DRAFT_SOURCES_SOUGHT_SOW_(003).docx

STATEMENT OF WORK

Professional Audiovisual Systems Engineering Services For the Audiovisual Program Development Branch, Lister Hill National Center for Biomedical Communications, National Library of Medicine

(02-25-2019)

1.0 TASK ORDER

The professional audiovisual systems engineering services specified in this Statement of Work (SOW) are being acquired from the Simplified Acquisition Procedures in accordance with FAR Part 13.5.

2.0 PURPOSE

The purpose of this requirement is to acquire professional audiovisual systems engineering services to support the work of the Audiovisual Program Development Branch (APDB), of the Lister Hill National Center for Biomedical Communications (LHNCBC), National Library of Medicine (NLM), in the following project activities:

· Provide the required planning, design engineering, development, production, fabrication, installation and testing services of related equipment and installation materials; and

· Provide the required media IT design services, asset management methods, 4K or better display system designs, and production systems engineering to allow full interactive multimedia capability.

3.0 BACKGROUND

The Lister Hill National Center for Biomedical Communications (LHNCBC) is the research and development arm of the National Library of Medicine (NLM). Through the technical capabilities of its Audiovisual Program Development Branch (APDB), current and emerging video communications technologies and multimedia techniques are applied to LHNCBC research, development, and demonstration projects and to the information projects of the NLM.

The National Library of Medicine (NLM) has an established long range goal of encouraging the use of high quality visual information by health professionals and the public. The Lister Hill National Center for Biomedical Communications (LHNCBC), through the Audiovisual Program Development Branch (APDB), has the requirement to perform research and development in the production, distribution, use and evaluation of audio and video materials and systems in support of this NLM goal. Given this mandate, the APDB plans and implements the development of prototype demonstration, instructional and informational projects. APDB also provides technical planning, engineering, and production support for NLM projects utilizing multimedia systems, technology and facilities. As the size and scope of these programs expand, the development of innovative information display and dissemination technologies integrating a wide variety of media becomes critical. Only through the use of current, digital media creation methods and advanced display and distribution systems, can the APDB continue to fulfill its role in meeting the growing demand for awareness and access to relevant biomedical visual information.

The official APDB functional statement is located in the NIH Policy Manual and can be found at: https://oma.od.nih.gov/IC_Functional_Statement/NLM Functional Statements.pdf

4.0 OBJECTIVE

The purpose of this procurement is to obtain, as part of a quick-reaction tasking arrangement, professional audio and video systems planning, design, engineering, installation, integration, and related testing services, including installation materials and equipment, as required, to upgrade multimedia display systems, conference rooms, and production facilities in the NLM. These upgrades are required to continue to provide NLM with proven, state-of-the-art interactive, multimedia production and presentation systems.

The purpose is also to quickly obtain media IT design services, and asset management and multimedia systems expertise required for the final fabrication, installation, and testing of the systems tasked to meet the mandated objectives of the NLM.

5.0 SCOPE OF WORK

In the performance of this contract, the contractor shall:

1) Provide the required planning, design engineering, development, production, fabrication, installation and testing services and related equipment and installation materials required to accomplish specific tasks defined by the designated NLM project officer.

2) Provide the required media IT design services, asset management methods, display system designs, and production systems engineering to allow full interactive multimedia capability of the specified facilities.

6.0 TASKS

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, materials, and equipment modifications necessary to provide total on-site, continuous professional operational and maintenance support of the audio, video, display, collaboration, still and motion imaging, graphics, animation and interactive media systems at the NLM. In coordination with the Contracting Officer’s Representative (COR), work requirements shall be within the following Tasks.

6.1 Sample Task 1 - Develop a Prototype NLM Media Streaming Infrastructure The planned development requested by this task, is required to provide the NLM with a prototype 4K media streaming infrastructure, capable of testing and developing the design requirements for a final operational NLM media streaming infrastructure. The NLM requires a more efficient media content delivery network, both for its internal conferencing facilities and for distribution and display of multimedia content developed by NLM and by its outside content developers. Dramatic improvements have been made recently in the visual quality, efficiency of workflows, network speed and latencies, and quality of experience of live and on-demand streaming networks. Enterprise or organizational training and visual informational material dissemination now dictate that an efficient media streaming infrastructure be in place to handle the growing demand for timely content distribution services. The first phase of this proposed development will be a survey of major technical developments in the field of media streaming networks and systems. The outcome of the initial survey will become a Roadmap specific for the NLM, taking into consideration the current and future operational requirements of NLM, and the state of the streaming technologies. Following the delivery of the NLM streaming Roadmap, a prototype NLM media streaming infrastructure will be proposed. The proposal for this prototype will contain the technical specifications, systems, and the time and cost estimates for the prototype network. After acceptance of the proposal by the Project Officer, the prototype will be implemented, tested, and functionally demonstrated. The technical survey, engineering design, installation, and system testing can only reasonably be expected to be accomplished, within the projected schedule, by the tasking of these required services made available via the purchase order awarded in association with the attached SOW.

A) Schedule: Final acceptance of development by NLM Project Officer by October 31, 2019.

B) Deliverables for Prototype Streaming Infrastructure:

1. Survey documentation of media streaming networks and systems capable of full 4K content. Roadmap of NLM specific media streaming infrastructure and the proposed prototype to effectively demonstrate and test applications for the NLM design requirements. The development, installation, and testing of the prototype media streaming infrastructure.

2. Cables, connectors, systems, and interfaces required for the prototype media streaming infrastructure.

C) Acceptance: The task Project Officer/COR will approve all plans, documents, designs, and drawings, and will approve all completed work.

6.2 Sample Task 2 – Upgrade the Large Demonstration Room Systems

The planned upgrade to the NLM large Demonstration Room, requested by this task, is required to provide the Demonstration Room with complete 4K presentation capability and integrate user interfaces with the control system, media servers, and conferencing network infrastructure, to provide the facility for demonstration of experimental content, visual materials created by outside developers, and all NLM originated material. Since the original Demonstration Room opened, several improvements have been identified and implemented for the operation of the multimedia systems required to accommodate the range of formats and resolutions of the media to be demonstrated. This upgrade will include the integration of several new 4K display systems, a new user interface, a highly interactive collaboration system, an interface to the conferencing network infrastructure, media servers and expanded media storage, and an upgraded control system connected to all of the operational systems and the prototype media streaming infrastructure. For several years, the NLM has been using content developers to design the visual and audio media for the interactive displays and presentation systems located throughout the NLM, as well as for employee presentations at remote teaching and conference locations. This required a facility to demonstrate and test a variety of visual communications materials prior to deployment. The original facility design is no longer able to accommodate the digital media now considered mandatory for the NLM. A facility with the systems upgrades proposed by this task will provide the appropriate demonstration and testing capability for materials developed for the new displays and media standards. The engineering design, installation, programming and system testing can only reasonably be expected to be accomplished, within the projected schedule, by the tasking of these required services made available via the purchase order awarded in association with the attached SOW.

A) Schedule: Final acceptance of upgrade by NLM Project Officer by October 31, 2019.

B) Deliverables for Demonstration Room Integration:

1) Display systems integration capable of full 4K content, and the control system and control software to integrate the collaboration system, the conferencing network, and media servers for user control of media playback in the Demonstration room.

a) Systems, cables, connectors and software modifications required for the new user interface.

C) Acceptance: The task Project Officer/COR will approve all plans, designs, and drawings, and will approve all completed work.

6.3 Sample Task 3 – Upgrade NLM Editing Suite Systems

The planned upgrade to the NLM Editing Suite Systems, requested by this task, is required to provide the Editing Suites with full 4K editing capability and integrate the user interface with the 4K content sources, the control system, and media storage for all of the demonstration and informational NLM originated media materials. Since the Editing Suite opened, multiple major improvements have been identified and implemented for the appearance and operation of the multimedia editing, near line storage, and archival systems. The major part of this upgrade will be the integration of a 4K capable editing and storage system, and the user interfaces to media sources and asset management systems to locate, recover, ingest, and archive the high quality media used in production by the NLM. For several years, the NLM has been involved directly with content developers to design the visual and audio media for interactive displays and presentation systems located throughout the NLM, as well as for employee presentations at remote teaching and conference locations. Due to technology and budget constraints encountered during the original system design, the editing systems, control system and the user interface to content sources and media asset management systems had to be considered an interim limited design. It now must be upgraded to its full intended functionality. The engineering design, installation, programming and system testing can only reasonably be expected to be accomplished, within the required schedule, by the tasking of these required services via the purchase order awarded in association with the attached SOW.

A) Schedule: Final acceptance of upgrade by NLM Project Officer by September 30, 2019.

B) Deliverables for Editing Suite Integration:

1) Editing systems modifications, storage systems, and content sources and media asset management system interfaces capable of using full 4K media. The control system and control software integrated with the production network, and a media server for user control of media playback in the Editing Suite.

a) Cables, connectors and interface modifications required for the new systems.

C) Acceptance: The task Project Officer/COR will approve all plans, designs, and drawings, and approve all completed work.

6.4 Sample Task 4 – Upgrade the NLM Board Room Media Systems and Infrastructure

The planned upgrade to the NLM Board Room, requested by this task, is required to continue to substantially improve the audio, video and display technologies available to support the Board Room meetings and presentations. Several improvements have already been identified for the appearance and operation of the Board Room’s multimedia systems. The major part of this upgrade will be focused on the systems required to improve user interfaces and operator control, and improve reliability through upgraded wiring standards, modern routing and switching systems, a fully functional conferencing network, and a media network infrastructure. For several years, Systems Engineering Support has been involved directly with technical design and installation of the video and audio systems required for the multimedia presentations in the Board Room. Due to limitations of room access time and budget constraints, system upgrades had to be accomplished in phases and some systems considered as interim designs. Many of the systems must now be upgraded to improve reliability and attain the Board Room’s desired functionality, including self-managed operation, remote monitoring, and full up-to-date collaboration. The engineering design, installation, programming and system testing can only reasonably be expected to be accomplished, within the projected schedule, by the tasking of these required services made available via the purchase order awarded in association with the attached SOW.

A) Schedule: Final acceptance of upgrade by NLM Project Officer by September 30, 2019.

B) Deliverables for Board Room Media Systems Integration:

1) Display systems and collaboration system integration, control systems, control software written to integrate the user interface with the multimedia systems, and routing and switching systems for control of media recording and playback in the Board Room. Remote monitoring systems, self-managed room operating interfaces and software, and conferencing network infrastructure.

2) Cables, connectors and network interfaces required for the new functioning user and operator control interface.

C) Acceptance: The task Project Officer/COR will approve all plans, designs, and drawings, and will approve all completed work.

6.5 Sample Task 5 – Upgrade Branch Chief Office, Building 38A, room 10S1004

The planned upgrade requirements to room 10S1004, requested by this task, include design, equipment procurement, installation, and testing a new collaboration system and associated network.

A new installation will provide a technological up-to-date collaborative environment utilizing an anticipated conferencing network within buildings 38 and 38A. The implementation of a conferencing network could become part of an interconnected scheduling system and permit the streaming of high quality/high data rate multimedia information reliably without burdening the normal business network.

The core system shall consist of a large touch screen 4K display of approximately eighty-five diagonal inches, mounted to the wall on a height adjustable mount, in conjunction with a computer platform specifically configured for a genuine collaborative experience.

The collaborative system shall be capable of displaying 4K (UHD) input signals, as well as multiple 1080p (HD) inputs, simultaneously. Touch screen manipulation of connected devices is required for true collaboration. To promote ease of use, wireless connectivity with personally owned equipment is required for this system. This will include a conference style table for six persons, with built in multimedia and network connectivity with AC power are part of the system requirements. An additional connectivity point located at branch chiefs’ desk for presentation of NIH connected office computer on the large screen display.

Additional room requirements:

· a proposed conferencing/collaboration network consisting of multiple single mode fiber paths between the tenth floor office and the NLM media control facility located in building 38A, room B2E20

· A CAT 6 or better cable infrastructure within the room for logical routing of various signals.

· Lighting control for both natural and electrically generated light. Motorized shades (screen and blackout fabrics) installation with remote control capabilities for windows. Room electrical lighting to be dimmable and with remote control capabilities.

· Reception of NLM cable TV for display.

· Both audio and video conferencing for the room system.

· Sound systems appropriate for playback/presentation/conferencing.

· Connectivity locations to include audio and video connectivity, AC power, USB charging, and network connections.

· Remote control functions required to allow system maintenance and monitoring through simplified and productive operations.

A) Schedule: Final acceptance of development by NLM Project Officer by August 31, 2019.

B) Deliverables for Prototype Streaming Infrastructure:

1. One mounted and fully functional large 4K touch screen display in room 10S1004.

2. Installation of motorized shades.

3. Cables, connectors, systems, diagrams, and interfaces required for the prototype media streaming infrastructure.

C) Acceptance: The task Project Officer/COR will approve all plans, documents, designs, and drawings, and will approve all completed work.

6.6 Sample Task 6 – Upgrade and modification of building 38A seventh floor conference room

The planned upgrade requirements to this conference room involves the design, procurement, installation, and testing of a new collaboration system and associated network. This requires room reorientation to reposition the display screen on the West wall.

The core system shall consist of a touch screen 4K display of approximately eighty-five diagonal inches to be mounted on an adjustable motorized wall mount. The display to be used with a modern, feature rich collaborative environment utilizing an anticipated conferencing network within buildings 38 and 38A. The implementation of a specific conferencing network could make an interconnected scheduling system possible and permit the streaming of high quality/high data rate multimedia information reliably, without burdening the normal business network.

The collaborative system shall be capable of displaying 4K (UHD) input signals, as well as multiple 1080p (HD) inputs, simultaneously. Touch screen manipulation of connected devices is required for true collaboration. To promote ease of use, wireless connectivity for personally owned equipment is required for this system.

A conference style table for twelve persons, with built in audio and video connectivity at a minimum of three locations on the table. AC power, USB charging, and network are part of the system connectivity requirements. An additional connectivity point located at the lectern for presentation of NIH connected room computer on the large screen display.

Basic room requirements:

A proposed conferencing/collaboration network consisting of multiple single mode fiber paths between the seventh floor conference room and the NLM media control facility located in building 38A, room B2E20.

· A Category 6 or better cable infrastructure within the room for logical routing of various signals.

· Room lighting to be dimmable and with remote control capabilities.

· Reception of NLM cable TV for display.

· Both audio and video conferencing for the room system.

· Sound systems appropriate for playback/presentation/conferencing.

· Remote control functions are required to allow system maintenance, monitoring, and simplified operations.

A) Schedule: Final acceptance of development by NLM Project Officer by September 30, 2019.

B) Deliverables for the 7th Floor Conference Room upgrade:

1. One mounted and fully functional large 4K touch screen display.

2. The basic room requirements are fully installed, tested, and proof of performance documented.

3. Cables, connectors, systems, and interfaces required for the prototype media streaming infrastructure.

C) Acceptance: The task Project Officer/COR will approve all plans, documents, designs, and drawings, and will approve all completed work.

6.7 Sample Task 7 – Upgrade the NLM Auditorium Presentation Systems

The planned upgrade to the NLM Auditorium, requested by this task, is required to upgrade all of the presentation systems, including major collaboration functional improvements, new user interfaces with the associated control system and media source playback, and efficient media recording, storage, and retrieval for the NLM Auditorium. The Auditorium was originally built as an interactive teaching and demonstration facility. Several major improvements have been identified and already implemented for the operation of the multimedia systems in the Auditorium. A major recent upgrade was the integration of a new large screen, a 4K projection system, the control system upgrade and the user interfaces required to control the presentation of the high quality 4K media in the auditorium. This proposed upgrade will provide the systems and media network infrastructure, and control and collaboration systems for more efficient room and remote operations. For several years, Systems Engineering Support has been involved directly with the technical design and installation of the audio, video, display, and collaboration systems for the NLM Auditorium. Due to budget constraints, the signal distribution standards, the user interface, and the remote operations had to be considered an interim design, and it now must be upgraded to its full intended functionality. The engineering design, installation, programming and system testing can only reasonably be expected to be accomplished, within the projected schedule, by the tasking of these required services made available via the purchase order awarded in association with the attached SOW.

A) Schedule: Final acceptance of upgrade by NLM Project Officer by August 30, 2019.

B) Deliverables for Auditorium Presentation Systems Integration:

1. Display collaboration system, control system and control system software to integrate the video, audio and display systems with the user interface for control of media source playback and recording in the Auditorium.

2. Cables, connectors and interface systems, conferencing network infrastructure, and switching systems, required for the new remote functional operation.

3. Upgraded display collaboration and control interface for the remote Auditorium information and operation system.

C) Acceptance: The task Project Officer/COR will approve all plans, designs, and drawings, and will approve all completed work.

7.0 SYSTEMS LOGISTICS SUPPORT AND DOCUMENTATION

a. Provide appropriate systems integration analysis and record keeping of upgrades and modifications, and preventive maintenance and routine cleaning recommendations.

b. Provide a comprehensive documentation system for all installed production equipment, including location, cable labels, equipment terminations, and system software versions and required updates.

8.0 TASK ORDER TYPE

This Task Order is Time-and-Materials (T&M). [Reference Federal Acquisition Regulation (FAR) 16.601].

9.0 PERIOD OF PERFORMANCE

The period of performance of this Task Order shall be for the 12-month Base Period of March 29, 2019 through March 28, 2020, with two (2) successive 12-month Option Periods, including Optional Effort in the Base Period and each Option Period:

10.0 TRANSITION PLAN

In the event the Government re-competes the requirements of this SOW and prior to completion of this Task Order’s period of performance, the Contractor shall, at the Government’s option, provide the Government with a Transition Plan that shall ensure an orderly and successful transition of the remaining tasks to a successor contractor should the incumbent Contractor not be selected during the re-competition. As part of the Transition Plan, the Contractor shall adequately train the successor contractor’s employees following any re-competition of the requirements specified in this SOW.

11.0 PLACE OF PERFORMANCE

The Contractor shall perform the work described herein at NIH Federally-controlled facilities in Buildings 38 and 38A on the NIH Campus in Bethesda, Maryland. Any work that the Contractor performs at a Non-Federally-controlled facility must be approved in advance by the COR.

To the extent possible, the contractor will perform pre-installation work in its own facilities. All approved installation work will be performed in Buildings 38 and 38A on the NIH Campus in Bethesda, Maryland in accordance with specified tasks and will require that the contractor be granted sufficient uninterrupted access to the requisite facilities. Appropriate NLM organizational entities will define the parameters of the concept, design and implementation for each task and at each level of development.

To allow for reasonable and timely support and collaboration between the contractor and NLM personnel for on-site meetings, installation, and testing, as rapid onsite services as needed, the contractor’s facilities should be located no greater than 45 miles from the National Library of Medicine and the Lister Hill Center in Bethesda, MD, if not proposal should address how vendor will respond to rapid onsite service requests.

12.0 DELIVERABLES/DELIVERY SCHEDULE

Routine (weekly, monthly) reports are not required. However, the project officer may require preliminary functional wiring and cabling diagrams, layout drawings, and system concept drawings, etc., for some or all of the work to properly evaluate and approve the contractor's plans and final configuration.

The contractor will provide appropriate engineering elements for approval at each major milestone for each task. These could include designs, drawings, renderings, prototypes, models, software modules, equipment specifications, demonstrations, and fabricated facility components. The final system deliverables will be reviewed by the designated task project officer at NLM, where they will be tested for functionality.

The Contractor shall provide the following deliverables for review and acceptance by the COR:

Provision Due Date

Subsequent submissions - within 14 calendar days of any revision to the Roster as a result of staffing changes.

Badges - all badges must be submitted to the COR within two (2) business days after the Government’s final acceptance of the work under this Task Order, or in the event of a termination of this Task Order.

All documents required herein shall be submitted in electronic format. In addition, one hardcopy of each document shall be submitted to the COR.

Requirements for accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), with updates from the “Information and Communications Technology (ICT) Final Standards and Guidelines (36 CFR Parts 1193 and 1194), are determined to be relevant under this SOW for the following program needs:

The Section 508 Standards applicable to this Task Order:

1194.21, Software applications and operating systems 1194.24, Video and multimedia products 1194.25, Self-Contained, Closed Products 1194.31, Functional performance criteria.

1194.41, Information, documentation, and support

The ICT Section 508 ‘refresh” also directs conformance with WCAG 2.0 standards (Levels A and AA). All electronic documents submitted shall be conformant with Section 508 and the ICT. Additional information about testing documents for Section 508 compliance, including specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible." Document formatting instructions and checklists can be found at http://www.hhs.gov/web/section-508/making-files-accessible/index.html. The Government reserves the right to inspect and evaluate any document for Section 508-conformance and accessibility.

The attached Government Product Accessibility Template (GPAT) is applicable to this Task Order.

Electronic documents delivered must be made available in alternate formats when requested by the COR, including formats compatible with assistive technology, at no additional charge.

All paper/hardcopy documents (including reports) submitted under this Task Order shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

The Contractor shall follow NIH/NLM security rules to provide services, ensured application/system/web security, and fix security vulnerabilities within the required time frame.

SOW: Professional Audiovisual Systems Engineering Services for APDB, LHNCBC, NLM Page 35 of 37

13.0 TIME-AND-MATERIALS (ESTIMATED – NOT TO EXCEED)

The Contractor shall provide the following resources (estimated, not to exceed) in the performance of this SOW:

(Estimated, Not to Exceed)

Base Period

12-Months Option Period 1

12 Months Option Period 2

12 Months Total 36 Months

Base Effort:

Professional:

Professional Support:

* Key Personnel

**Materials as defined pursuant to Federal Acquisition Regulation (FAR) 16.601 (e.g., direct materials, equipment and software purchases, training, local travel within the Washington-Baltimore Metropolitan Area, and other direct costs that have received prior written approval from the COR)

The Government reserves the right to add or modify labor categories and the number of hours required to complete the tasks.

14.0 Labor Categories

The following labor categories are required to successfully perform the work requirements under this SOW.

Due to the continued growth and evolution of the APDB’s responsibilities in conducting media development for LHNCBC’s research, development, and demonstration projects; providing consultation and materials development for NLM information programs; and engineering technical improvements for media production; it is understood that additional labor categories may need to be incorporated into this SOW in order to accomplish the work requirements specified in Provision 6.0 above. New labor categories may be added to this SOW at the direction of the Government or by suggestion from the Contractor. Any new labor category added to SOW shall be approved in advance by the COR and incorporated by modification to the Task Order.

11.1.3 Project Manager

Minimum Experience:

Education:

Functional Responsibility:

11.1.2 Project Support

Minimum Experience:

Education:

Functional Responsibility:

11.1.3 System Design Engineer

Minimum Experience:

Education:

Functional Responsibility:

11.1.4 System Engineer

Minimum Experience:

Education:

Functional Responsibility:

11.1.5 Senior Engineering Technician

Minimum Experience:

Education:

Functional Responsibility:

11.1.6 Installation Technician

Minimum Experience:

Education:

Functional Responsibility:

12.0 INFORMATION AND PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Information Type

[X] Administrative, Management and Support Information:

Supply Chain Management: Inventory Control Information – Refers to tracking of information related to procured assets and resources with regards to quantity, quality, and location.

Confidentiality: [X] Low [ ] Moderate [ ] High Integrity: [X] Low [ ] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High

Overall Risk Level: [X] Low [ ] Moderate [ ] High

[ ] Mission Based Information: Not applicable

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents provided by the Contracting Officer’s Representative (COR) to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and Operating Division (OpDiv)-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation by the date specified by the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HHS non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer and/or COR prior to performing any work under this acquisition. A copy of the Commitment to Protect Non-Public Information – Contractor Employee Agreement (NDA) form, 2 pages, Adobe file is located at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the NIH Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within the time frame designated by the COR after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the NIH SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable NIH Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. The training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and NIH-specific rules, as applicable.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all Alerts/Indicators of Compromise (IOCs) provided by the NIH Computer Security Incident Response Center (CSIRC) IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted…