RFP_75P00120R00052_BASE.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

DAM

Bethesda MD 20814 8th Floor 7700 Wisconsin Avenue

DHHS/PSC/AMS/DAM

CODE 16. ADMINISTERED BYCODE

X

X

541512

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORDAM

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

03/16/2020 1200 ET

02/27/2020

WENDY CRUZ

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

75P00120R00052

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 92 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

Bethesda MD 20814 8th Floor 7700 Wisconsin Avenue

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$30.00

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

DHHS/PSC/AMS/DAM

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

X

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Indefinite Delivery Indefinite Quantity (IDIQ) for Systems Support Services: Payment Management System (PMS)RFP Period of Performance: 05/04/2020 to 05/03/2021

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

WENDY C. CRUZ

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

92 2 of

RFP#75P00120R00052 Page 3 of 92

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

The purpose of this contract is to support the Payment Management System (PMS) application, infrastructure and assist with the development of solutions to address mandated and customer-requested changes.

B.2 TYPE OF CONTRACT

This is a single-award Indefinite Delivery Indefinite Quantity (IDIQ) type contract.

B.3 TYPE OF ORDERS (IDIQ)

Task orders issued under this IDIQ contract may be: firm fixed-priced orders, time and material orders or labor hour orders

B.4 MINIMUM AND MAXIMUM QUANTITIES (IDIQ)

During the contract period, the Government shall place orders totaling a minimum of $2,000,000.00. This reflects the contract minimum for the entire period of performance, including any options. The contract maximum for the entire period of performance, including any options, shall be for the placement of orders totaling a maximum of $19,840,000.00.

B.5 CONTRACT LINE ITEM PRICING (IDIQ)

The price for each task order will be based on the negotiated unit prices listed below and estimated level of effort, or firm fixed price amount, to be determined at the time of task order award.

The Contractor will be reimbursed in accordance with pricing section of each task order for satisfactory performance of the work.

Time and Material/Labor Hour Orders The Contractor shall not exceed the maximum, fully loaded hourly rates (inclusive of wages, indirect costs such as fringe, overhead, general and administrative expenses, any other indirect costs for labor, and profit) for each category listed below.

Fully Loaded Labor Rate Labor Category Year 1 Year 2 Year 3 Year 4 Year 5

RFP#75P00120R00052 Page 4 of 92

Material (Non-Labor) Indirect Cost Rates - Pursuant to the General Provisions of this contract pursuant to FAR 52.212-4; Alt. I, the following fixed indirect rate to be applied against Materials is established:

No Material Costs are allowable under the IDIQ.

Firm Fixed Price Orders Firm Fixed Price orders shall comply with the labor rate maximums for each category listed below. A payment schedule for Firm Fixed Price orders will be negotiated for individual task orders.

Labor Category

Year 1 Year 2 Year 3 Year 4 Year 5

RFP#75P00120R00052 Page 5 of 92

SECTION C - Description/Specifications/Statement of Work

TITLE: Indefinite Delivery Indefinite Quantity (IDIQ) for Systems Support Services: Payment Management System (PMS)

C.1 PROGRAM DESCRIPTION AND BACKGROUND

C.1.1 Purpose of the Contract

This is a single-award Indefinite Delivery/Indefinite Quantity (IDIQ) contract which sets forth the conditions and clauses under which future acquisitions between the parties shall be governed.

This contract will be used as a means to efficiently and effectively support the Payment Management System (PMS) application, infrastructure and assist with the development of solutions to address mandated and customer-requested changes.

C.1.2 Agency Mission

The mission of PSC/Payment Management Services is to deliver the best value in grant payment services under a shared service approach, ensuring acquisition activities and general performance objectives are completed cost effectively in support of the needs and goals of PSC customers and PSC leadership.

C.1.3 Introduction

The Department of Health and Human Services (DHHS), Program Support Center (PSC), Financial Management Portfolio (FMP), Payment Management Services (Services) is responsible for operations support, maintenance, and enhancements to the Payment Management System (PMS).

The Contractor shall support PMS and the Service as they manage, and report on the thousands of grant payments that the PSC/FMP/Payment Management Services is required to monitor by legislative mandate.

C.1.4 Background

The Payment Management Services within the Program Support Center (PSC) has over 30 years of experience providing grant and grant-like payments, cash management, and grant accounting support services to Federal Agencies. PSC uses a custom-developed PMS that provides awarding Agencies and Grant recipients the tools to manage grant payment requests and disbursement reporting activities. The PMS has been selected by the Chief Financial Officers Council - by authority of Office of Management & Budget (OMB) - as one of two non-Department of Defense (DoD) grants payment systems for use by the entire Federal Government. PMS leverages efficient business processes, state-of-the-art information technology, E-Government initiatives and business expertise to build a critical link in the operation of Federal Financial assistance programs. PMS is a full service centralized grants payment and cash management system. The system is fully automated to receive payment requests, edit them for accuracy and content, transmit the payment to either the Federal

RFP#75P00120R00052 Page 6 of 92

Reserve Bank or the U.S. Treasury for deposit into the grantee's bank account, and record the payment transactions and corresponding disbursements to the appropriate account(s).

The function of the PMS is to provide world-class grants payment and cash management services to HHS and other Federal and non-Federal entities. The PMS serves as a fiscal intermediary between awarding agencies and the recipients of grants and contracts. The PMS objectives are to provide:

Central standardized process for Federal grant payments

An efficient cash management of grant funds

On-line access to grant recipients for funds requests, grant account information, and the Federal Financial Report (FFR) SF-425

On-line access to awarding agencies for grant recipient account, payment, and financial information

Operational efficiencies through economies of scale.

Reports to Treasury, Federal Accounting Systems, and other Federal systems requiring reporting data

The PMS currently processes approximately $547 billion annually in Federal grant and grant like payments. The PMS customers include a wide variety of grant and grant-like recipient organizations totaling over 30,000 payee accounts. PMS is a FISMA HIGH system that currently disburses funds to approximately 131 countries throughout the world.

Currently, PMS availability is limited to Monday – Friday 5:00 AM ET to 11:00 PM ET and Saturday & Sunday 9:00 AM ET to 9:00 PM ET; however, off-hours support will be required for various reasons (i.e. enhancement implementation, address unexpected system issues, emergencies, system security requirements, etc.) as well as any necessity to increase the system’s hours of availability.

C.1.4.1 PMS Overview

The primary functionality of the PMS consists of the following elements:

Recording award authorizations that are initiated by the grant awarding agencies

Processing grant recipient requests for funds

Reporting

RFP#75P00120R00052 Page 7 of 92

The PMS currently runs on servers and limited mainframes housed at the National Institute of Health (NIH). The physical maintenance of these machines is not within the scope of this Statement of Work, however various components of the operating system administration is within the scope of this Statement of Work. The PMS is not a single application, but is made up of various web pages, web based applications, workflows, databases, UNIX and Windows based servers, specially configured routers, virtual private networks (VPNs), file servers, commercial-off-the-shelf products (COTS) and custom developed programs, and data analytics solutions.

The objectives of the PMS are to provide a central point for grant and program payments;

efficient cash management; capability for recipients to request funds on-line; on-line access to payment and disbursement information by awarding agencies & delegates, and to obtain operating efficiencies through economies of scale.

C.1.4.2 Organizational Structure/Stakeholders

The FMP PMS Management structure consists of

A Government Contract Officer’s Representative (COR) who shall be responsible for the overall success of the PMS project, ensuring adequate coordination among the various management components.

Financial Management Portfolio (FMP), which is responsible for providing a full range of financial reporting and accounting services that meet strict Federal financial management system requirements and applicable Federal accounting and transaction standards. FMP is comprised of the Office of the Director and three Divisions: Accounting Services (AS); Cost Allocation Services (CAS); and the Payment Management Services (PMS). FMP also interacts regularly with the other PSC portfolios.

The Payment Management Services (Services) maintains responsibility for all grant payment responsibilities and is the primary user and stakeholder of the PMS. The Services serves as the financial intermediary between awarding agencies and grant recipients. The Services uses the PMS to perform and document payment-related grant activities for HHS and other federal agency clients. The PMS application is used to process grant payments for the majority of federal grantees. Some of the services offered include:

Next-day payments through the Automated Clearing House electronic network for financial transactions in the United States.

Cash management services that support the Cash Management Improvement Act

Professional grant account support services including helpdesk, training, reporting, and audit support.

RFP#75P00120R00052 Page 8 of 92

A Change Control Board (CCB) which shall serve as the primary authority for reviewing and approving (or disapproving) those changes to the software or requirements that affect PMS

Compliance with Treasury oversight and requirements under delegated disbursing authority

C.2. SCOPE OF IDIQ

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in each task order.

The services contemplated under this contract will be identified in each Task Order, the first of which addresses “Operations & Maintenance (O&M)” and related activities. Any subsequent Task Order will be awarded as necessary and will identify the combination of services required.

Potential future Task Orders may include (but are not limited to):

1. Work required to maintain compliance with new policy or regulatory changes issued by the Federal government, or the Department of Health and Human Services

2. The migration of the PMS application to a cloud-based platform

3. Expanding the use of data analytics

4. The implementation of Robotic Process Automation (RPA)

5. Expanding the use of WebServices technology

6. The implementation of enhanced cybersecurity monitoring tools and technology

See Section H.1 for subsequent task order procedures.

C.2.1 Project Management

C.2.1.1 The contractor shall establish Project Management standards that shall be delivered throughout the period of performance of the contract for all services. These standards consist of the following:

C.2.1.2 Project management standards and industry /government leading practices shall be expected of all tasks performed by the contractor.

Due to the FISMA HIGH rating of the PMS application, a proposed Project Manager with an existing certified Six Sigma Green Belt (or higher) and/or Project Management Professional (PMP) is preferred.

C.2.1.3 The contractor shall be required to develop and adhere to a Project Management Plan that incorporates policies, standards and concepts to the delivery of all the services and operations under this Statement of Work. The contractor shall incorporate industry and government leading practices

RFP#75P00120R00052 Page 9 of 92 to develop and adopt a project management model that the contractor shall use throughout the period of performance. The Project Management Plan shall include but is not limited to a Scope Management Plan, a Quality Management Plan, a Communication Management Plan, and a Risk Management Plan. The Project Management Plan shall be routinely reviewed and tasks will be prioritized by the Federal PMS team.

C.2.1.4 The contractor shall be required to adopt and adhere to HHS’s Enterprise Performance Life Cycle (EPLC) plan which incorporates policies, standards and concepts, which shall apply to all software development and coding activities delivered under this Statement of Work.

The Department of Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) is a framework to enhance Information Technology (IT) governance through rigorous application of sound investment and project management principles and industry’s best practices. The HHS EPLC provides the context for the HHS IT governance process and describes interdependencies between its project management, investment management, and capital planning components.

The goals of the EPLC framework are to:

Provide a coherent and effective methodology to guide HHS IT investment and project management to ensure that enterprise needs are met.

Promote the effective and consistent use of investment and project management principles and industry best practices to consistently deliver IT capabilities that provide maximum support to HHS business needs within approved cost and schedule baselines.

Enhance the HHS IT governance process by effectively integrating IT investment planning, execution, management, and oversight.

Ensure Critical Partner and stakeholder functions are performed throughout the life cycle of investments to include timely, effective multi-disciplinary reviews of IT investments and reports on them to the HHS IT Governance Bodies for their assessment of investments within the context of the HHS enterprise-wide IT portfolio.

C.2.1.5 The contractor shall be required to develop and adhere to an Information Technology Service Management plan which incorporates policies, standards and concepts which shall apply a customer-centered focus to the delivery of the information technology services and operations under this Statement of Work. The contractor shall incorporate industry and government leading best practices to develop and adopt a service delivery model, which the contractor shall use throughout the period of performance.

C.2.1.6 The contractor shall conduct an assessment of the existing PMS change control process including the existing change control board and provide recommendations regarding the change

RFP#75P00120R00052 Page 10 of 92 control process. Recommendations shall include any industry and governmental leading best practices as well as operational and process efficiency opportunities. Upon review and acceptance of any recommendations the contractor shall implement such changes.

C.2.1.7 The contractor shall submit a detailed Project Work Plan (PWP) of their technical approach of how they shall accomplish the support for the work being described within the Task Order. The Plan is to be developed using Microsoft Project, however, the PSC may change the project management software in use if PSC standards change. The contractor shall have 90 days to convert if the standards change. The PWP shall follow the steps below:

a) The PWP shall show all the components scheduled with major milestones and target dates.

b) Incorporate Communications Plan into PWP to assist HHS Leadership to prepare stakeholders for the expected change with regard to new programs, enhanced functionality etc. and identify resulting impact on process owners’ roles and responsibilities.

c) Periodic updates of the PWP as requested and coordinated with the COR.

d) Provide Earned Value Management reports on all enhancements, upgrades and implementation of new programs.

C.2.1.8 The contractor shall provide a written weekly status report to the COR and conduct a weekly status meeting with the COR and/or the Information Systems Branch Chief or his/her designee(s). This status report shall include at a minimum: a review of activities completed in the previous week, the activities scheduled for the previous week but not completed, the activities scheduled for the coming week, any identification of issues, risk assessments along with recommended solutions, and contractor staff availability (e.g. scheduled leave) over the coming 60 days. The COR may include any other personnel (governmental or non-governmental) in the weekly status report and meeting as per their discretion. The COR may request additional details as necessary to monitor and track progress and resources. The contractor shall take meeting minutes during the weekly status report and provide them to the COR.

C.2.1.9 Other contractors may be performing other PSC/PMS support services in areas associated with the requirements of this contract.

The Government shall facilitate initial contact between the contractor and other contractors. The contractor shall provide all further required coordination with other contractor personnel for any component specified in this contract that relates to or impacts any other contracted work.

It is expected that other PSC, FMP or Payment Management Services contractors may at times review work performed under individual Task Orders awarded under this IDIQ, and provide advice and consultation to facilitate the successful implementation of a specific project.

RFP#75P00120R00052 Page 11 of 92

C.2.2 General Assumptions

C.2.2.1 The contractor shall utilize all existing PSC/FMP systems, tools, standards and processes for systems documentation, configuration management, change management, code version control and migration.

C.2.2.2 The contractor shall be responsible for transferring PMS application functionality knowledge to the PMS users especially around new releases and /or at the time of new hires as per the direction of the COR. This includes the development and maintenance of training material. The contractor shall provide ongoing training workshops to new and current users regarding system configuration and procedures as requested with supporting documentation. Similarly, the contractor shall be required to provide training and / or knowledge transfer workshops to PSC personnel (upon COR’s request) to optimize processes and procedures for running and troubleshooting the applications.

C.2.2.3 The contractor shall plan, schedule and conduct the weekly Change Control Board (CCB) meeting. This includes preparing and publishing the meeting agenda, taking meeting minutes, documenting action items, recording votes, and distributing all related communications.

C.2.2.4 The contractor shall maintain the Services written Standard Operating Procedures (SOP).

These SOP includes the daily processes as well as the month-end, quarter-end and year-end processes.

C.3 INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

REQUIREMENTS

Information Security is applicable to this solicitation and the following information is provided to assist in proposal preparation.

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including subcontractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational and technical safeguards needed to protect the confidentiality, integrity and availability of a Federal information system and its information.

The Statement of Work (SOW) requires the successful offeror to (1) develop, (2) have the ability to access information from, or (3) host and/or maintain a Federal information system(s). Pursuant to Federal and HHS Information Security Program Policies the following requirements apply:

RFP#75P00120R00052 Page 12 of 92

Reference: Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002);

http://csrc.nist.gov/policies/FISMA-final.pdf

(a) Information Type

[X] Administrative, Management and Support Information:

[X] Mission Based Information:

(b) Security Categories and Levels

Confidentiality Level: [ ] Low [ ] Moderate [X] High

Integrity Level: [ ] Low [ ] Moderate [X] High

Availability Level: [ ] Low [ ] Moderate [X] High

Overall Level: [ ] Low [ ] Moderate [X] High

(c) Position Sensitivity Designations

Prior to award, the Government will determine the position sensitivity designation for each contractor (including subcontractor) employee that the successful offeror proposes for work under the contract. For proposal preparation purposes, the following designations apply:

[X] Level 6: Public Trust - High Risk (Requires Suitability Determination with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

[ ] Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non Sensitive (Requires Suitability Determination with an NACI). Contractor employees assigned to a Level 1 position are subject to a National Agency Check and Inquiry Investigation (NACI).

Upon award, the contractor will be required to develop and submit a roster of all staff (including subcontractor staff) working under the contract who; have the ability to access information from, or host and/or maintain a federal information system(s). The Government will determine and notify the Contractor of the appropriate level of suitability investigation required for each staff

RFP#75P00120R00052 Page 13 of 92 member. An electronic template, “Roster of Employees Requiring Suitability Investigations,” is available for contractor use at: http://ais.nci.nih.gov/forms/Suitability-roster.xls

Upon receipt of the Government’s notification of applicable Suitability Investigations required, the contractor shall complete and submit the required forms within 30 days of the notification.

Contractor/subcontractor employees who have met investigative requirements within the past five years may only require an updated or upgraded investigation.

(d) Information Security Training

HHS policy requires contractors/subcontractors receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements.

The successful offeror will be responsible for assuring that each contractor/subcontractor employee has completed the HHS Computer Security Awareness Training course and any other security training required by the Department prior to performing any contract work, and thereafter completing the HHS-specified fiscal year refresher course as required during the period of performance of the contract. The successful offeror shall maintain a listing of all individuals who have completed this training and shall submit this listing to the Project Officer.

Additional security training requirements commensurate with the position may be required as defined in NIST Special Publication 800-16, Information Technology Security Training Requirements (http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf). This document provides information about information security training that may be useful to potential offerors.

(e) Rules of Behavior

The contractor/subcontractor employees shall comply with the HHS Information Technology General Rules of Behavior

(f) Personnel Security Responsibilities

Contractor personnel will comply with the federal Standards of Conducts and Ethical behavior when executing duties under the terms of this award. Contractor personnel will comply with successful completion of all required training. The contractor shall provide the required documentation identified by the Department and/or sub-agency in advance of any contractor/subcontractor employee that terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

(g) Commitment to Protect Non-Public Departmental Information Systems and Data

RFP#75P00120R00052 Page 14 of 92

(1) Contractor Agreement

The Contractor and its subcontractors performing under this SOW shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

-18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

-18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

-Public Law 96-511 (Paperwork Reduction Act)

(2) Contractor-Employee Non-Disclosure Agreements

Each contractor/subcontractor employee who may have access to non-public Department information under this contract shall complete the Commitment to Protect Non-Public Information - Contractor Agreement. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under the contract.

(h) NIST SP 800-26 Self-Assessment Questionnaire

The contractor shall annually update and re-submit its Self-Assessment Questionnaire required by NIST Draft SP 800-26, Revision 1, Guide for Information Security Program Assessments and System Reporting Form. [Reference questionnaire format to be used in http://csrc.nist.gov/publications/drafts/Draft-sp800-26Rev1.pdf. See Appendix B for format.

Subcontracts: The contractor’s annual update to its Self-Assessment Questionnaire shall include similar information for any subcontractor that performs under the SOW to (1) develop a Federal information system(s) at the contractor’s/subcontractor’s facility, or (2) host and/or maintain a Federal information system(s) at the contractor’s/subcontractor’s facility.

The annual update shall be submitted [For option contracts: no later than the completion date of the period of performance/for all other contracts: indicate due date as determined by the Project Officer/Contracting Officer].

(i) References

(1) Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002);

http://csrc.nist.gov/policies/FISMA-final.pdf

(2) HHS Personnel Security/Suitability Handbook: http://www.hhs.gov/ohr/manual/pssh.pdf

(3) NIST Special Publication 800-16, Information Technology Security Training Requirements:

RFP#75P00120R00052 Page 15 of 92 http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf Appendix A-D:

http://csrc.nist.gov/publications/nistpubs/800-16/AppendixA-D.pdf

(5) NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems: http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

(6) NIST SP 800-26, Revision 1, Computer Security:

http://csrc.nist.gov/publications/drafts/Draft-sp800-26Rev1.pdf

(7) NIST SP 800-53, Revision 4, Recommended Security Controls for Federal Information Systems:

http://csrc.nist.gov/publications/nistpubs/index.html

(8) NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I: http://csrc.nist.gov/publications/nistpubs/800-60/SP800-60V1-final.pdf;

Volume II, Appendices to Guide For Mapping Types of Information and Information Systems To Security Categories, Appendix C at http://csrc.nist.gov/publications/nistpubs/800-60/SP800- 60V2-final.pdf and Appendix D at http://csrc.nist.gov/publications/nistpubs/800-60/SP800- 60V2-final.pdf.

(9) NIST SP 800-64, Security Considerations in the Information System Development Life Cycle:

http://csrc.nist.gov/publications/nistpubs/800-64/NIST-SP800-64.pdf

(10) FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

(11) FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

C.4 Article H: Access to HHS electronic mail

All contractor staff that have access to and use of HHS electronic mail (e-mail) must identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the contractor staff shall set up an e-mail signature ("AutoSignature") or an electronic business card ("V-card") on each contractor employee's computer system and/or Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent.

RFP#75P00120R00052 Page 16 of 92

C.5 Confidential Treatment of Sensitive Information

The contractor shall guarantee strict confidentiality and nondisclosure of the information/data that it is provided by the Government during the performance of the contract. The Government has determined that the information/data that the contractor will be provided during the performance of the contract is of a sensitive nature.

Disclosure of the information/data, in whole or in part, by the contractor can only be made after the Contractor receives prior written approval from the Contracting Officer. Whenever the contractor is uncertain with regard to the proper handling of information/data under the contract, the contractor shall obtain a written determination from the Contracting Officer.

C.6 Performance Metrics

The contract will contain the following performance standards and expectations:

Performance Standards

Quality Expectations

Completeness All submissions will be complete and compliant with all applicable regulations.

Accuracy All information submitted will be accurate.

Effectiveness All deliverables must contribute to the overall success of the contract.

Timeliness All deliverables will be on time and within Schedule.

Cost All work will be performed within the funding limit provided in contract.

Detailed Performance Metrics will be developed for each individual Task Order.

C.7 Acronyms:

ACH – Automated Clearing House ADA – Anti-Deficiency Act ARRA – American Recovery and Reinvestment Act AS – Accounting Services (PSC) BTO – Business Technology Officer CAS – Cost Allocation Services (PSC) C&A – Certification and Accreditation CCB – Change Control Board CFO – Chief Financial Officer CGI – Common Gateway Interface CO – Contracting Officer

RFP#75P00120R00052 Page 17 of 92

COR – Contracting Officer’s Technical Representative COOP – Continuity of Operations COTS – Commercial Off The Shelf CIP – Critical Infrastructure Planning CIT – Center for Information Technology DHHS – Department of Health and Human Services DISA – Defense Information Systems Agency DMZ – A buffer zone that separates the internal network from the Internet EA – Enterprise Architecture EVM – Earned Value Management FAADS – Federal Assistance Award Data Source FARS – Financial Analysis and Reporting System FFATA – Federal Funding Accountability and Transparency Act FFMIA – Federal Financial Management Improvement FFR – Federal Financial Report FIPS – Federal Information Processing Standards FISMA – Federal Information Security Management Act FMFIA – Federal Managers Financial Integrity Act FMS – Financial Management Service FTP – File Transfer Protocol GRMA – Government Management Reform Act IGE – Independence Government Estimate IPIA – Improper Payments Information Act ISSO – Information Systems Security Officer HTML – Hyper-text Markup Language NAIC – National Agency Check and Inquiry NIH – National Institutes of Health NIST – National Institute of Standards and Technology O&M – Operations & Maintenance OCI – Organizational Conflict of Interest OLAP – On-Line Analytical Processing OMB – Office of Management and Budget PMP – Project Management Professional PMS – Payment Management System PO – Project Officer POA&M – Plan of Action and Milestones PSC – Program Support Center PPA – Prompt Payment Act PPIRS – Past Performance Information Retrieval System PWP – Project Work Plan RDBMS – Relational Database Management System SAB – Systems Accounting Branch SAS – Statement on Auditing Standards SCR – System Change Requests SDLC – Systems Development Life Cycle Services – Payment Management Services (PSC)

RFP#75P00120R00052 Page 18 of 92

SF 1199 form – Direct Deposit Sign-Up Form SME – Subject Matter Experts SPS – Secure Payment System SSA – Source Selection Authority SSEB – Source Selection Evaluation Board ST&E – Security Testing Evaluation STIG – Security Technical Implementation Guides T&M – Time and Materials TT&E – Tests, Training and Exercises UFMS – Unified Financial Management System VPN – Virtual Private Network

C.8 KEY PERSONNEL AND WORK-SITE

With the exception of emergency and /or off-hours support, Key Personnel shall perform all services on-site unless specific approval is provided by the CO, COR, or their designated representative.

Contractor staff will be required to use government issued computers for work performance related to this contract. Contractor will need to provide accommodations to all remaining personnel not identified as Key Personnel. Each individual assigned to a Task Order will be required to pass a background investigation and upon a favorable adjudication will be issued a government smart card in accordance with HSPD-12 directives and provisions.

The contractor shall assign Key Personnel to the Government work-site, currently located in Bethesda, Maryland, as per requirements from the COR.

HHS/PSC/FMS/Division of Payment Management Bethesda Place, 10th Floor 7700 Wisconsin Avenue Bethesda, MD 20814

In the event that HHS, PSC, FMP, or the Services relocates to any other work site within the Washington DC metro area (which includes surrounding counties in Maryland and Virginia), the contractor shall participate in relocation efforts related to contractor staff activities and shall perform all services required on-site at the new location.

In the event of any disruption to normal operations, the contractor will be required to execute duties at alternate work locations assigned under the Continuity of Operations Plan (COOP). If travel outside of the Washington, DC, metro area is required due to a disruption to normal operations, the Contracting Officer may issue a modification to the Task Order to add funding if required. If travel is authorized in an individual task order, travel other than local travel must be pre-approved by the COR (or designee) and authorized by the Contracting Officer.

RFP#75P00120R00052 Page 19 of 92

The contractor Key Personnel shall perform the primary work effort at the Services’ office.

Other contractor personnel shall perform the primary work effort at contractor located offices, available for on-site performances at the Services’ office or COOP facilities on rare occasions.

C.9 REQUIREMENTS FOR PRIVACY ACT RECORDS

Applicable SORN number(s), or SORN to be developed: General Services Administration (GSA)/GOVT 9, System for Award Management, 09-90-0101 Health Care Program Violations (OIG), 09-90-0024, HHS Financial Management System Records (ASFR), 09-90-0025 Central Registry of Individuals Doing Business with HHS (ASFR).

Records disposition instructions:

At the end of contract performance, HHS will provide disposition instructions to the contractor for securely transferring or destroying (in accordance with NIST SP-800-88) any agency records that are in the contractor’s (or any subcontractor’s) custody or control.

C.10 ADDITIONAL HSPD-12 REQUIREMENTS

To perform the work specified herein, contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems. In addition to requirements stated elsewhere in this contract, the contractor shall comply with the following.

Contractor personnel subject to HSPD-12 credentialing requirements may not begin work requiring access to HHS facilities, information or information systems until codified credentialing standards are met and the HSPD12 badges have been issued.

The minimum Government investigation to receive an HSPD-12 PIV Credential is a Tier 1 (NACI), which consists of searches of records covering specific areas of a person’s background during the past five years. The minimum Government investigation to receive Elevated Privilege (any access beyond normal email or data entry) is a Tier 4 (BI High Risk Public Trust).

The contractor must comply with the instructions and timeframes provided by the Contracting Officer’s Representative (COR) regarding the handling of the security requirements specified in this section. Typically, each employee must submit at a minimum: a completed OF-306; a current resume; and a completed HHS 828 form. Additional requirements may apply to Foreign National Applicants who will follow a slightly different level of initial checks. Contractors should ensure that the employees whose names they submit have a reasonable chance for access approval. In some cases, employees with existing background investigations commensurate with sensitivity designations will expedite performance. Inquiries, including requests for forms and assistance, should be directed to the COR.

Typically, the Government investigates personnel at no cost to the contractor, but the expense of multiple investigations for the same position is difficult to justify. Consequently, multiple investigations for the same position may, at the Contracting Officer’s discretion, justify reduction(s) in the contract price of no more than the cost of the extra investigation(s).

RFP#75P00120R00052 Page 20 of 92

After final acceptance of the work specified herein or any employee departure, the contractor shall follow the COR’s instruction on the return of all identification badges, building access cards, Government Furnished Equipment, Government Furnished Data and Government Furnished Property (GFE/GFD/GFP) as applicable.

HHS reserves the right to suspend or withdraw access at any time for any reason.

Language similar to this Security section shall be included in any subcontracts which require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems.

C.11 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance. The oversight provided for in the contract and in the QASP will help to ensure that service levels reach and maintain the required levels throughout the contract term. Further, the QASP provides the COR with a proactive way to avoid unacceptable or deficient performance, and provides verifiable input for the Contractor Performance Assessment Reporting System (CPARS). The QASP may be updated by modification to the contract.

In lieu of the below QASP, the government may choose to submit a Task Order level QASP or request that the contractor submit a Task Order level QASP. The government will identify the specific request at the Task Order level.

Quality Assurance Surveillance Plan (QASP)

Required Services/Tasks

Performance Standards

Method of Surveillance (Quality Assurance)

Standard to be Met/ Allowable Deviation

Customer Satisfaction

Contractor complies with SOW specifications.

Contractor adheres to guidance provided by COR.

COR feedback

Fewer than 2 written complaints from COR during the period of performance.

Overall Contract Management, Including Timeliness

Contractor maintains high level of quality assurance.

Contractor informs COR timely of issues or problems.

Contractor meets time frames agreed upon.

COR and Contracting Officer monitoring and review of activities and deliverables.

COR makes no more than 2 valid written complaints during the period of performance. No more than a two week delay in agreed upon schedule.

Written Products

Contractor provides high-quality written materials.

COR and other federal

Minimal rewriting or editing required; product

RFP#75P00120R00052 Page 21 of 92 staff reviews of draft and final products.

utilized (e.g., disseminated) as planned.

C.12 SECTION 508 ACCESSIBILITY STANDARDS

The following Section 508 accessibility standards apply to the work to be performed:

To be completed in individual task orders, when applicable.

C.13 352.239-73 Electronic Information and Technology Accessibility

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR Part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit--

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

(b) Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility standards. Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/provisions.htm.

(c) All work to this solicitation is to be implemented 508 compliant. In order to facilitate the Government's evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific Section 508 accessibility standard. Instructions for preparing the HHS Section 508 Evaluation Template may be found under Section 508 policy on the HHS Office on Disability Web site (http://www.hhs.gov/od).

(d) Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 accessibility standards conformance, as well as for documenting EIT products or services that are incidental to the project, which would

RFP#75P00120R00052 Page 22 of 92 constitute an exception to Section 508 requirements. If a vendor claims its products or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 accessibility standards in its completed HHS Section 508 Product Assessment Template, and it is later determined by the Government--i.e., after award of a contract/order, that products or services delivered do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance specified in the vendor's Product Assessment Template will be the responsibility of the Contractor and at its expense.

RFP#75P00120R00052 Page 23 of 92

SECTION D - Packaging and Marking

D.1 PACKAGING AND MARKING

All deliverables shall be delivered to the Contracting Officer’s Representative (COR) identified in Section G and shall be marked as follows:

1. Name and address of the Contractor;

2. Contract Number;

3. Description of item contained therein; and

4. Consignee's name and address.

D.2 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information including forms, reports, etc. to the Contracting Officer or COR shall be paid by the Contractor.

RFP#75P00120R00052 Page 24 of 92

SECTION E - Inspection and Acceptance

E.1 INSPECTION AND ACCEPTANCE

Pursuant to FAR clause 52.212-4, all work described in Section C to be delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the Contracting Officer’s Representative (COR), who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

E.1.1 Inspection and Acceptance Criteria Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the place of delivery by the COR.

E.1.2 General Acceptance Criteria General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Statement of Work.

Accuracy - Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity - Work Products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements - All work products must satisfy the requirements of this

Statement of Work.

File Editing - All text and diagrammatic files shall be editable by the Government.

Format - Work Products shall be submitted in hard copy and electronic copy. The electronic copy must be in a format as indicated in the Deliverables Table.

E.2 52.252-2 CLAUSES INCORPORATED BY REFERENCE. (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.acquisition.gov/far/ and http://www.hhs.gov/hhsar/

FEDERAL ACQUISITION REGULATION (FAR) (48 CFR CHAPTER 1) CLAUSES

CLAUSE TITLE DATE IDIQ FFP

Task Order

T&M/ Labor Hour Task

Order 52.246-4 Inspection of…