D-CSS_75N95024Q00012_2.7.24(update offer due date).pdf

COMBINED SYNOPSIS / SOLICITATION

COMPETITIVE

Title: Medicinal Chemistry Consultant Support Services

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested at this time and an additional written solicitation will NOT be issued. This acquisition is being conducted in accordance with the procedures of FAR Part 13Simplified Acquisition Procedures and FAR Part 12Acquisition of Commercial Items.

(ii) The solicitation number is 75N95024Q00012 and the solicitation is issued as a request for quotation (RFQ).

This acquisition is for a commercial item or service and is conducted under the authority of the Federal Acquisition Regulation (FAR) Part 13—Simplified Acquisition Procedures; FAR Subpart 13.5— Simplified Procedures for Certain Commercial Items; and FAR Part 12—Acquisition of Commercial Items, and is expected to exceed the simplified acquisition threshold.

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 202306, dated December 4, 2023. The resultant contract will include all applicable clauses in effect through this date.

(iv) The intended procurement is classified under NAICS code 541690 Other Scientific and Technical Consulting Services with a Size Standard of $19 Million.

This requirement shall be 100% set aside for small businesses.

(v) The National Institutes of Health (NIH) is the nation's leading medical research agency and the primary Federal agency whose mission is to seek fundamental knowledge about the nature and behavior of living systems and the application of that knowledge to enhance health, lengthen life, and reduce illness and disability, conducting, supporting and making medical discoveries that improve people's health and save lives.

The NIH Blueprint for Neuroscience Research, a consortium of 8 NIH Institutes and Centers that support neuroscience research, established the Blueprint Neurotherapeutics Network (BPN) as a pipeline between the typical endpoint of NIH funded research and the beginning of industry drug development. The BPN provides neuroscience researchers with funding and access to a full range of industrystyle drug development services and expertise. The program is intended for projects requiring medicinal chemistry optimization and contract research organization (CRO) support through Phase I clinical testing. Each project is directed by a Lead Development Team (LDT) composed of the principal investigator (PI), industry consultants hired by NIH, and NIH staff. This team maps out a research strategy, including milestones, and oversees implementation by CROs. Bioactivity and efficacy studies are funded through an award to the PI; other research services are provided without cost to the PI through NIH contracts.

(vi) Purpose and Objectives: The purpose of this requirement is to procure executive (senior scientific)level, industryexperienced drug discovery and development consultants with expertise in Medicinal Chemistry to provide technical guidance to the following programs:

• Medicinal Chemistry consulting to procure consultant services to provide technical recommendations to the NIH Blueprint Neurotherapeutics Network drug discovery and development programs in the area of Medicinal Chemistry.

• Other NIH neurosciencefocused drug discovery and development programs

Project Requirements: Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government as needed to perform the requirements herein.

The Contractor shall provide this support while serving on NIH BPN Lead Development Teams. Lead Development Teams (LDT) meet for approximately two hours every one to two weeks via teleconference and each LDT project may require between three and ten hours weekly, inclusive of meeting and preparation time.

The Contractor is expected to provide support services in a collaborative way. Lead Development Teams the Contractor is assigned to may work on a number of projects in the exploratory through preclinical safety stages. Some projects may proceed to investigational new drug (IND) and clinical trial stages.

The Contractor shall provide consulting support services to the NIH Blueprint Neurotherapeutics Network in the area of Medicinal Chemistry.

Medicinal chemistry consultants will be expected to provide seniorlevel medicinal chemistry expertise and contribute feedback and guidance on projects to the NIH and to LDT members through conference calls and by email.

The role of the medicinal chemistry consultant may include but is not limited to the following responsibilities and tasks:

1. Offer input on project milestones, target product profiles, and testing funnels

2. Provide feedback on chemical structures and processes proposed by a chemistry service contractor for each round of SAR

3. Evaluate SAR data on a weekly or biweekly basis.

4. Medicinal chemistry consultants may be asked to evaluate the potential tractability (including surrounding IP space) of a chemical structure for medicinal chemistry. Specific consulting responsibilities will depend on the expertise of the individual consultant and the needs of individual projects.

5. In partnership with other consultants, contractors, and the NIH staff, advise, strategically plan, and manage medicinal chemistry programs to facilitate exploratory chemistry, hittolead, lead optimization, IND enabling, and clinical studies.

6. Serve as the medicinal chemistry expert in order to identify potential drug discovery and development challenges and suggest strategies to address these challenges.

7. Collaborate on design of investigative studies in support of NIH drug discovery and development projects.

8. Review Medicinal Chemistry sections of regulatory filings provided by CROs [Contract Research Organizations] or PIs [Principal Investigators], collaborate on the design of investigative studies in support of development compounds.

9. Accompany NIH staff or visit, at NIH program staff request, Contract Research Organizations [CRO] under contract to the NIH (e.g., NIH Blueprint Neurotherapeutics Network (BPN) or the NIH Helping to End Addiction Long Term (HEAL)). Assist NIH staff in inspecting facilities and discuss appropriateness of CRO proposed methodology. Submit trip reports to BPN and HEAL program staff.

10. Facilitate Lead Development Team discussions via telephone and email regarding assigned medicinal chemistry efforts.

Contract Deliverables:

a. Monthly Report - The Contractor shall provide the COR and CO with a Monthly Report to include details of work completed during the month. The format for reports shall be provided after the contract award.

b. Contractor Non-Disclosure Agreement (NDA) Each Contractor (and/or any subcontractor) employee having access to nonpublic government information under this contract shall complete the NIH nondisclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

c. Vulnerability Scanning Reports The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the Technical Progress Report. Otherwise, this report shall be submitted under separate cover on a monthly basis.

d. Service Contract Reporting Per FAR Clause 52.20414 Contractors shall submit via SAM an annual report on October 31st encompassing the previous year from 1 October through 30 September.

Level of Effort: The estimated level of effort for this requirement is one (1) contractor employee on a parttime basis.

The required level of effort varies depending on the quantity and complexity of BPN projects at any given time. It is anticipated that a minimum of 20 hours of support is required annually. A Not to Exceed (NTE) amount of 800 Optional Hours shall be exercised if needed, using FAR Clause 52.2177 Option for Increased Quantity Separately Priced Line Item.

Government Furnished Information/Property: No Government furnished property shall be provided. Project related data will be provided to the Contractor for performance of work efforts. All data provided to the Contractor must be treated as confidential and not be disclosed to any third party.

Project data will be collected and stored by NINDS. NINDS will provide data as needed to the consultant each time it requests service. The consultant may store data up to 12 months after initially receiving it, after that time the consultant should either delete the data files and sanitize the computer using NIST SP 80088 (current revision) or if information is still needed contact the COR for permission to store data longer.

Key Personnel: The Contractor employee providing services for this effort shall be considered Key personnel. Key Personnel requirements are as follows:

General requirements

1. Consultants must have extensive experience in managing drug discovery and early development (e.g., Phase 1 clinical) medicinal chemistry efforts as evidenced by employment as an executive (senior scientific)leader in the biopharmaceutical industry or as an experienced consultant providing the same services. Experience with drug discovery for nervous system conditions is preferred.

2. Consultants must have experience with antibody conjugates, chemistry, peptides, siRNA synthesis is a plus.

3. Consultants must be able to work in a crossfunctional team environment and manage competing priorities.

4. Consultants must have strong interpersonal skills, an attention to detail, excellent organizational, writing, communication, presentation, and documentation skills as well as computer and software literacy.

5. Consultants must demonstrate the ability to educate and build trust with LDT members of many disciplines to build consensus and maintain the focus of the team on milestone achievement.

6. Consultants must have experience working with multidisciplinary teams at a senior level in the biopharmaceutical industry, especially teams with members from outside organizations and members at various management levels.

7. Must participate actively in LDT discussions.

Education and work experience requirements

1. A PhD degree in chemistry or medicinal chemistry is required.

2. Minimum of 15 years of medicinal chemistry experience

3. Experience in executing and managing drug development tasks, preferably with experience in developing drugs for nervous system conditions preferred but not required.

4. A track record of advancing projects into drug development. Measures of success include patents, Investigational New Drug (IND) applications, publications, and drugs brought to market.

5. Previous experiences in identifying and anticipating problems early in a project, overcoming technical difficulties, and making strategic decisions that make wise use of limited resources (including terminating projects that appear unlikely to succeed) will be considered as signs of a strong track record in drug development.

6. Expertise leading chemistry efforts performed by contract research organizations and managing drug project portfolios.

7. Experience in therapeutics for CNS and pain relief will be considered a plus.

The proposed Key Personnel will become subject to the provisions of Health and Human Services Acquisition Regulation (HHSAR) Clause HHSAR 352.23775 Key Personnel as follows:

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

Travel (Option Item): The consultant may be required to travel within the contiguous United States to provide the services described herein. Travel reimbursement will be provided for such required travel.

All travel arrangements must be made in accordance with Federal Travel Regulations and must be approved by the Contracting Officer and authorized by the Contracting Officer’s Representative prior to being finalized or invoiced. Contracting Officer approved and Contracting Officer’s Representative authorized travel shall not exceed $1,500.00 annually.

Approximately 8 hours of travel time are anticipated for this requirement.

Information Systems Security: The Contractor must ensure that any computer system used in the course of this contract shall include the following features:

1. Any computer used in relation to this contract must be patched with the most updated IT Security Patches.

2. Any Contractor computer used in relation this contract must have virus protection loaded and running with definition files that are updated on at least a daily basis.

3. Hard drives and portable media used for this contract must be encrypted using the FIPS 1402 standard.

4. Contractors are required to take NIH Security and Privacy Training annually http://irtsectraining.nih.gov/

5. Contractor is required to sign the NIH nondisclosure agreement http://irtsectraining.nih.gov/NIH_NonDisclosure_Agreement.pdf

6. Contractors are required to report any lost or stolen NIH data to the NINDS ISSO within one hour of knowing of the lost or theft even if the data is on a Contractor furnished computer.

7. Contractors are required to adhere to the NIH IT rules of behavior which can be found at https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx

8. Any computers used in reference to this contract must be assessed for vulnerabilities.

9. Any computers used in reference to this contract must be backed up on an external hard drive which is password protected.

10. Any computers used in reference to this contract must have auditing enabled such that if an incident occurred then that event could be reconstructed.

11. Any computers that are used in reference to this contract must employ at a minimum username and password authentication or if possible two factor authentication.

12. Any computer used in relation to this contract must be password protected. All Password must meet the NIH standard such that users must choose passwords that have at least eight characters and at least three of the following types of characters:

a. capital letters

b. lower case letters

c. numeric characters

d. special characters (!@#$%^&*()_+|~=\`{}[]:";'<>?,./)

Data Rights: The National Institute of Neurological Disorders and Stroke shall have unlimited rights to and ownership of all deliverables provided under this procurement including reports, analyses, recommendations and all other deliverables. In addition, it includes any additional deliverables required by contract change. The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.” FAR clause 52.22714, “Rights in DataGeneral,” shall be incorporated into any resulting award by reference.

Intellectual property: Consultants who contribute to the creation of new intellectual property will be named as inventors according to US or prevailing patent law.

Accordingly, consultants must complete negotiations with the principal investigator’s institution regarding assignment of rights and royalties distribution prior to advising on any activities. The consultant shall provide copies of all intellectual property agreements to the NIH COR, for documentation purposes.

Section 508 Compliance: Section 508 of the Rehabilitation Act of 1973 requires that Federal agencies’ electronic and information technology (EIT) is accessible to people with disabilities. The Federal Acquisition Regulations (FAR) Final Rule for Section 508 (EIT Accessibility) can be found at www.section508.gov and at the Access Board’s Web site at https://www.accessboard.gov/508.htm. The contractor must state that they will comply with the requirements of Section 508 or cite a justifiable reason for an exception.

Non-Personal Service Statement: Contract employee performing services will be controlled, directed and supervised at all times by management personnel of the contractor. Actions of contractor employees may not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated funds of the U.S. Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition Regulations (FAR).

Collaboration Requirements: It is required that all contractors involved with the NIH community work collaboratively with federal staff and other contractors towards the NIH mission and other affected organizations and follow the direction of the Contracting Officer’s Representative (COR), and/or the designated Federal Project Manager(s)/Lead(s). This collaboration includes daytoday activities, support, development, knowledge transfer and creating and sharing documentation when required.

Confidentiality of Information: Confidential Information means information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization. Confidential Information or records shall not be disclosed by the Contractor without written authorization from the Contracting Officer.

Whenever the Contractor is uncertain with regard to the confidentiality of or a property interest in information under this contract, the Contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or publication.

Contract Type: A Labor Hour Purchase Order with Options to Extend the Term of the Contract is contemplated, with Options to Extend the Term of the Contract as well as Options to Increase the Quantity is contemplated.

Response Format: Responses to this solicitation must include clear and convincing evidence of the offeror's capability of fulfilling the requirement as it relates to the technical evaluation criteria.

The offeror must submit: 1) a technical response, 2) a separate price quotation using the format in Attachment 6.

The technical response should be prepared in reference to the evaluation criteria identified in this solicitation and may be up to thirty (30) single sided pages.

A. Technical response

Respondents must provide clear and convincing documentation of their capability of providing the services specified in this notice. In addition to a detailed CV, respondents are requested to provide document discussing at a minimum, the following (please see Attachment 7Evaluation Criteria for further guidance):

• Key personnel professional experience in drug discovery and development

• Key personnel education and certification

• Key personnel collaborative team experience

• Employment status of proposed Key Personnel. Indicate whether the proposed Key

Person is either an independent contractor or an employee of the proposed organization. Key Personnel who are W2 employees of organizations other than their own company or the proposing organization are not acceptable.

• Past performance details for at least two (2) references with knowledge of the respondent’s relevant skills and experience in the areas outlined in the herein

Name of organization Brief description of offeror’s responsibilities Point of contact name, title, telephone number and email address.

• The respondent must also provide their DUNS number, organization name, address, point of contact, and size and type of business (e.g., 8(a), HubZone, etc., pursuant to the applicable NAICS code and any other information that may be helpful in developing or finalizing the acquisition requirements.

• Finally, respondents are also encouraged to provide a general overview of the respondent’s opinions about the difficulty and/or feasibility of the potential requirement, and any other information regarding innovative ideas or concepts that may be applicable.

B. Price quotation

The price quotation should be in the format of Attachment 6.

Contractors must provide their Company Name, Dun & Bradstreet Number (DUNS), Taxpayer Identification Number (TIN), Business Size, Physical Address, and Point of Contact Information in their responses. All offerors must have an active registration in the System for Award Management (SAM) www.sam.gov."

(vii) Period of Performance: The estimated required period of performance is a oneyear base period from March 1, 2024 through February 28, 2024 and two (2) subsequent one year option periods.

Place of Performance: The primary place of performance shall be Contractor site.

Conference calls and email shall be the primary mode of communication; however, the Contractor may be required to work at Government facilities or facilities of selected principal investigators on an as needed basis.

(viii) The provision at FAR clause 52.212-1, Instructions to Offerors – Commercial Products and Commercial Services (Sep 2023), applies to this acquisition.

(ix) The provision at FAR clause 52.212-2, Evaluation – Commercial Products and Commercial Services (Nov 2021), applies to this acquisition.

(a) The Government will award a contract resulting from this solicitation to the responsible offerors whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. Technical factors together shall be considered more important than price and all technical evaluation factors are detailed in Attachment 7-Evaluation Criteria.

(b) Options. Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

(x) The Offerors shall include a completed copy of the provision at FAR clause 52.212-3, Offeror Representations and Certifications—Commercial Products and Commercial Services (Nov 2023), with its offer. This requirement may be met by completion of the provision in the System of Award Management and so indicate in their offer.

(xi) FAR clause at 52.212-4, Contract Terms and Conditions – Commercial Products and http://www.sam.gov/

Commercial Services (Nov 2023), with ADDENDUM applies to this acquisition.

KEY PERSONNEL, HHSAR 352.237-75 (December 2015) The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

TBD

OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in the contract, the contract will consist only of the Base Period as defined. Pursuant to FAR Clause 52.217-7, Option for Increased QuantitySeparately Priced Line Item and FAR Clause 52.217-9, Option to Extend the Term of the Contract the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth herein. If the Government exercises any of these options, notice must be given at least 10 days prior to execution of said option, and the price of the contract will be increased as set forth in the OPTION PRICES SECTION of the contract.

52.217-7 Option for Increased Quantity—Separately Priced Line Item (Mar 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within the period of performance of the purchase order. Delivery of added items shall continue at the same rate that like items are called for under the contract unless the parties otherwise agree.

(End of clause)

52.217-9 -- Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within the period of performance of the purchase order; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 10 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed three years.

(End of clause)

52.224-1 Privacy Act Notification (Apr 1984)

The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of1974, Public Law93579, December 31,1974 (5 U.S.C.552a) and applicable agency regulations.

Violation of the Act may involve the imposition of criminal penalties.

52.224-2 Privacy Act (Apr 1984)

(a) The Contractor agrees to

(1) Comply with the Privacy Act of1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

(b) In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function.

For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

(c) (1) "Operation of a system of records," as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(2) "Record," as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(3) "System of records on individuals," as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

(End of clause)

HHSAR 352.22470 Privacy Act.

As prescribed in HHSAR 324.105(a), the Contracting Officer shall insert the following clause:

Privacy Act (DEC 2015)

This contract requires the Contractor to perform one or more of the following: (a) Design;

(b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.

The term system of records means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).

The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in 45 CFR part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records (5 U.S.C. 552a(m)(1)). The contract work statement:

(a) Identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and

(b) Specifies the disposition to be made of such records upon completion of contract performance.

52.242-15 Stop-Work Order (Aug 1989)

(a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stopwork order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stopwork is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either—

(1) Cancel the stopwork order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

(b) If a stopwork order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if—

(1) The stopwork order results in an increase in the time required for, or in the Contractor’s cost properly allocable to, the performance of any part of this contract; and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

(c) If a stopwork order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stopwork order in arriving at the termination settlement.

(d) If a stopwork order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stopwork order.

INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1. Applicability- The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information nonrepudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov .

d. Comply with the Privacy Act requirements.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 80060, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor NonDisclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

mailto:fisma@hhs.gov

Confidentiality: [ ] Low [ X ] Moderate [ ] High Availability: [ ] Low [ X ] Moderate [ ] High

Integrity [ ] Low [ X ] Moderate [ ] High Overall Risk Level: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ X] Yes PII

Applicable SORN number: 09250118

4. Controlled Unclassified Information (CUI)- CUI is defined as "information that laws, regulations, or Governmentwide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, reusing, and disposing of the information." 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a NeedToKnow basis;

c. Protected in accordance with NIST SP 80053, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 80088, Guidelines for Media Sanitization.

5. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M0616, Protection of Sensitive Agency Information by securing it with a FIPS 1402 validated solution.

6. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the

Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to nonpublic Department information under this acquisition shall complete the "Commitment to Protect NonPublic Information Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf . A copy of each signed and witnessed NonDisclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

7. Internet Protocol Version 6 (IPv6)- All procurements using Internet Protocol shall comply with OMB Memorandum M0522, Transition Planning for Internet Protocol Version 6 (IPv6).

8. Government Websites- All new and existing publicfacing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internalfacing websites, the HTTPS is not required, but it is highly recommended.

9. Contract Documentation- The Contractor shall use provided templates, policies, forms and other agency documents provided by the Contracting Officer and the Contracting Officer's Representative to comply with contract deliverables as appropriate.

10. Vulnerability Management Use SCAPcompliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NISTspecified SCAP standards for vulnerability identification and management. The contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAPcompliant automated tools and report to the agency at least within 30 days of the contract award.

11. Standard for Encryption- The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 1402 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIHspecific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 1402. The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative within 15 days of the validation.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

12. Contractor Non-Disclosure Agreement (NDA)- Each Contractor (and/or any subcontractor) employee having access to nonpublic government information under this contract shall complete the NIH nondisclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)- The Contractor shall assist the NIH Office of the Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed. The NIH PIA guide is located at https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.

pdf .

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M03 22, Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002.

b. The Contractor shall assist the NIH Office of the SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. TRAINING

1. Mandatory Training for All Contractor Staff- All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2. Role-based Training- All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete rolebased training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS RoleBased Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Rolebased Training https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.a spx

3. Training Records- The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy.

A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. RULES OF BEHAVIOR

1. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and comply with the NIH Information Technology General Rules of Behavior https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx , which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov

2. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed Rules of Behavior must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. INCIDENT…