75P00120Q00176 Continuation pages.pdf

RFQ No. 75P00120Q00176 Title: Wastewater Data Testing

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A— Health Resources Priorities and Allocations System.

SECTION 1 – SUPPLIES OR SERVICES/PRICES

1.1 DESCRIPTION/SPECIFICATIONS/ TITLE:

The purpose of this PWS is to outline proposed Contractor support to assist the HHS Office of the Chief Information Officer (OCIO) with leveraging wastewater data to detect trends in COVID-19 cases in the community and including that data in the HHS Protect Program.

1.2 DESCRIPTION/PERFORMANCE WORK STATEMENT

Under the direction of the White House Coronavirus Task Force, the Department of Health and Human Services (HHS) and our federal partners are working with state, local, tribal and territorial governments and with the private sector to execute a whole of government response to fight the COVID-19 pandemic and protect the public’s health.

To that end, Departmental leadership and HHS Operating and Staff Divisions are working to obtain sufficient and necessary data to address the needs of this public health emergency. Through the authorities under the Foundations for Evidence-Based Policymaking Act, the HHS CIO/CDO is responsible for ensuring the effective execution of data management practices across our organization. Data collection and analysis is of the utmost importance in responding to COVID-19 and coordinating efforts to collect that data will accelerate our work to protect the public and lessen the spread and impact of this virus. With the increasing number of cases in the United States and across the globe, it is critical for the United States Government to have access to all available resources to support efforts in the response.

This requirement is a critical and urgently need to support the nation's response to the COVID-19 health emergency. The HHS Protect platform is critical to manage data and information for HHS to the nation, White House task force, and the National Response Coordination Center. The HHS OCIO has a requirement to immediately provide this capability to the various senior decision makers that are providing medical and pharmaceutical related material and services to various locations across the US during this public health emergency.

This HHS Data Sharing platform is critical to the COVID-19 White House Task Force, the HHS response teams, and the inter-governmental COVID-19 teams that are hosted by the FEMA National Response and Coordination Center. In furtherance of this need, we are planning to ingest HHS data sets on the HHS COVID-19 Data Sharing Platform, as well as, publicly available data sets, state and local data sets, and private sector data sets. These data are the foundation for the White House’s decision-making and daily public presentations.

These data sets may contain certain sensitive data elements, including residual personally identifiable information that are required in furtherance of these COVID-19 response efforts therefore data protection is critical. We will be integrating multiple products to address issues related to role-based access – what levels of data are needed, how to accomplish secure data transmission, and to ensure awareness of the anticipated level of use and sharing of data provided.

Trends in SARS-CoV-2 concentrations in wastewater have been demonstrated to correlate with trends in new COVID-19 cases 5 to 11 days in the future. Wastewater testing data provided by the Contractor will illustrate a more complete picture of local, community-level COVID-19 trends, where clinical cases may be underreported and transmission levels not well understood. This can be particularly helpful for communities with limited testing access, or for communities in which demand for testing remains low for other reasons. The Contractor will work with HHS to find the best path forward so that testing can have the greatest impact on the overall health of the American populace.

Scope:

The Contractor shall provide additive data and support to the HHS Protect Program by detecting pathogen SARS- CoV-2 in community wastewater, compiling that data, performing predictive analysis on that data, and securely transferring the derived data into the HHS Protect system in a JSON format that corresponds with the Federal Information Processing Standard Publication (FIPS) code level. The contractor shall support wide-scale and regular testing of the American population for COVID-19 using wastewater surveillance to help guide reopening and mitigation strategies, and also serve as leading indicator for local re-emergence events to enable rapid containment.

As set forth below, Contractor, at the direction of HHS/OCIO, shall go to Authorized Communities, and perform the services listed below in this section. An Authorized Community is defined as a city, town, or other locality for which HHS/OCIO has directed a Contractor to provide wastewater surveillance testing services for SARS-CoV-2 with appropriate quality assurance and quality controls. HHS/OCIO shall provide direction to Contractor regarding the Authorized Community, frequency of testing, and approved number of sample collection locations.

Contractor may reject the assignment of an Authorized Community, provided that in order to do so Contractor must notify HHS/OCIO in writing within 48 hours of being assigned an Authorized Community that it rejects this assignment.

The Contractor must provide all staff, equipment, supplies, and logistical support to perform all services described in this contract, including but not limited to, identification of sample collection location, sample collection, and sample analysis. This will include supplying sample collection equipment. This Performance Work Statement (PWS) addresses these areas for the performance of this work:

1. Program management,

2. Engagement in a documented planning process,

3. Collection of wastewater samples from approved sample collection locations on a regular basis in Authorized Communities as established in consultation with HHS;

4. Analysis and provision of SARS-CoV-2 RNA concentration data and associated metadata from wastewater treatment plants for predictive analysis

5. Rapid, secure data file transfers to HHS Protect

Leveraging wastewater data to predict new COVID-19 cases

The contractor shall support wide-scale and regular testing of the American population for COVID-19 using wastewater epidemiology to help guide the overall reopening strategy, but also serve as an early warning system for local re-emergence events to enable rapid containment.

The contractor shall work with communities across 42 states and establish COVID-19 wastewater testing for over 10% of the American population. They will scale these testing regimes as they will serve as an invaluable early warning system to guide local and national strategies controlling the spread of the COVID-19 outbreak.

A national wastewater testing platform for HHS

The contractor shall scale COVID-19 wastewater testing, in phases, in the United States. This network will generate qualitative trend data of SARS-CoV-2 concentrations in sewage, providing critical information on how to strategically reopen American cities and the economy, and an early warning for new outbreaks.

Wastewater testing is predictive of new COVID-19 cases 5 to 11 days in advance. Data and analysis provided by the contractor’s wastewater surveillance will illustrate a more complete picture of local, community level COVID- 19 trends, where clinical cases had been dangerously underreported, leading to unchecked spread. This can be particularly helpful for communities lacking testing facilities or testing supplies, or for communities in which demand for testing remains low for other reasons.

Clinical testing lags 5-11 days behind wastewater surveillance, giving public officials a planning advantage and enabling an adequate operational response. The contractor will work with HHS to find the best path forward so that testing can have the greatest impact on the overall health of the American populace.

Data Use

All wastewater samples collected through this contract, along with their associated data and reporting, or any other derivative information the Contractor uses, maintains, discloses, receives, creates, transmits or otherwise obtains in connection with its performance of the Project, are the sole property of HHS. Under no circumstances may Contractor use these samples, or any data generated with, by, or from these samples, for purposes not explicitly described in this Contract or without prior written approval from HHS. Examples of prohibited uses include, but are not limited to, testing of wastewater samples collected pursuant to this Contract other than as provided for in this Contract, inclusion in research publications, data sharing with other public or private entities, or incorporation into marketing materials.

The Contractor shall report to HHS, both verbally and in writing, any instance in which a sample or any other data obtained in connection with this contract is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under the Freedom of Information Act). The Contractor shall provide such report to HHS as soon as feasible upon receiving or otherwise becoming aware of the legal process;

provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. If HHS determines that it shall respond directly, the Contractor shall cooperate and assist HHS in its response.

The Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the samples and that prevent use or disclosure of such data other than as provided for by this Contract. As soon as possible, but in any event no later than twenty-four (24) hours after Contractor becomes aware of a misuse or mis-disclosure not permitted under the Contract, the Contractor shall verbally report the Event to HHS with as much of the details listed below as possible, and shall follow such verbal report within three (3) business days with a written report outlining the misuse or mis-disclosure and shall provide any additional information as HHS may reasonably request. The Contractor acknowledges that samples subject to this contract are sensitive, and violations of this section shall be deemed a material breach of the Contract.

Tasks

Phase 0: Rapid ramp-up of testing deployment and establishment of data transfer protocols between Contractor and HHS Protect.

Period of performance, 2 weeks

1. Establish and test data transfer protocols between Contractor and HHS Protect

2. Leverage existing and prior contractor relationships with wastewater treatment plants to ramp-up and onboard testing to cover ~36 million people, ~ 100 wastewater treatment plants, ~10% of the population.

Deliverables

Contractor shall establish and test secure data transfer to HHS Protect Contractor shall prepare and host at least two training sessions, no less than 30 minutes/each, for the government and their representatives, covering how to digest and analyze the provided data Contractor shall provide data collection instrument for required wastewater treatment plant metadata.

Contractor shall provide thorough documentation and guides for HHS to analyze the data streams

Phase 1: Testing and reporting for~36 million people, ~100 wastewater treatment plants, ~ 10% of the US population including quality assurance and quality control (QA/QC)

Period of Performance: 6 weeks

1. Contractor will provide self-contained sampling kits to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples, greater than or equal to 500 ml.

2. Provide training to wastewater facility staff on proper collection, packaging, and shipping of composite sample of their wastewater, safely packaging and returning to the contractor. Sample collection and shipping protocols are provided.

3. Contractor runs laboratory analysis, isolating the genetic material (RNA) of SARS-CoV-2 and analyzing and testing to quantify the amount of SARS-CoV-2 RNA molecular targets via reverse transcriptase quantitative polymerase chain reaction or droplet digital RT-PCR.

4. Contractor uses computational biology models to identify strains circulating in the state, and to estimate COVID-19 cases.

5. Contractor expedites reporting, contextualizing data with thousands of samples collected across 42 states to date.

6. Contractor performs QA/QC controls to maintain the uncorrupted nature of the raw and modeled data required, including but not limited to, protocol of laboratory methods utilized, human fecal normalization parameter, inhibition evaluation, standard curves (RT-qPCR), extraction blanks, and no template controls.

7. Contractor provides regular data streams to HHS Protect, at a minimum of 2x/week.

Deliverables

- Transfer derived data to HHS a minimum of 2x/week.

- Report testing performance including QA/QC, turnaround time, and percent of samples requiring repeat testing.

- One additional 30-minute training sessions with the government and their representatives;

Task 2: Target expansion to ~100 million people, ~320 wastewater treatment plants, ~30% of the US population

Optional: (must be exercised by the government), Period of Performance: 9 weeks

Task 2 includes all the steps outlined in Task 1, but at an expanded footprint of sample collection sites to approximately 350 wastewater treatment plants covering approximately 30% of the US population, which the Contractor will coordinate with HHS to identify.

Note: Task 2 is contingent on the successful completion of Task 1. The government will determine the value of a continued data transfer from the contractor to HHS Protect.

Task 3: Contractor Program Management

The Contractor shall manage their performance to ensure compliance with all requirements of the contract. The Contractor shall assign a Program Manager who will ensure the Contractor’s performance complies with all requirements and will be the primary point of contact for the work to be performed. The Program Manager shall have sufficient corporate authority to direct, execute, and control all elements of the task and ensure that all necessary management, business, contracts, engineering, implementation, and maintenance resources are available and sufficient, both in numbers and qualifications, to successfully perform all the tasks required by the contract.

The Contractor shall continuously monitor the performance of this contract, and of all subcontracts, to provide the Government with a timely assessment of program progress and problems and to control contract activities to include Subcontractor and/or vendor activities. This should involve the development and execution of a Communication Plan to include the methodology and approach for communicating status, issues, and risks to OCIO through the COR and for communicating with stakeholders outside OCIO. Critical management data regarding OCIO operations status and high priority projects should be available on an electronic Dashboard.

Deliverables:

- Kick off Meeting

- Status Report (Weekly)

- Monthly Contract Review Meetings (Frequency: Monthly)

Performance Standards:

Task Description Performance Indicator Required Performance Measurement

Providing data transfers into HHS Protect

Delivery Time Data transfer is completed – without delays or errors – 2x/week

Providing consistently complete data

Accuracy Deliverables require two revisions or less

HHS Protect Support Response Time Respond to all inquiries & requests for assistance within one business day

MINIMUM REQUIREMENTS

Contractor certifies that it meets the following minimum requirements for entering into the Contract:

1. Contractor has the capacity to perform wastewater testing for SARS-CoV-2 and associated Quality Assurance/Quality Control (QA/QC) required for on a maximum of 200 samples per week for 8 weeks in Phase 1 and up to 640 samples per week for 9 weeks in Phase 2 (optional).

2. Contractor can consistently report results of wastewater surveillance testing within 36 hours of sample collection for the duration of this Contract.

3. Contractor can specify appropriate QA/QC measures and document their implementation as a part of their wastewater analysis methodology.

4. Contractor has the demonstrated capacity to independently forge partnerships with local officials, including but not limited to local water/sewer departments.

5. Contractor has previous experience performing wastewater testing activities with appropriate QA/QC measures in the United States.

6. Contactor can secure all equipment necessary to perform the services required under this Contract.

7. Contractor has all appropriate licenses or waivers in place to perform all wastewater testing services.

1.3 TYPE OF CONTRACT

This is a Firm Fixed Price Task Order for severable, commercial items/services.

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

1.4 COMMERCIAL ITEMS

COMMERCIAL ITEMS/SERVICES:

The services specified in this task order have been determined to be commercial.

CONSIDERATION AND PAYMENT (Fixed Price – Severable Services)

Base: September 30, 2020 through November 25, 2020 (8 weeks)

Option Period One: November 26, 2020 through January 27, 2021 (9 weeks)

In consideration of satisfactory performance/delivery of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN. The contract is priced as follows:

CLIN Item/Part Number

Description QTY/WEEKS Unit Price Extended Price

1 8 $ $ 2 9 $ $

TOTAL FFP $

SECTION 2 – DELIVERIES OR PERFORMANCE

2.1 PERIOD OF PERFORMANCE

The period of performance shall be for a base period of twelve (12) months from the date of award, with anticipated award date of July 29, 2020, as follows:

Base Period: 09/30/2020 – 11/25/2020 Option Period One: 11/26/2020 – 01/27/2021

2.2 PLACE OF DELIVERY/PERFORMANCE

Work will be performed at the Contractor’s site, but the contractor is not prohibited from allowing its employees to telework in accordance with the contractor’s policies if the work and required level of performance can be completed successfully in accordance with the contract requirements. The Contractor shall coordinate employee telework or any on-site Government location delivery/support in advance with the Contracting Officer’s Representative.

Delivery information is as follows:

Procurement Name: Wastewater Data Testing

Procurement POP: September 30, 2020 through November 25, 2020 Technical Point of Contact: TBD POC Email: TBD POC Telephone:

COR: TBD

COR Email: TBD COR Telephone:

Delivery Address for Hardware/Software: Via email to COR and Technical POC; 200 Independence Avenue, Washington DC 20001

2.3 REPORTS/DELIVERABLES AND DELIVERY/PERFORMANCE SCHEDULE

The purpose of the effort is to assist HHS-OCIO migrate its legacy application portfolio to a standardized modern platform that provides ease of integration with other HHS-OCIO technology platforms. Reference deliverables listed in Scope and Tasks; deliverables include:

- Kick off Meeting

- Status Report (Weekly)

- Monthly Contract Review Meetings (Frequency: Monthly)

Contractor Performance Evaluation:

During the life of this TO, contractor performance will be evaluated on an interim and final basis pursuant to FAR Subpart 42.15. The Contractor Performance Assessment Reporting System (CPARS) will be utilized for these reviews. Information on CPARS can be located at http://www.cpars.gov.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The Government intends to utilize the below Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance. The oversight provided for in the contract and in the QASP will help to ensure that service levels reach and maintain the required levels throughout the contract term. Further, the QASP provides the COR with a proactive way to avoid unacceptable or deficient performance, and provides verifiable input for the Contractor Performance Assessment Reporting System (CPARS). The QASP may be updated by modification to the contract.

Quality Assurance Surveillance Plan (QASP)

Task Standard Acceptable Quality Limit

All deliverables Deliverables are completed by the required due dates.

95% of deliverables

Task Standard Acceptable Quality Limit

For each deliverable requiring government approval, less than 10 percent content rework is required.

100% of deliverables

Upon resubmission reworked deliverables are compliant.

100% of reworked deliverables

Schedule management

Over the life of the program, milestone completion dates defined in the integrated master schedule and PMP change less than 10 percent from the PMO-approved baseline.

100% compliance

Standards Design is compliant with statutory and regulatory standards, HHS policy, and federal enterprise architecture standards.

100%

Testing All systems are tested and perform per approved design and system specifications.

95% pass rate

Remediated defects pass UAT testing upon first resubmission and do not cause cascading defects.

98% of defects

All show stopper defects must be resolved before scheduled release.

100% show stoppers

Implementation Systems are given authority to operate prior to go live date.

100%

Collaboration Contractor adheres to agreed upon standards of behavior and conduct.

100%

Transition Out/Knowledge Transfer

EA receives the referenced documentation and knowledge transfer to successfully operate and maintain Vision Application Portfolio Management and related interfaces post contract completion.

As evaluated by the EA Executive and

PMO

Stabilization and user acceptance

During the stabilization period, Contractor is responsive and resources are applied to support acceptance and adoption of the system by the user community.

As evaluated by the

EA PMO

2.3 NOTICE TO THE GOVERNMENT OF DELAYS

In the event the Contractor encounters difficulty in meeting performance requirements, or when the Contractor anticipates difficulty in complying with the contract delivery schedule or completion date, or whenever the Contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the Contractor shall immediately notify the Contracting

Officer, the Contracting Officer’s Representative and the Program Management Office, in writing, giving pertinent details. This data shall be informational only in character and this provision shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this task order.

Performance Standards:

Task Description Performance Indicator Required Performance Measurement

Providing data transfers into HHS Protect

Delivery Time Data transfer is completed – without delays or errors – 2x/week

Providing consistently complete data

Accuracy Deliverables require two revisions or less

HHS Protect Support Response Time Respond to all inquiries & requests for assistance within one business day

SECTION 3 - Contract Administration Data

3.1 AUTHORITIES OF GOVERNMENT PERSONNEL

Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of this contract will require maximum coordination between the Government and the Contractor. The following individuals will be the Government's points of contact during the performance of this contract:

Contracting Officer Name: Jennifer Browning Email: jennifer.browning@hhs.gov

Contracting Officer's Representative Name: TBD Address: 200 Independence Ave, S.W., Washington DC 20201 Email: TBD

Note: The Contracting Officer is the only individual authorized to modify the contract.

3.2 CONTRACTING OFFICER’S REPRESENTATIVE (COR) AUTHORITY

(a) Performance of work under this contract must be subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing. The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(b) Technical direction must be within the scope of the specification(s)/work statement.

The Contracting Officer's Representative does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

(2) Constitutes a change as defined in the clause entitled "Changes";

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

(d) The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officers, Representative. If, in the opinion of the contractor, any direction of the Contracting Officers, Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

3.3 INVOICE SUBMISSION

(1) Invoice Submission

The contractor shall submit invoices under this contract once per month. Invoices shall be submitted in accordance with the contract terms.

A proper invoice, with all required back-up documentation shall be sent electronically, via email, to:

1) Contracting Officer's Representative (COR): TBD

2) Contracting Officer: Jennifer.browning@hhs.gov

3) Contract Specialist: Lashawn.Haggins@hhs.gov

4) Financial Management Services: psc_invoices@psc.hhs.gov

5) Acquisition Management Services: pscsas.invoices@psc.hhs.gov

The subject line of the invoice submission email shall contain the contract number, order number (if applicable), and the number of invoices contained within. Each invoice shall be submitted as a single file, limited in size to 25MB, which includes all required back-up documentation based on the contract type. In the event an invoice file exceeds the size limitation, the contractor shall contact the Contracting Officer to provide all required supporting documentation. The email may have multiple invoices for the contract. Invoices must be in the following formats: PDF, TIFF, or Word. No Excel formats will be accepted. The electronic file cannot contain multiple invoices; example, 10 invoices requires 10 separate files.

(2) Invoice Elements

Invoices must include all elements required by FAR 52.212-4(g). The contractor is required to include electronic funds transfer (EFT) banking information. In accordance with the requirements of the Debt Collection Improvement Act of 1996, all payments under this contract will be made by electronic funds transfer (EFT). The Contractor shall provide financial institution information to the Finance Office designated above in accordance with FAR 52.232-33 Payment by Electronic Funds Transfer - System for Award Management.

Additionally, the Program Support Center (PSC) requires:

(i) Invoices must break-out price/cost by contract line item number (CLIN) as specified in the pricing section of the contract.

(ii) Invoices must include the Dun & Bradstreet Number (DUNS) of the Contractor.

(iii) Invoices that include time and materials or labor hours CLINS must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

3) Prompt Payment Act

Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR Part 1315.

SECTION 4 - Special Contract Requirements

4.1 PRIVACY AND SECURITY REQUIREMENTS

Contractor must comply with or receive an applicable waiver for all HHS-OCIO security, privacy, and section 508 requirements.

4.2 KEY PERSONNEL

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The Government does not currently identify any key personnel. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

4.3 HHS PRIVACY AND SECURITY REQUIREMENTS

Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS) if so required.

Service Level Agreements. The Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and cloud providers and work with OPS to develop and maintain an SLA.

Interconnection Agreements/Memorandum of Agreements. The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of Agreements/Understanding in accordance with HHS/OS policies.

4.4 REQUIREMENTS FOR CLOUD SERVICES

HHS Privacy and Security Requirements

The Contractor (and/or any subcontractor) shall be responsible for the following privacy and security requirements:

HHS Compliant ATO. As applicable, since Vision Data Sharing Platform relies upon an existing moderate HHS compliant solution – Oracle Federal Managed Cloud Services. The contractor shall comply with HHS Security Assessment and Authorization (SA&A) requirements and to ensure the information system/service under this contract maintains a valid HHS compliant (approved) authority to operate

(ATO) in accordance with Federal Information Processing Standard (FIPS) Publication 199 defined security categorization.

a) Implement applicable baseline controls commensurate with the agency-defined security categorization and the applicable security control baseline. The HHS Information Security and Privacy Policy (IS2P) a Outlines controls identified by the agency.

b) A security control assessment must be conducted by an HHS third-party assessment organization for the initial ATO and annually thereafter or whenever there is a significant change to the system’s security posture in accordance with the application’s Continuous Monitoring Plan.

1. Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS).

2. Interconnection Agreements/Memorandum of Agreements. The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of Agreements/Understanding in accordance with HHS policies.

4.5 PROTECTION OF INFORMATION IN A CLOUD ENVIRONMENT

1) If contractor (and/or any subcontractor) personnel must remove any information from the primary work area, they shall Vision it to the same extent they would the proprietary data and/or company trade secrets and in accordance with HHS policies.

2) HHS will retain unrestricted rights to federal data handled under this contract. Specifically, HHS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of HHS and hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data must be available to HHS within one (1) business day from request date or within the timeframe specified otherwise. In addition, the data shall be provided at no additional cost to HHS.

3) The Contractor (and/or any subcontractor) shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with HHS requirements and policies.

4) The contractor shall support a system of records in accordance with NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to the following:

a. Maintenance of links between records and metadata, and

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

5) The disposition of all HHS data shall be at the written direction of HHS. This may include documents returned to HHS control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

6) If the system involves the design, development, or operation of a system of records on individuals, the Contractor shall comply with the Privacy Act requirements.

A. Security Assessment and Authorization (SA&A) Process

1) The Contractor (and/or any subcontractor) shall comply with HHS requirements as mandated by federal laws, regulations, and HHS policies, including making available any documentation, physical access, and logical access needed to support the SA&A requirement. The level of effort for the SA&A is based on the system’s FIPS 199 security categorization and HHS security policies.

a. The contractor shall complete and maintain an agency SA&A package to obtain agency ATO prior to system deployment/service implementation. The agency ATO must be approved by the HHS authorizing official (AO) prior to implementation of system and/or service being acquired.

2) HHS reserves the right to perform penetration testing (pen testing) on all systems operated on behalf of agency. If HHS exercises this right, the Contractor (and/or any subcontractor) shall allow HHS employees (and/or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with HHS requirements.

Review activities include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

3) The Contractor must identify any gaps between required HHS Security Control Baseline/Continuous Monitoring controls and the contractor’s implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts. In addition, all gaps shall be documented and tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require remediation at the contractor’s expense, before HHS issues an ATO.

4) The Contractor (and/or any subcontractor) shall mitigate security risks for which they are responsible, including those identified during SA&A and continuous monitoring activities. All vulnerabilities and other risk findings shall be remediated by the prescribed timelines from discovery: (1) critical vulnerabilities no later than thirty (30) days and (2) high, medium and low vulnerabilities no later than sixty (60) days. In the event of a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they shall be added to the designated POA&M and mitigated within the newly designated timelines. HHS will determine the risk rating of vulnerabilities using HHS baselines.

5) Revocation of a Cloud Service. HHS has the right to take action in response to the CSP’s lack of compliance and/or increased level of risk. In the event the CSP fails to meet HHS security and privacy requirements and/or there is an incident involving sensitive information, HHS and may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the CO and/or COR may direct the CSP to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor information system under this contract.

Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

B. Reporting and Continuous Monitoring

1) Following the initial ATOs, the CSP (and/or any subcontractor) must perform the minimum ongoing continuous monitoring activities specified below, submit required deliverables by the specified due dates, and meet with the system/service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities.

2) At a minimum, the CSP Contractor must provide the following artifacts/deliverables on a monthly basis

a. Operating system, database, Web application, and network vulnerability scan results;

b. Updated POA&Ms;

c. Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the System Owner or AO; and

d. Any configuration changes to the system and/or system components or CSP’s cloud environment that may impact HHS’s security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency.

C. Configuration Baseline

1) The contractor and CSP shall certify that applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB), DISA Security Technical Implementation Guides (STIGs), Center for Information Security (CIS) Security Benchmarks or any other HHS-identified configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved HHS Vision Platform configuration baseline.

2) The CSP contractor shall use Security Content Automation Protocol (SCAP) validated tools with configuration baseline scanner capability to certify their products operate correctly with HHS and NIST defined configurations and do not alter these settings.

D. Incident Reporting

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy

Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving

PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Vision all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send HHS Vision Platform ISSO and Vision Data Sharing Platform COR approved notifications to affected individuals.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the HHS Incident Response Team (IRT), COR, CO, Vision Data Sharing Platform SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information HHS incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

6) The Contractor (and/or any subcontractor) shall provide an Incident and Breach Response Plan (IRP) in accordance with HHS, OMB, and US-CERT requirements and obtain approval from the

Vision Data Sharing Platform. In addition, the Contractor must follow the incident response and US-CERT reporting guidance contained in the HHS Incident Communications.

7) The Contractor (and/or any subcontractor) must implement a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of federal data, afford HHS access to its facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The program of inspection shall include, but is not limited to:

a. Conduct authenticated and unauthenticated operating system/network/database/Web application vulnerability scans. Automated scans can be performed by HHS personnel, or agents acting on behalf of HHS, using agency-operated equipment and/or specified tools. The Contractor may choose to run its own automated scans or audits, provided the scanning tools and configuration settings are compliant with NIST Security Content Automation Protocol (SCAP) standards and have been approved by the agency. The agency may request the Contractor’s scanning results and, at the agency discretion, accept those in lieu of agency performed vulnerability scans.

b. In the event an incident involving sensitive information occurs, cooperate on all required activities determined by the agency to ensure an effective incident or breach response and provide all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

In addition, the Contractor must follow the agency reporting procedures and document the steps it takes to contain and eradicate the incident, recover from the incident, and provide a post-incident report that includes at a minimum the following:

Company and point of contact name;

Contract information;

Impact classifications/threat vector;

Type of information compromised;

A summary of lessons learned; and Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future.

E. Media Transport

1) The Contractor and its employees shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital and non-digital media (e.g., CD-ROM, tapes, etc.), mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards).

2) All information, devices and media must be encrypted with HHS-approved encryption mechanisms to Vision the confidentiality, integrity, and availability of all government information transported outside of controlled facilities.

F. Boundary Protection: Trusted Internet Connections (TIC)

1) The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities using cloud services is inspected by Trusted Internet Connection (TIC) processes.

2) The contractor shall route all external connections through a TIC.

3) Non-Repudiation. The contractor shall provide a system that implements FIPS 140-2 validated encryption that provides for origin authentication, data integrity, and signer non-repudiation.

a. Information Technology Application Design, Development, or Support

1) The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

2) The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

3) The Contractor (and/or any subcontractor) shall ensure that computer software developed on behalf of HHS or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards.

The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the HHS environment. No sensitive data shall be used during software testing.

4) The Contractor (and/or any subcontractor) shall Vision information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably-available information, is deemed sensitive or proprietary by HHS shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

4.6 INCIDENT REPORTING

The Contractor (and/or any subcontractor) shall maintain an Incident and Breach Response Plan (IRP) in accordance with HHS, OMB, and US-CERT requirements.

4.7 PROHIBITION AGAINST PERSONAL SERVICES

The Contractor shall not perform personal services under this contract. Contractor personnel are employees of the Contractor or its subcontractors and are under the administrative control and supervision of the Contractor. A Contractor supervisor must give all individual Contractor employee assignments and daily work direction. The Government will not supervise or direct Contractor employees in the performance of their assignments.