75N95023R00017 Amendment 00001_Signed.pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

00001

The purpose of this amendment is to provide answers to questions received regarding the RFP. See pages 2-3 of this amendment.

The proposal due date of April 14, 2023, 4:00pm local time, is unchanged.

Note: Offerors should acknowledge receipt of this amendment via email reply to sarah.adan@nih.gov or include acknowledgment of receipt in their response to the RFP.

National Institutes of Health National Institute on Drug Abuse Bethesda, MD 20892-7511

TO ALL POTENTIAL OFFERORS

75N95023R00017

1 3

04/04/2023

03/14/2023

RFP 75N95023R00017: Answers to Questions

Q1: “Article H.11.1, section A, section b, section v specifies that the contractor must “Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.” Could a link to those applicable security and privacy policies be provided?”

A1: We use the NIST risk management framework and its associated standards as the basis for our policy.

Q2: “Article H.11.1, section A, section c specifies that the contract must “Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.” However Article H.1 specifies that ” It is hereby understood and agreed that research involving human subjects shall not be conducted under this contract, and that no material developed, modified, or delivered by or to the Government under this contract, or any subsequent modification of such material, will be used by the Contractor or made available by the Contractor for use by anyone other than the Government, for experimental or therapeutic use involving humans without the prior written approval of the Contracting Officer.”. As the Privacy Act of 1974 regulates the collection, maintenance, use, and dissemination of records about individuals that are retrieved by a personal identifier, does that apply to non-human primates? If not, are the sections of Article H.11.1, sections c & d applicable?”

A2: The Privacy Act does not apply to this solicitation. Therefore, Article H.11.1, Sections C & D are not applicable.

Q3: “Article H.11.1, section A, section j, section i specifies that the contractor must “Comply with the HHS Standard for Encryption of Computing Devices and Information”. That standard does not appear to be publicly available. Could a copy be provided?”

A3: The HHS Policy for Encryption of Computing Devices and Information is to establish comprehensive encryption requirements for HHS systems and information that are compliant with the Federal Information Security Modernization Act of 2014 (FISMA), National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Executive Order 14028. - The FISMA document is PUBL283.PS (congress.gov) - The NIST publication is SP 800-53 Rev. 5, Security and Privacy Controls for Info Systems and Organizations | CSRC (nist.gov)

Q4: “Article H.11.1, section A, section j, section ii specifies that the contractor must “Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 days of the validation.” The list of validated solutions includes cryptographic capabilities of software (e.g. Ubuntu, MacOS, Windows) as well as hardware (TPM chips, Google Titan chips etc.) but does not include database applications or platforms for storing and retrieving sample data. That validation does include hardware platforms including Apple Inc. computers running specific operating system versions. Is using such a validated computer to update the sample data sufficient, https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final or is it necessary to evaluate the underlying hardware running the database platform to confirm that each part is validated? Are there any suggested database solutions that meet all of the requirements?”

A4: The same cryptographic standards for data at rest apply equally for databases containing sensitive or proprietary (non-public) information. Prospective offerors should propose their recommended solution.

Q5: “Article H.11.1, section A, section j, section v specifies that the contract must “Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.” Is that intended to mean that the entire sample database platform needs to be decryptable and accessible with a key recovery mechanism?”

A5: Yes, if encryption is applicable, almost any encrypted solution will require the ability to decrypt data for use and that requires encryption keys. If those keys are lost, key recovery is needed to access the data or the data is lost.

Q6: “Article H.11.1 section A, section 4 (incident response), section b, section i specifies that the contractor must “Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.” As no personal identifying information (PII) is being created, stored or transmitted, is that section applicable to non-human primates?”

A6: While the primary research data is not human in nature, PII can include contact information for anyone accessing the system or anyone the system may need to store that information for. If that information is captured, stored, or transmitted as part of the use of the system, then it applies. For this contract, no contact information for anyone accessing the system will be captured.

Q7: “Article H.11.1 section A, section 4 (incident response), section b, spection [sic] ii specifies that the contractor must “NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative..” As this solicitation involves non-human primates, is the requirement to NOT notify them applicable to this solicitation?”

A7: No, this requirement does not apply.

http://csrc.nist.gov/publications/