SOLICITATION HBCU - updated through Amendment 002 FINAL.pdf

RFP Number 75N98023R00002

- 1 -

FP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK TATEMENT…………………………………………….….8

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

2. NOTICE OF SMALL BUSINESS SET-ASIDE

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. COMMITMENT OF PUBLIC FUNDS

e. PROMOTING EFFICIENT SPENDING

f. COMMUNICATIONS PRIOR TO CONTRACT AWARD

g. RELEASE OF INFORMATION

h. PREPARATION COSTS

i. SERVICE OF PROTEST ..................................................................................................................….….64

3. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Separation of Technical and Business Proposals

3. PROPOSAL SUBMISSION INFORMAITON

4. Evaluation of Proposals

5. Use of the Metric System of Measurement

6. Standards for Privacy of Individually Identifiable Health Information

7. Privacy Act - Treatment of Proposal Information

8. Selection of Offerors

9. Certification of Filing and Payment of Taxes 10.52.203-98 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality

Agreements—Representation (DEVIATION)……….………………………………………………………..69

- 2 -

RFP Number: 75N98023R00002

11.Solicitation Provisions Incorporated by Reference, FAR 52.252-1

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Salary Rate Limitation

4. Small Business Subcontracting Plan

5. Mentor Protege Program, HHSAR 352.219-70

6. HUBZone Small Business Concerns

7. Total Compensation Plan

8. Past Performance Information

9. Proposal Summary and Data Record (NIH-2043) 10.Other Administrative Data 11.Subcontractors 12.Proposer’s Annual Financial Report 13.Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. DEFINITIONS

3. MANDATORY QUALIFICATION CRITERIA

4. EVALUATION OF OPTIONS

5. TECHNICAL EVALUATION FACTORS

6. TECHNICAL RATINGS

7. PAST PERFORMANCE FACTOR

8. COST/PRICE EVALUATIONS

9. SUBCONTRACTING PROGRAM EVALUATION FACTORS

- 3 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN

CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO

THIS SOLICITATION. ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN

ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND

GENERAL INFORMATION APPLICABLE TO THE CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS

CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT

REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF

THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL

PROVISIONS

PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) IF THE GOVERNMENT ELECTS TO HOLD DISCUSSIONS, IT WILL BE

INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND

THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Institutes of Health (NIH) intends to acquire a wide range of Business and Professional Support Services for Financial Analysis, Business Solutions, and Acquisition Lifecycle Support;

Business Process Improvement and Organizational Assessment; Communication and Training;

Program Planning and Management Services; Policy Development, Implementation, and Administration; System Integration; and Centers of Excellence Support Services.

The contractor, acting as an independent contractor and not as an agent of the government, shall furnish all the necessary services, qualified personnel, material, equipment, and facilities necessary to meet the requirements in accordance with the Statement of Work. The contract type is an Indefinite Delivery/Indefinite Quantity (IDIQ) task order contract utilizing Fixed Price (FFP), Labor Hour, and Time and Materials (T&M) type task orders in accordance with FAR 16.504. This contract will be used primarily by NIH but may also be used by other portions of DHHS and other Federal agencies.

B.2. HISTORICAL REFERENCE

EO 14041 White House Initiative on Advancing Educational Equity, Excellence, and Economic Opportunity Through Historically Black Colleges and Universities

• HBCUs produce nearly 20 percent of all Black college graduates and 25 percent of Black graduates who earn degrees in the disciplines of science, technology, engineering, and math.

• To support implementation of this Government-wide approach to breaking down systemic barriers for HBCU participation in Federal Government programs, the Director of the Office of Management and Budget and the Assistant to the President for Domestic Policy shall coordinate closely with the

Secretary of Education (Secretary), the Assistant to the President and Director of the White House Office of Public Engagement, the Executive Director, and the Chair of the President's Board of Advisors on HBCUs (as established in section 3 of this order) to ensure that the needs and voices

- 4 -of HBCUs, their faculty, staff, students, alumni, and the communities they principally serve are considered in the efforts of the Administration to advance educational equity, excellence, and opportunity.

B.3. PRICES/COSTS

a. The final contract will contain the price provisions agreed upon by the Government and the Offeror.

Offerors shall submit prices based on the Task Area of their expertise according to the Section B Pricing Table. The hourly rates and annual ceiling priced proposed in the BUSINESS PROPOSAL are fixed contract terms and may not be exceeded without the written authorization of the NIH Contracting Officer.

b. Pricing Table

The following are the four (4) tasks of the wide range HBCU PEI support services that contractors shall perform, upon request, during the contract. Offerors may submit proposals for one of more of the tasks of the contract activities listed below. A separate proposal is required for each type of contract activity that an offeror wishes to be considered for (i.e., an offeror qualified to perform Business and Professional Support Services related Public Health Outreach/Communications and Research, shall submit two proposals, each one focused on the particular type of contract activity).

TASK AREA 1: Biomedical Research and Development

TASK AREA 2: Business and Professional Support Services

TASK AREA 3: Laboratory Services/Products

TASK AREA 4: Public Health Outreach/Communications and Research

The Government shall compensate the Contractor at an amount negotiated at task order award. Compensation will be negotiated on the basis of the Labor Rates set forth below:

[To be completed at award (see Pricing attachment)]

Labor Categories Base Year Hours Hourly Rate Total

Labor Program Manager Project Manager Technical/Security Project Manager Senior Consultant Subject Matter Expert (Communications)

Subject Matter Expert (Researcher) Subject Matter Expert

(Manufacturer)

Subject Matter Expert (Outreach) Program Analyst Business Financial Management Analyst

Edwards, Anita (NIH/OD) [E] Added Program Manager to Labor Categories

- 5 -

Project Controller I Writer

Other Direct Costs

Total

c. Offerors' prices shall be FULLY burdened labor rates for each year for a period of five (5) years. Fully labor rates include all direct, indirect, general, and administrative costs, fringe, benefits, and profit associated with providing required skill. (Offerors shall provide rates for each of the labor categories for ALL years). The Congressional Budget Office released the Economic Projections in April 2018.

Offerors may allow an inflationary increase per year that not exceed more than 1% of the given year's CPI. For information on the 5-year Budget Projections, go to https://www.cbo.gov/about/products/budget-economic-data#3 . The prices set forth in this ARTICLE shall cover the contract period of five (5) years.

d. This is a Multiple Award Indefinite Delivery/Indefinite Quantity (IDIQ) contract as contemplated by FAR

16.504.

The Contractor shall be paid by the Government in an amount as listed below: not less than a total of $250 (minimum) nor more than a total of $ 49 mil (maximum) for successful performance of this contract.

The maximum ceiling is equal to the four Task Areas as follow:

TASK AREA 1: Biomedical Research and Development = $12, 250,000.00

TASK AREA 2: Business and Professional Support Services = $12,250,000.00

TASK AREA 3: Laboratory Services/Products = $12,250,000.00

TASK AREA 4: Public Health Outreach/Communications and Research = $12,250,000.00

e. The prices set forth in this ARTICLE will cover the contract periods:

Base Date of Award through July 07, 2024

Option Year 1 July 08, 2024 through July 07, 2025

Option Year 2 July 08, 2025 through July 07, 2026

Option Year 3 July 08, 2026 through July 07, 2027

Option Year 4 July 08, 2027 through July 07, 2028

f. The Government will compete, and award Task Orders based on the work described in SECTION C of this contract.

Removed the T in front of the 15mil

Wilkerson, Darnese (NIH/OD) [E] Added clarification to ceiling calculation illustration.

Revised award periods

- 6 -

g. Ordering procedures are described in The TASK ORDER PROCEDURE Article in SECTION G of this contract.

h. The Government will compete, and award Task Orders based on the work described in the attached

Statement of Work (SOW). See Section C of this contract. The anticipated type of Task Orders will be Firm-Fixed Price, Time-and-Materials, Labor Hour, or Hybrid type. Each Task Order will stand alone and will be issued in accordance with FAR16.505(a)(b). Task Orders for services will be issued in accordance with standard ordering procedures for HBCU PEI. An example of current ordering procedures is attached.

i. The labor rate in effect at the time the Task Order is issued applies until the work is completed. Should a contractor's actual year standard billing rate for their best customers be lower than the rate listed on the contract, the lower rate must be used. In such a case the contractor is to provide the Contracting Officer's Representative and the Contracting Officer a notice of any change in the final billing rate as they are established no more than 30 days after they become effective.

j. The contractor activities under this contract are subject to audit by the Government, its agents, or other organizations of the Federal Government. Such audits shall be undertaken at the cost of the Government. However, should the audit report find that charges to the Government exceed the amount that should properly have been charged, the contractor shall pay the Government the difference between the amount paid and the proper amount billed, and pay the cost of the audit.

B.4. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

B.4.a. Pursuant to FAR 16.504(a)(4)(vi), any duly warranted federal government Contracting Officer (as that term is defined in FAR 2.1) in good standing with the appropriate contracting authority is authorized to award task orders under this contract. For purposes of this contract, these individuals are referred to as Contracting Officers. Task orders may be multi-year or include options as defined in FAR Part 17 and agency-specific FAR Part 17 supplements. Refer to Section F. Task Order Period of Performance.

B.4.b. Subcontract

Award of the subcontract shall not proceed without the prior written consent of the Contracting Officer upon review of the supporting documentation required by FAR Clause 52.244-2, Subcontracts. After receiving written consent of the subcontract by the Contracting Officer, a copy of the signed, executed subcontract shall be provided to the Contracting Officer.

B.4.c. Non-Personal Services and Inherently Government Functions Pursuant to FAR 37.1, no personal services shall be performed under this contract. All work requirements shall flow only from the Contracting Officer's Representative (COR) to the Contractor's Project Manager. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the

- 7 -

Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

B.4.d. Pursuant to FAR 7.5, the Contractor shall not perform any inherently Governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government contractors in connection with this contract, the Contractor employee shall state that they have no authority to in any way change the contract and that if the other contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

B.4.e. The Contractor shall ensure that all of its employees working on this contract are informed of the substance of this article. Nothing in this article shall limit the Government's rights in any way under the other provisions of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this article shall be included in all subcontracts at any tier.

B.4.f. Labor Categories The labor categories represent the Government's best estimate of the kinds of personnel required for successful contract performance. The contractor is expected to map from the contract categories to the contractor own categories, for the purpose of matching resources to requirements.

B.4.g. Contractor Personnel The Contractor shall be responsible for maintaining satisfactory standards of employee competency, conduct, and integrity and shall be responsible for taking such disciplinary action with respect to his employees as may be necessary.

B.4.h. Supervision The Government shall not exercise any supervision or control over Contractor employees performing services under the contract. Such Contractor personnel shall be accountable solely to the Contractor who, in turn, shall be accountable to the Government.

The Contractor shall apply proper supervisory techniques and keep personnel informed of all changes and methods of operation. All work shall be performed in such a manner so that there is no interruption to, or interference with the NIH mission.

Contractor supervisors shall be available when the contract work is in progress, to receive notices, reports, or requests from the Contracting Officer's Representative (COR) or the Contracting Officer (CO). The Contractor shall furnish the COR updates and changes.

B.4.i. Confidential Treatment of Sensitive Information The Contractor shall guarantee strict confidentiality of the information/data that it is provided by the Government during the performance of the contract. The Government has determined that the information/data that the Contractor will be provided during the performance of the contract is of a sensitive nature.

- 8 -

Disclosure of the information/data, in whole or in part, by the Contractor can only be made after the Contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the Contractor shall obtain a written determination from the Contracting Officer.

B.4.j. Contract Number Designation On all correspondence submitted under this contract, the Contractor agrees to clearly identify the contract number that appears on the face page of the contract as follows:

B.4.k. Contract No. TBD.

If it is related to a specific Task Order, including the Contract No. and the Task Order No.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1. DESCRIPTION -STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish at least or all of the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, attached hereto and incorporated into this Solicitation as follows:

1.0 INTRODUCTION

In accordance with the Presidential Executive Order (EO) 14041, the White House Initiative on Advancing Educational Equity, Excellence, and Economic Opportunity Through Historically Black Colleges and Universities (HBCUs), the National Institutes of Health (NIH) Small Business Program Office (SBPO) administers the Path to Excellence and Innovation (PEI) Initiative as a comprehensive vehicle to strengthen the capacity of HBCUs to participate in Federal programs and access Federal resources, including procurement opportunities.

For more than 150 years, HBCUs have served this country as engines of economic growth, cultural diversity, and academic achievement. In particular, these venerable institutions have made a significant impact on advancing public health. From graduating overwhelming percentages of African-Americans into medical practice, to conducting breakthrough research in everything from cancer to genomes, HBCUs’ ongoing contribution to American public health is undeniable.

But for all the progress and diversity HBCUs bring to American health, their partnerships with the NIH—the world’s largest public funder of biomedical research—have been historically limited: HBCUs have not secured more than 1% of the NIH’s annual acquisition award funding. Increasing that number would not only enable the NIH to be in compliance with Executive Order for all Federal Agencies to support excellence and innovation within HBCUs, it would also advance the NIH’s mission to help the American people live their longest, healthiest lives.

This Indefinite Delivery Indefinite Quantity (IDIQ) shall provide for an increase in Research and Development Projects to support and stimulate research and technology development at Historically Black Colleges and Universities (HBCUs) pursuant to the HBCU Partners Act. The funding is designed to increase support and expand HBCU participation in federal programs.

2.0 BACKGROUND INFORMATION

Wilkerson, Darnese (NIH/OD) [E] Removed paragraph B.5 in entirety.

- 9 -

The NIH SBPO administers the PEI Initiative to provide HBCUs with resources for building contracting capacity and infrastructure.

The PEI Initiative specifically targets acquisition opportunities with a focus on biomedical research and other activities central to the NIH public health mission. The desired outcome is an increase in the number of contracts, grants, and cooperative agreements awarded to HBCUs. The PEI 2.0 Cohort consists of 21 HBCUs and 43 small businesses.

3.0 GOALS/OBJECTIVES

The concept of the program is to increase the potential for innovative technology and research opportunities while fulfilling the improved HBCUs understanding of their importance in providing cutting edge statutes of the law and its requirement to solutions to the NIH requirements. The program objective is to establish a baseline and measure improvements in the following:

3.1 Enhance the research and educational capabilities of such institutions in areas of importance to the

NIH 27 institutes and centers

3.2 Encourage the participation of such institutions in the research, development, testing and evaluation (RDT&E) programs and activities

3.3 Increase the number of graduates from such institutions engaged in disciplines important to the nature and behavior of living systems and the application of that knowledge to enhance health, lengthen life, and reduce illness and disability

3.4 Encourage research and educational collaborations between such institutions and other institutions of higher education, Government organizations, and industry

3.5 To foster fundamental creative discoveries, innovative research strategies, and their applications as a basis for ultimately protecting and improving health

3.6 To develop, maintain and renew scientific human and physical resources that will ensure Nation’s capability to prevent disease

3.7 To expand the knowledge base in medical associated sciences in order to enhance the Nation’s economic well-being and ensure a continued high return on the public investment in research

3.8 To exemplify and promote the highest level of scientific integrity, public accountability, and social responsibility in the conduct of science

In realizing these goals, the NIH is soliciting the HBCUs, along with their small business partners, to assist the NIH leadership with developing a program designed to improve the health of the minority community by conducting and supporting research specifically targeted in underserved and underrepresented areas.

4.0 SCOPE OF WORK

This Indefinite Delivery Indefinite Quantity (IDIQ) contract will provide services to the NIH 27 institutes and centers. The NIH intends, through this procurement, to increase the number of contractors and resources available to provide required services, relevant to the NIH mission.

The intent of this IDIQ contract is to issue task orders in the following scope areas:

• Biomedical Research and Development

• Business and Professional Support Services

• Laboratory Services/Products

- 10 -

• Public Health Outreach/Communications and Research The selected contractor(s) shall have subject matter expertise and provide all resources necessary to perform the specific requirements as defined in the Task Order Performance Work Statement (PWS).

Individual Task Orders will not be awarded that exceed $750,000 as authorized by section 1331 of Public Law 111-240 (15 U.S.C. 644(r)).

Individual Task Orders will be awarded on a Time & Materials (T&M) and Fixed Price (FP) basis in accordance with FAR 16.504.

The Contracting Officer may waive the dollar limit and the period of performance ceilings for individual task orders. Solely the Contracting Officer, on a case-by-case basis, shall determine deviations from the dollar limitation and the period of performance ceilings.

Revised $700k to $750K

- 11 -

4.5 SCOPE AREA DESCRIPTIONS

TASK AREA 1: Biomedical Research and Development

Biomedical research and development involves the broad area of science that looks for ways to prevent and treat diseases that cause illness and death in people and in animals. This general field of research includes many areas of both the life and physical sciences.

Biomedical research and development involves utilizing biotechnology techniques, biomedical researchers study biological processes and diseases with the ultimate goal of developing effective treatments and cures.

Biomedical research is an evolutionary process requiring careful experimentation by many scientists, including biologists and chemists. Discovery of new medicines and therapies requires careful scientific experimentation, development, and evaluation.

TASK AREA 2: Business and Professional Support Services

Business and professional support services involves a wide range of support for Financial Analysis, Business Solutions, and Acquisition Lifecycle Support; Business Process Improvement and Organizational Assessment;

Communication and Training; Program Planning and Management Services; Policy Development, Implementation, and Administration; and System Integration.

TASK AREA 3: Laboratory Services/Products

Laboratory Services (and supporting products) involves services related to lab tests, including detailing information and specimen collection supplies for supported lab tests, lab test requisitioning and ordering, lab test specimen collection and accessioning, lab tests performed on specimens, recording of lab test results, delivery of lab test results, as well as billing and collection for lab services.

TASK AREA 4: Public Health Outreach/Communications and Research

Public health outreach focuses on identifying specific geographic regions that may face higher levels of need or significant barriers toward living healthy lives. Compared to a community with access to nutritious food and health care services, those at a disadvantage often have shorter life spans.

The objective of public health outreach is to improve and extend the reach of health care through activities such as health education, case management, basic health screening, and facilitating access to services.

These activities can directly and indirectly improve health outcomes of individuals and communities.

6.0 DELIVERABLES

Deliverables will be determined at the task order level.

All reports required herein shall be submitted in electronic format. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

http://www.hhs.gov/web/508/index.html

- 12 -

7.0 REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

a. Technical Progress Reports

1. In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods.

The frequency and specific content of these reports will be determined prior to contract award.

For proposal preparation purposes only, it is estimated that in addition to the required electronic version(s) 0 hard copies of these reports will be required as follows:

[X] Monthly [ ] Quarterly [ ] Semi-Annually [X] Annually [ ] Annually (with a requirement for a Draft Annual Report) [X] Final - Upon final completion of the contract [ ] Final - Upon final completion of the contract (with a requirement for a Draft Final Report)

b. Other Reports/Deliverables. n/a

HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

INFORMATION AND/OR PHYSICAL SECURITY

1. Security Assessment and Authorization (SA&A)- A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) within three

(3) months after contract award. The Contractor shall conduct the SA&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

For an existing ATO, Contracting Officer Representative must make a determination if the existing ATO provides appropriate safeguards or if an additional ATO is required for the performance of the contract and state as such. NIH acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

http://www.hhs.gov/web/508/index.html

- 13 -

2. SA&A Package Deliverables - The Contractor (and/or any subcontractor) shall provide an SA&A package within 30 days of contract award to the CO and/or COR. The following SA&A deliverables are required to complete the SA&A package.

The NIH should determine which security control baseline applies and then make a determination on the appropriateness/necessity of obtaining an independent assessment. Assessments of controls can be performed by contractor, government, or third parties, with third party verification considered the strongest. If independent assessment is required, include statement below.

Thereafter, the Contractor, in coordination with the NIH shall conduct/assist in the assessment of the security controls and update the SAR at least annually.

• Independent Assessment - due 90 days after the contract award. The Contractor (and/or subcontractor) shall have an independent third-party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The Contractor shall address all "high" deficiencies before submitting the package to the Government for acceptance. All remaining deficiencies must be documented in a system Plan of Actions and Milestones (POA&M).

3. Contingency Plan and Contingency Plan Test - due 60 days after contract award. The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems and be consistent with HHS and NIH policies. Upon acceptance by the System Owner, the Contractor, in coordination with the System Owner, shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed.

Thereafter, the Contractor shall update and test the Contingency Plan at least annually.

• E-Authentication Questionnaire - The contractor (and/or any subcontractor) shall collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods shall follow OMB 04-04 and NIST SP 800- 63, Rev. 2, Electronic Authentication Guidelines.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

4. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[x ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

- 14 -

[ ] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

1. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE

(HSPD)-12 Roster-

a. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within seven (7) calendar days of the change.

The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-1512.xlsx.

b. If the Contractor is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

c. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

d. The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

e. All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract. Contractors may begin work after the fingerprint check has been completed.

f. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

g. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

h. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHScontrolled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

i. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

- 15 -

j. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

5. CONTRACT INITIATION AND EXPIRATION

1. General Security Requirements- The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology or and in accordance with the HHS Contract Closeout Guide (2012). HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html

2. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of, and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Notification- The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within fifteen days before an employee stops working under this contract.

5. Contractor Responsibilities Upon Physical Completion of the Contract- The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non- government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

6. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/ Emp-sep-checklist.pdf when an employee terminates work under this contract within 2 days of the employee's exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

6. Contractor Non-Disclosure Agreement (NDA)- Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

7. Vulnerability Scanning Reports The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the https://www.hhs.gov/ocio/ea/documents/proplans.html

- 16 -

Technical Progress Report. Otherwise, this report shall be submitted under a separate cover on monthly basis.

8. Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor's facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

a. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government's direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract.

The Government includes but is not limited to the U.S. Department of Justice, U.S. Government Accountability Office, and the HHS Office of the Inspector General (OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, SQL injection vulnerabilities, and any other known vulnerabilities.

b. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

c. Segregate Government protected information and metadata on the handling of Government protected information from other information. Commingling of information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

d. Cooperate with inspections, audits, investigations, and reviews.

2. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer's Representative (COR). The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/web/508/ contracting/technology/vendors.html under "Vendor Information and Documents."

http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html

- 17 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

E.1 The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided. For the purpose of this SECTION, task order contracting officer's representative is the authorized representative of the Contracting Officer.

Inspection and acceptance will be informed a location specified in the task order:

E.2. 52.246-11 Higher-Level Contract Quality Requirement.

As prescribed in 46.311, insert the following clause: Higher-Level Contract Quality Requirement (Dec 2014)

(a) The Contractor shall comply with the higher-level quality standard(s) listed below.

______________________________________________________[Contracting Officer insert the title, number (if any), date, and tailoring (if any) of the higher-level quality standards.]

(b) The Contractor shall include applicable requirements of the higher-level quality standard(s) listed in paragraph (a) of this clause and the requirement to flow down such standards, as applicable, to lower-tier subcontracts, in-

(1) Any subcontract for critical and complex items (see 46.203(b) and (c)); or

(2) When the technical requirements of a subcontract require-

(i) Control of such things as design, work operations, in-process control, testing, and inspection; or

(ii) Attention to such factors as organization, planning, work instructions, documentation control, and advanced metrology.

(End of clause)

SECTION F - DELIVERIES OR PERFORMANCE

- 18 -

F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be from the date of award through 12 months thereafter.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below:

Option Option Period Base Period July 08, 2023 - July 08, 2024

Option Year I July 08, 2024 - July 08, 2025

Option Year 2 July 08, 2025- July 08, 2026

Option Year 3 July 08, 2026 - July 08, 2027

Option Year 4 July 08, 2027 - July 08, 2028

F.2. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY 1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be determined

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

https://www.acquisition.gov/?q=browsefar https://www.acquisition.gov/?q=browsefar

- 19 -

G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance.