMENT OF WORK 5

annually)

a. Subcutaneous and intravenous pentylenetetrazol seizure model, mouse and rat (Approximately 10 investigational compounds in mice and 2 in rats annually)

7. Identify, develop, validate and implement new models as directed by the NINDS Contracting Officer’s Representative (COR).

Please reference the NINDS Public Access to Neuroactive & Anticonvulsant Chemical Evaluations (PANAChE) public website (https://panache.ninds.nih.gov) for a detailed description of the test protocols.

B. PERFORMANCE AREA 2 – Models of Disease Prevention and Modification

Objective:

Implement models to identify investigational compounds that prevent the development of epilepsy or are disease modifying. The models listed below at minimum are required for the disease prevention and modification workflow. The estimates of the numbers of tests required for each model are approximate numbers and provided for use when estimating the cost proposal only.

Technical Requirements:

1. Implement a test protocol in a post-kainic acid status epilepticus-induced chronically epileptic rat that can be used to identify investigational compounds with disease prevention and/or disease modifying effects in epilepsy. Development of spontaneous recurrent seizures measured by video EEG shall be the primary endpoint (Approximately 6 investigational compounds annually).

2. Implement a test protocol in a mouse model of mesial temporal lobe epilepsy (mTLE) induced by focal (amygdala and/or hippocampus) kainic acid injection to identify investigational compounds with disease prevention and/or disease modifying effects in epilepsy.

Development of spontaneous recurrent seizures measured by video-EEG shall be the primary endpoint (Approximately 10 investigational compounds annually).

Please reference the NINDS Public Access to Neuroactive & Anticonvulsant Chemical Evaluations (PANAChE) public website (https://panache.ninds.nih.gov) for a description of the models mentioned above.

C. PERFORMANCE AREA 3 – PHARMACOKINETIC STUDIES

Objective:

https://panache.ninds.nih.gov/ https://panache.ninds.nih.gov/

STATEMENT OF WORK 6

Implement pharmacokinetic testing to support determination of plasma and brain levels of investigational compounds in rat and mouse. The estimates of the numbers of tests required for each model are approximate numbers and provided for use when estimating the cost proposal only.

Technical Requirements:

1. Implement methods to collect plasma and brain samples from naïve and epileptic rodents (approximately 30 compounds in mouse and 30 compounds in rat studies annually).

2. Develop and implement bioanalytical method and validation protocols to determine pharmacokinetics of reference and investigational compounds in naïve and epileptic rodents (approximately 10 compounds in mouse and 10 compounds in rat studies annually).

D. ANCILLARY STUDIES

The Government may require, depending on the evolving needs of the ETSP, studies and models including but not limited to the following:

a. Models and assays associated with recognized co-morbidities of epilepsy

b. Supporting ADME studies including formulation screening

E. OPTIONAL TASKS

The Government may require, based on the evolving needs of the ETSP and in consultation with the ECB, additional capabilities for disease prevention and modification studies. During each Option Period (1-4), the contract includes 10 quantity options that, if exercised, will be funded on a cost reimbursement, level-of-effort basis. Each of these quantity options is based on anticipated level of effort required for testing one compound, based on current assumptions.

In advance of the NINDS’ exercise of a Quantity Option for Optional Tasks services, the Contractor shall provide a specific technical proposal and updated budget, if applicable, to implement or subcontract the specific expanded capabilities as directed by the COR. Additional capabilities including but not limited to rodent models of post-traumatic epilepsy may be implemented for investigation of new treatments for disease prevention and modification.

a. The Contractor shall develop technical proposals, budget and subcontracting plan and/or model development and implementation plan with timelines as directed by the COR.

Additionally, the contractor shall provide a plan for communication with a potential subcontractor. If an updated budget is submitted for consideration by the Government, it shall illustrate any potential differences from assumptions in its final proposal revision to the specific needs, as defined by the NINDS COR at the time of the request to exercise an

STATEMENT OF WORK 7

option. The Government may consider revision of the level-of-effort in each quantity option provided all options remain within the total contract ceiling.

b. The subcontractor, subcontracting plan and/or model development plan, budget and timelines must be approved by the Contracting Officer.

F. TRANSFER OUT-PLAN

The Contractor shall provide a detailed plan for the transfer of all electronic data, laboratory notebooks, ETSP participant compounds and reagents, genetic model(s), other biological material, and all laboratory equipment and computers purchased by the ETSP contract to a successor Contractor and/or storage facility. The detailed plan shall address transition, resource protection and retention, wind down of testing in progress, data transfer and reporting. The total estimated number of ETSP compounds involved in this requirement is approximately 2,500. An updated version of this plan shall be provided upon request to the NINDS COR

G. TRANSITION OUT (OPTION ITEM)

In the event that the NINDS ETSP must be moved from the Contractor’s facility, such as if a new successor contractor is awarded a follow-on contract (“Successor Contractor”) or if NINDS decides to end or pause the program, the Contractor shall provide Transition-out services.

For Transition-out, the Contractor shall be responsible for: 1) Preparing for transfer of all the biospecimens in its possession; 2) Providing all data, experimental protocols, and an electronic inventory by individual tube of all of the biospecimens in a common digital format to the COR and Successor Contractor; and 3) Bringing any Successor Contractor up to par on the current system.

Upon written notice from the CO, the Contractor shall transfer all electronic databases, data management systems, and files as directed by the COR. All data shall be the property of the Government and shall be replicated and disseminated in a transferable format such that any Successor Contractor and NINDS customers may use the data after transfer.

These Transition-out services are nonseverable, completion form.

II. ADDITIONAL REQUIREMENTS

A. Animal Facility - shall be accredited by or registered as follows:

1. The Contractor and any subcontractor shall be fully accredited by the Association for Assessment and Accreditation of Laboratory Animal Care (AAALAC) International or equivalent and maintain that accreditation for the life of the contract. Information about AAALAC accreditation is available at www.aaalac.org.

http://www.aaalac.org/

STATEMENT OF WORK 8

2. The Contractor shall have an approved Animal Welfare Assurance for the Office of Extramural Research (OER), Office of Laboratory Animal Welfare (OLAW) (http://grants.nih.gov/grants/olaw/olaw.htm), Office of the Director, NIH, as required by Section I-43-30 of the Public Health Service Policy on Humane Care and Use of Laboratory Animals. The Contractor shall maintain such assurance for the duration of this contract, and any subcontractors performing work under this contract involving the use of animals shall also obtain and maintain an approved Animal Welfare Assurance.

3. The Contractor and any subcontractor shall comply with the Public Health Service (PHS) Policy on Humane Care and Use of Laboratory Animals (http://grants.nih.gov/grants/olaw/references/phspol.htm) and conduct work in compliance with recommendations established in the Guide for the Care and Use of Laboratory Animals (http://www.nap.edu/openbook.php?record_id=5140).

4. The Contractor’s Institutional Animal Care and Use Committee (IACUC) shall approve all animal procedures under this contract.

B. Animal Requirements:

The Contractor shall comply with the HHSAR clause 352.270(5)(b), Care of Live Vertebrate Animals (DEC 2015). All available animal assurances and related laboratory inspections will be provided to the COR on an annual basis throughout the period of the contract and such assurances must also be assessable when required. Any violations of protocol resulting in issues, warnings or the need for corrective measures will be reported immediately in writing to both the COR and Contracting Officer. All relevant explanations related to the nature of the violation as well as planned remedy or actions need to accompany the report.

1. Animal Sources and Strains:

Carworth Farms (CF-1) and C57BL/6 male mice and Sprague-Dawley male rats from Charles River shall routinely be used throughout this contract. Testing in female animals will also be required on specified investigational compounds as directed by the NINDS COR. The supplier of these rodents shall not be changed unless directed or approved by the COR and will require adequately validated studies of comparability among strains and/or sources of supply. In addition, such animals that may be required to establish future genetic models of epilepsy will be employed as directed by the COR.

2. Animal housing:

No insecticides, such as chlorinated hydrocarbons or methylenedioxphenyl compounds shall be used in animal facilities because of their effects on hepatic drug metabolism enzymes. Bedding for animal cages shall not contain any substances that alter the animal's microsomal enzymes or that produce other adverse effects.

3. Data Integrity and Controls:

The Contractor shall establish controls to ensure consistency of the data; e.g., each shipment of http://grants.nih.gov/grants/olaw/olaw.htm http://grants.nih.gov/grants/olaw/references/phspol.htm http://www.nap.edu/openbook.php?record_id=5140

STATEMENT OF WORK 9

rodents shall be tested for their sensitivity to electrical and chemical induced seizures or as directed by the COR. Source of animal supplies will not be changed without advanced permission of the COR and validation of appropriate drug standards.

C. Rigor:

Contractor shall refer to NIH Rigor and Reproducibility webpage (www.nih.gov/research-training/rigor-reproducibility) for guidance on implementing enhanced rigor in study designs and data reporting as appropriate or as directed by the NINDS COR.

D. The Supply and Purity of the Investigational Compounds:

1. The adequate supply and identity and purity verification of the candidate compounds shall be the responsibility of the NINDS COR, and the participant sources of test submissions. The COR shall supply the Contractor with information on storage, stability, solubility, and formulation of investigational compounds when it is available from owners (ETSP Participants). In addition, any available toxicological data concerning handling of investigational compounds shall be made available to the Contractor.

2. The Contractor shall be required to determine the melting point of candidate compounds and report any discrepancy between batches to ensure continuity of different batches of candidate compounds. Noted discrepancies will be reported to the COR who will attempt to find resolution.

3. Scheduled I-V compounds will be submitted for evaluation by the ETSP. The Contractor must be licensed by the Drug Enforcement Administration (DEA) to receive and handle scheduled II-V compounds and any schedule I compounds specified by the NINDS COR.

4. Compounds will usually be submitted to the Contractor blinded for testing to maintain rigor and protect intellectual property rights of the ETSP participant. For DEA scheduled compounds that cannot be shipped blinded it will be the Contractor’s responsibility to establish a procedure for blinding the technical staff that will conduct testing.

5. Contractor shall be responsible for proper storage of investigational compounds as directed by the NINDS COR. Most compounds shall be stored at room temperature and 4°C but some will require -20°C, -80°C and/or in a desiccator. Approximately 2500 compounds (typically 5-500 mg quantities with some ranging up to 10,000 mg) will need to be stored.

6. Contractor shall be responsible to return remaining investigational compounds to compound handling lab as requested by NINDS COR.

7. Contractor will facilitate elemental analysis of investigational compounds as per NINDS COR request.

8. Contractor shall dispose compounds in an approved manner based on industry standards when directed by the NINDS COR. At the end of the performance period of the contract the Contractor shall transfer any stored investigational compounds to a location designated by the http://www.nih.gov/research-training/rigor-reproducibility http://www.nih.gov/research-training/rigor-reproducibility

STATEMENT OF WORK 10

NINDS COR.

E. Data Security, Storage, Access and Transfer to NINDS

1. Access to all chemical entities, data or other materials provided by the Government as well as all reports, summaries, data descriptions, generated tables and/or testing results derived in performance of this contract shall be restricted pursuant to the terms of FAR clause 52.227-17 Rights in Data-Special Works, paragraph (d). The Contractor is not allowed any internal use or through outside contract to study, manipulate, copy, remove, publish and/or release any information on any data provided by the Government and/or generated under this contract without the prior written approval of the NINDS Contracting Officer and the COR. Further, any such approvals must be submitted in writing by the COR to the Contractor and Contracting Officer. When the data are not at the contract site, e.g., when data are being securely transmitted, mailed or delivered to NIH, the Contractor must ensure that the data are covered with the statement, "Privileged Communication of Data -- Property of the U.S.

Government" and take appropriate measures to assure safe transmission. The contract number and title shall also be included on such transmissions. Any unexpected or notable observation discovered during evaluation of investigational compounds or resultant from reviews or other summary data collected must be immediately reported to the COR. All such information and conclusions drawn are deliverables and therefore the sole property of the U.S.

Government.

2. Contractor shall obtain the test requests to be performed from the designated quarantined part of the NINDS ETSP Anti-epileptic Drug Development System (ADDS) II database.

Contractor has to login to the secured online 508 complaint NINDS ETSP Lab web-application with the updated browser and all current test request would be available in the pending order list. All lab data generated shall be input into the FISMA-compliant secured online 508 complaint NINDS ETSP Lab web-application. Test results submitted by technician will undergo various steps of the quality control process with in the NINDS ETSP Lab web-application. Once test results are approved in secured online NINDS ETSP Lab web-application, test results would be available for the NINDS ETSP team for review and approve.

NINDS ETSP Lab web application is hosted on the NINDS Information Resources Management Branch (IRMB) Servers and all test results data are secured in ADDSII database with in the NINDS IRMB Servers. When the contractor’s laboratory technicians perform animal testing and other assays the technician first records and documents study data in a laboratory notebook that is stored securely by the contract site. The study data is then transferred and stored on the NINDS IRMB data servers. The laboratory notebook remains securely stored at the contract site unless transfer to another physical location is requested by the NINDS COR. Contractor shall have access to current and historical test results by accessing the secured online NINDS ETSP Lab web-application.

a. Specific IT Compatibility Requirements:

i. Contractor shall provide the Windows 10 or later workstation computers with the most current FISMA-compliant antivirus software. Contractor computer should have the latest updated Google Chrome browser installed to access secured online

STATEMENT OF WORK 11

NINDS ETSP Lab web-application to view the Orders / Tests and enter results for the Test.

ii. IT Security, networking, workstations and support shall all be provided by the Contractor IT staff and must be in compliance with FISMA requirements as determined by the NINDS Information Systems Security Officer (ISSO). Only secured online NINDS ETSP Lab web-application for viewing and updating test results will be used by the Contractor. Software development and support will be provided by NINDS ETSP IT Staff to the Contactor.

iii. No ETSP software or database will be deployed or installed on the contractor location / computer.

3. The Contractor shall store all raw laboratory data (i.e. laboratory notebooks, data storage media, etc.) for the performance period of the contract. At the end of the performance period of the contract the Contractor shall transfer program data to a location designated by the

NINDS COR.

H. Special Requirements:

The Contractor shall communicate frequently with the NINDS COR by letter, email, telephone and/or facsimile on the progress of the contract's experiments and schedule. NINDS staff will make site visits at least twice a year for inspection and long-term planning. The Principal Investigator shall travel to NINDS as needed, anticipate one time per year for discussion of progress and planning.

III. DELIVERABLES

TECHNICAL DELIVERABLES

A. All reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Helpful Resources."

B. Transfer of Test Data – The Contractor shall input test results into secured online 508 complaint NINDS ETSP Lab web application. Authorized ETSP personnel will have immediate access to data as it is generated. All reports required herein shall be submitted by an approved electronic method.

C. Quarterly Progress Reports – Quarterly Progress Reports for all testing summaries will be provided in an approved electronic format to the COR. Quarterly Reports shall be comprised of:

1) a summary of all testing performed in the performance period; 2) current status of all projects

STATEMENT OF WORK 12

under development (i.e. new model development, pilot studies), problem areas and any performance delays encountered or that may impede future performance; and 3) list of comprehensive summary reports in preparation or completed during the reporting period.

The first reporting period consists of the first full three months of performance including any fractional part of the initial month. Thereafter, the reporting period shall consist of three full calendar months. Reports shall be due on or before the 10th calendar day following each reporting period. The Contractor shall send two copies of the Quarterly Progress Reports, one to the COR and one copy to the Contracting Officer, NINDS.

D. Comprehensive Summary Reports – As directed by the NINDS COR, a comprehensive report (referred to as an ETSP “Red Book”) of all ETSP studies shall be completed within 45 days upon request of the COR. (Approximately ten of these reports will be required on specific investigational compounds or a related group of investigational compounds annually). Other less comprehensive summaries for “pilot studies and special projects” shall have a 30-day completion requirement for each separate candidate selected.

E. Standard tables for comparative assessments for all major models. These will be due within 90 days after contract award in an electronic table format.

F. Standard operating manual describing methods, test preparations, relevant mathematical calculations and formula derivations. This will be due within 90 days after contract award in an electronic table format.

ADMINISTRATIVE AND REGULATORY DELIVERABLES:

A. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth in the ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY Article in SECTION H of this contract. The Section 508 Report Template and Instructions for completing the report are available at:

http://www.hhs.gov/web/508/contracting/technology/vendors.html under "Vendor Information and Documents."

B. Subcontracting Reports

The Contractor shall submit the following Subcontracting reports electronically via the "electronic Subcontracting Reporting System (eSRS) at http://www.esrs.gov .

1. Individual Subcontract Reports (ISR)

Regardless of the effective date of this contract, the Report shall be due on the following dates for the entire life of this contract:

April 30th http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.esrs.gov/

STATEMENT OF WORK 13

October 30th Expiration Date of Contract

2. Summary Subcontract Report (SSR)

Regardless of the effective date of this contract, the Summary Subcontract Report shall be submitted annually on the following date for the entire life of this contract:

October 30th

For both the Individual and Summary Subcontract Reports, the Contracting Officer/Contract Specialist shall be included as a contact for notification purposes at the following e-mail address:

sneha.singh@nih.gov

C. Invention Reporting

In accordance with contract Article C.3. “Invention Reporting Requirement”, an Annual Invention Utilization Report shall be due on or before the anniversary date of the contract award and a Final Invention Statement will be due on or before the expiration date of the contract.

D. Service Contract Annual Report

In accordance with FAR 52.204-14, “Service Contract Reporting Requirements”, contained in full text in Article I.4. of the contract, the Contractor shall report annually by October 31, for services performed under this contract during the preceding Government fiscal year (October 1 – September 30) the following information to http://www.sam.gov, with an electronic copy to the Contracting Officer:

(1) Contract number and, as applicable, order number.

(2) The total dollar amount invoiced for services performed during the previous Government fiscal year under the contract.

(3) The number of Contractor direct labor hours expended on the services performed during the previous Government fiscal year.

(4) Data reported by subcontractors [if applicable] under paragraph (f) of the subject clause (see full text of clause FAR 52.204-14, “Service Contract Reporting Requirements” in Article I.4. of the contract).

INFORMATION AND PHYSICAL ACCESS SECURITY DELIVERABLES:

The Contractor shall comply with all current NIH requirements for satisfying the Federal Information Security Management Act (FISMA). The Federal Information Security Management Act (FISMA) is mailto:sneha.singh@nih.gov http://www.sam.gov/

STATEMENT OF WORK 14

United States legislation that defines a framework of guidelines and security standards to protect Government information and operations. This risk management framework was signed into law as part of the Electronic Government Act of 2002, and later updated and amended.

Current NIH FISMA requirements include, but are not limited to, the following deliverables:

Assessment & Authorization (A&A)

FIPS 199 Security Categorization Privacy Impact Assessment (PIA) E-Authentication Risk Assessment (ERA) System Security Plan (SSP) Security Assessment Plan (SAP) Security Control Assessment (SCA) Security Assessment Report (SAR) Configuration Management Plan (CMP) Contingency Plan (CP) Contingency Plan Test (CPT) Business Impact Analysis (BIA) Incident Response Plan (IRP) Incident Response Plan Test (IRPT) Memorandum of Understanding (MOU), when applicable Interconnection Security Agreement (ISA), when applicable Plan of Action and Milestones (POA&M) Authorization to Operate

(ATO)

Continuous Monitoring (CM) NIH Information Security Awareness & Privacy Training Monthly Vulnerability Scans Review and Update of all A&A Deliverables Listed Above Annual Assessment Policies and Procedures User Recertification Review Documents Separation of Duties Matrix Information Security Awareness and Training Records System(s) Baseline Configuration Standard Document System Configuration Settings Results of Review of Physical Access Records Penetration Test Report

The Contractor shall furthermore understand and acknowledge that NIH FISMA requirements evolve over time. The Contractor shall be responsible for obtaining the latest NIH FISMA requirements as coordinated with the Contracting Officer and ISSO throughout the duration of the contract period of performance. The Contractor shall also understand and acknowledge that NIH compliant Authorizations to Operate (ATO) is required by NIH and DHHS to satisfy the FISMA law.

STATEMENT OF WORK 15

At present, the Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract. Note: Each report listed below includes a reference to the appropriate subparagraph of this article.

A. Roster of Employees Requiring Suitability Investigations

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access, or host and/or maintain a Federal information system(s). The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract. (Reference subparagraph A.e. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

B. IT Security Plan (IT-SP)

In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the contractor shall submit the IT-SP within thirty (30) days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

The Contractor shall review and update the IT-SP in accordance with NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, on an annual basis.

(Reference subparagraph D.c.1. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

C. IT Risk Assessment (IT-RA)

In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the contractor shall submit the IT-RA within thirty (30) days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS- OCIO Information Systems Security and Privacy Policy.

The Contractor shall update the IT-RA on an annual basis.

STATEMENT OF WORK 16

(Reference subparagraph D.c.2. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

D. FIPS 199 Assessment

In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the Contractor shall submit a FIPS 199 Assessment within thirty (30) days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard.

(Reference subparagraph D.c.3. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECITON H of this contract.

E. IT Security Certification and Accreditation (IT-SC&A)

In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed within three (3) months after contract award.

The Contractor shall perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid.

(Reference subparagraph D.c.4. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

F. Reporting of New and Departing Employees

The Contractor shall notify the COR and Contracting Officer within five working days of staffing changes for positions that require suitability determinations as follows:

1. New Employees who have or will have access to HHS Information systems or data:

Provide the name, position title, e-mail address, and phone number of the new employee.

Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

2. Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in the "Employee Separation Checklist", attached in Section J, ATTACHMENTS of this contract, when a Contractor/Subcontractor employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

(Reference subparagraph E.2.a-c. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

STATEMENT OF WORK 17

I. Contractor - Employee Non-Disclosure Agreement(s)

The contractor shall complete and submit a signed and witnessed "Commitment to Protect Non-Public Information - Contractor Agreement" form for each contractor and subcontractor employee who may have access to non-public Department information under this contract. This form is located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclos ure.pdf .

(Reference subparagraph E.3.d. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

J. Vulnerability Scanning Reports

The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the Technical Progress Report.

Otherwise, this report shall be submitted under separate cover on a monthly basis.

(Reference subparagraph E.5. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf