SOW AE BPA12.13.2024.pdf

STATEMENT OF WORK

Architect and Engineering Technical Assistance

December 13, 2024

I. BACKGROUND

The Department of Health and Human Services (HHS), Health Resources and Services Administration (HRSA), requires contract support for Architect and Engineering (A/E) technical assistance and assisting with the reviews of federally assisted construction and modernization projects.

Historically, HRSA has received construction authority through a variety of laws and special appropriations including, but not limited to, the Health Centers Consolidation Act of 1996, the American Recovery and Reinvestment Act, and the Patient Protection and Affordable Care Act of 2010. Federal assistance has been provided through the form of grants, cooperative agreements, loans, congressionally directed spending, and loan guarantees, to public and non-profit entities providing a variety of health-related services. Administration of these programs requires contractor support services for assistance with A/E grant project management and architectural and engineering technical assistance.

II. PURPOSE

The purpose of this Blanket Purchase Agreement (BPA) is to obtain A/E services to perform program and A/E reviews. Additionally, the contractor shall perform outreach to award recipients and HRSA staff to ensure compliance with applicable federal statutes and regulations. The services shall augment HRSA’s capacity to review, monitor, ensure compliance with Federal laws, and provide technical assistance on construction-related projects, A/E documentation and related reviews for Federal construction-related assistance programs.

III. PERIOD AND PLACE OF PERFORMANCE

The BPA shall have one (1) 12-month base period with four (4) 12-month option periods.

The place of performance shall primarily be the contractor’s facility. Partnering meetings shall be held via teleconference. Partnering meetings may be held at HRSA offices at contractor’s request and approval by the Contracting Officer’s Representative (COR).

IV. SPECIFIC TASKS

Task 1.0: Federal Records Management

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

Task 1.1: Records and Information Regulation Guidelines

The contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Task 1.2 Records and Information Management

The contractor shall manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C.

Chapters. 21, 29, 31, 33); 36 CFR § 1236.20What are appropriate recordkeeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013- 02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010- 05.html), Guidance on Managing Records in Cloud Computing Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

Task 2: Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2023recordsmanagement/01_index.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the COR of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

Task 3: Kick-Off Meeting

The contractor shall participate in an initial meeting with the HRSA Contracting Officer (CO), Call Order COR, and designated HRSA officials within 14 business days from the effective date of BPA Call Orders (if needed) to discuss the general requirements under the BPA Call Orders such as: relevant background information; review requirements of the BPA Call Order; items to be delivered and delivery schedule;

goals and objectives; processes; periods; and priorities. Contractor to provide meeting minutes within three (3) business days following the meeting.

Task 4: Training

The contractor shall:

a) Complete HRSA-led training pertaining to programmatic and grant eligibility requirements and standard operating procedures for conducting reviews listed under Task 10 – Program and A/E http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhumancapital.learning.hhs.gov%2Fcourses%2F2023recordsmanagement%2F01_index.html&data=05%7C01%7CJWerner%40hrsa.gov%7C45b0bdeed6aa4f2128c208dbe5e27637%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638356533039422625%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=u9aeP0drZTq0%2Bxnr%2BpfwR%2FvLqbP5jwJbwKEt9qH32SU%3D&reserved=0

Technical Review Assistance. Training sessions will be scheduled at a time convenient for HRSA and last two (2) hours. Training sessions will be conducted once per topic area. Contractors are responsible for informing staff that were unable to participate.

b) Complete mandatory training for All Contractor Staff. All contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/HRSA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/HRSA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

c) Training Records. The contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. The training records shall be provided to the CO and/or COR within 30 days after the first BPA Call Order issued in each period of performance and annually thereafter or upon request.

d) Rules of Behavior

1. The contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, the HRSA Information Technology Rules of Behavior (included in the HRSA Information Security and Privacy Awareness Training), and any applicable system-level rules of behavior.

2. All contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HRSA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

Task 5: Status Meetings

The contractor shall:

Participate in status teleconferences, as scheduled by the COR, with the COR and other designated HRSA officials to discuss current activities, questions and answer session, and provide status updates. Status meetings will last 30 minutes. Meeting minutes to be provided by the contractor within three (3) business days following the meeting.

Task 6: Monthly Status Reports

The contractor shall:

Submit monthly status reports to the COR as ordered, reporting on all BPA Call Orders that are active.

The monthly status reports shall enable for consolidated data reviews, review of work assigned, completed and in progress, relate work completed and invoices submitted, and include a graphic depiction showing the BPA Call Order quantities and usage. The contractor shall only submit monthly status reports in the quantity ordered in the call order(s).

Task 7: Technical Review Progress Reports

a) Provide progress reports for technical reviews completed for each grant that includes the following:

1. Progress reports consist of a brief paragraph not to exceed (NTE) 100 words summarizing the information for each grant specific progress report. This includes review of project progress report submissions and identifying potential issues. Potential issues include: problems in meeting condition of award; changes to project scope; significant changes in budgets; changes in site;

construction schedule slippage; unallowable project costs; and draw down status.

A determination of the risk of the grant specific progress report. The report should include:

drawdown analysis; project completion status; a summary of project narrative; project budget; and status of project closeout and grant closeout. Note: a drawdown analysis will be performed by comparing the drawdown percentage shown in the HHS Payment Management System (PMS) report provided by HRSA at the time of the reviews.

Questions, issues, or deficiencies with the grant award during the course of technical monitoring.

Reports should note the risk level and recommendations for more frequent technical assistance.

2. Progress reports are reviewed on a semi-annual or quarterly basis each year. A report showing the progress reports completed shall be submitted on a weekly basis during the reviewing period of the progress reports and shall be submitted in a Microsoft Excel format. All information from the progress report shall be captured in the weekly report.

Task 8: Project Management Plan

a) Document their project management approach in a Project Management Plan (PMP) for the

Government’s review and approval. The PMP shall adhere to the following standards:

1. The PMP shall be comprised of an Executive Summary and (4) four areas: Staffing Plan; Training Plan;, Quality Control Plan; and Monitoring and Reporting.

2. The contractor’s final PMP shall be submitted to the COR within 30 days of initial BPA Call

Order in each Base or Option Period.

3. A PMP shall cover a 12-month period and include information for multiple BPA Call Orders.

4. The COR must approve the PMP and all changes to the PMP.

5. If changes occur that have an impact on the PMP then the PMP shall be updated. A maximum of two (2) updates per 12-month period are allowed. Updates to the PMP shall be submitted to the COR within 30 days of the granted security clearance.

Task 9: Partnering Meetings

a) Participate in partnering meetings that shall be held to discuss new funding opportunities, review processes, answer questions, or discuss the status of reviews in progress. Partnering meetings shall be scheduled by the COR as needed, via teleconference and will last no longer than (NLT) 1.5 hours.

Partnering meetings shall be held at the Government’s discretion for in depth conversations related to new funding opportunities and/or general discussion of review processes. During these meetings, the contractor shall be prepared to present briefings to the COR and other designated HRSA personnel on the status of BPA Call Orders that have been awarded against this BPA. Partnering meetings shall be held via teleconference. Contractor shall provide meeting minutes within three (3) business days of the meeting.

Task 10: Program and A/E Technical Review Assistance

a) Complete the reviews annotated below in this SOW and identify if applications and submissions meet all programmatic and grant eligibility requirements. Technical reviews will identify problems, but not generally advise the applicant as to how to solve the problem. Reviews include communication required to answer questions, obtain clarifications from HRSA or the award recipient, and complete program reviews. Reviews can include direct contact with the award recipient as needed to resolve issues. The contractor shall adhere to the following communication and meeting procedures:

1. Ensure the COR and Project Officer (PO) (or PO equivalent) are carbon copied (cc’d) on all email communications regarding the technical review submissions.

2. Ensure the COR is contacted via email regarding contract tasks.

3. Invite the COR and PO to teleconference meetings that are held with award recipients.

4. Note any direct communication with award recipients in the Electronic Handbook System (EHB) review comments for each task.

5. Utilize the EHB for the purpose of performing Technical Reviews and Technical Assistance work.

Contractor is responsible for maintaining active status in the HRSA security systems and EHB for each contracted staff.

Task 10.1: Scoping A/E Project Technical Review

a) Perform scoping A/E project technical reviews within three (3) business days of notification by HRSA of the availability of the technical reviews. Information shall be entered into the EHB. If the grant application is not in EHB, the contractor will be emailed an electronic document to fill out and email to the HRSA contact. If a grant application includes more than one service delivery site, then each independent delivery site will be regarded as one distinct Project Technical Review. Technical reviews will contain the following project-level application and submission documentation:

1. Budget and budget justification;

2. Allowable and unallowable costs per program guidance;

3. Consistency between budget narrative, project description, schematic drawings, and site plan;

4. Equipment list correctly categorized;

5. Reasonableness of schedule, and ability to mitigate delays;

6. Project management team experience;

7. Applicant’s knowledge of A/E and ability to complete on-time and within budget on submitted application;

8. Schematic drawings and site plan for sufficient detail and consistency with project scope in submitted narrative;

9. Application for proper categorization of type of project (equipment only, construction, or alteration & renovation);

10. Provide cost per square footage, abbreviated project description, and recommendations.

b) Perform a back check of the pre-award A/E project technical review done in item 10.1(a) within two

(2) business days of notification by HRSA of the availability of the technical reviews.

Information shall be entered into the EHB. If the grant application is not in EHB, the contractor will be emailed an electronic document to fill out and email to the HRSA contact. If a grant application includes more than one service delivery site, then each independent delivery site will be regarded as one distinct Project Technical Review. Technical reviews will contain the following project- level application and submission documentation:

1. Budget and budget justification;

2. Allowable and unallowable costs per program guidance;

3. Consistency between budget narrative, project description, schematic drawings, and site plan;

4. Equipment list correctly categorized;

5. Reasonableness of schedule, and ability to mitigate delays;

6. Project management team experience;

7. Applicant’s knowledge of A/E and ability to complete on-time and within budget on submitted

8. Schematic drawings and site plan for sufficient detail and consistency with project scope in submitted narrative;

9. Application for proper categorization of type of project (equipment only, construction, or

10. Provide cost per square footage, abbreviated project description, and recommendations.

Task 10.2: Implementation & Close Out Submission Technical Review

Review each type of submission, determine whether each submission is in conformance with requirements and align to the approved scope of work, and provide the COR with review comments and a recommendation for action within three (3) business days from the date of notification by HRSA of the availability of the submission. In the implementation period, the contractor shall:

1. Conduct Submission Review – implementation activities using the information provided within

EHB.

2. Complete the review of each submission and provide the review comments to the COR and PO for review and approval in EHB.

3. Review can include direct contact with the award recipient as needed to resolve issues. The review must contain the recommended action for the submission (i.e., acceptance with justification, or recommendation to return to award recipient with the information and/or corrections to include in the resubmission). It is understood that if resubmission(s) is/are needed the contractor will review the resubmission(s) under the same task and a new task will not be created. The task will be completed only when a complete and acceptable submission has been submitted and sent to HRSA for the final review.

4. Submissions are inclusive of conditions of award and reporting requirements which shall include the following:

a. Major Submission Reviews

• Revised Project-Specific Budget/Budget Justification (to include SF-424C, budget justification, and Equipment List if applicable)

• Revised Schematic Drawings

• Final Budget Information (to include SF-424C, budget justification, and Equipment List if applicable)

b. Minor Submission Reviews

• Project Implementation Certification.

• Revised Project Timeline

• Project Completion Certification (to include Certificate of Occupancy and Certificate of

Substantial Completion for construction projects).

• Photographs.

Task 10.3: Project Changes Technical Review (Capital Update Prior Approval)

a) Perform A/E technical reviews related to project changes to funded projects requiring submission of a capital update prior approval in EHB. These reviews shall be completed within five (5) business days of notification by HRSA of the availability of the technical review. Reviews can include direct contact with the award recipient as needed to resolve issues. If a grant application includes more than one service delivery site, then each independent delivery site will be regarded as one distinct Project Changes Technical Review. These technical reviews will contain the following project-level application and submission documentation:

1. Review of revisions to application cover page;

2. Budget and budget justification;

3. Allowable and unallowable costs per program guidance;

4. Consistency between budget narrative, project description, schematic drawings, and site plan;

5. Equipment list correctly categorized;

6. Reasonableness of schedule, and ability to mitigate delays;

7. Project management team experience;

8. Applicant’s knowledge of A/E and ability to complete on-time and within budget on submitted

9. Schematic drawings and site plan for sufficient detail and consistency with project scope in submitted narrative;

10. Application for proper categorization of type of project (equipment only, construction, or

11. Provide cost per square footage, abbreviated project description, and recommendations; and

12. Summary that includes description of project changes from previously approved project to revised project.

Task 10.4: Project Re-budgeting Technical Review

a) Perform post-award A/E technical review related to significant changes to the funded project budget requiring submission of a re-budgeting prior approval in EHB. These reviews shall be completed within five (5) business days of notification by HRSA of the availability of the technical review. Technical reviews will contain the following project- level application and submission documentation:

1. Review of revisions to budget and budget justification as compared to the last approved information for the project;

2. Review of the scope of construction related work as compared to the last approved information on the project;

3. Allowable and unallowable costs per program guidance;

4. Consistency between budget narrative, project description and equipment list;

5. Equipment list correctly categorized

6. Proper categorization of type of project (equipment only, construction, or alteration & renovation); and

7. Provide cost per square footage and recommendations, including a summary of major changes to the project costs.

Task 11: Security and Privacy

a) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

1. Access (Physical or Logical) to Government Information: A contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

2. Operate a Federal System Containing Information: A contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b) Safeguarding Information and Information Systems. In accordance with the Federal Information

Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the contractor (and/or any subcontractor) shall:

1. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

2. Provide security for any contractor systems, and information contained therein, connected to an HHS network, or operated by the contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

3. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the contractor is responsible under this contract or to which the contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

4. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

c) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution. Also see the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

d) Confidentiality and Nondisclosure of Information. Any information provided to the contractor

(and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the contractor. Each contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

1. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

2. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

3. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

e) Contractor Non-Disclosure Agreement (NDA). Each contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete mailto:fisma@hhs.gov the HRSA non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

f) Incident Response

Federal Information Security Modernization Act (FISMA) defines an incident as “an occurrence that

(1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the contractor (and/or any subcontractor), the contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2. NOT notify affected individua ls unless so instructed by the CO or designated representative. If so instructed by the CO or representative, the contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

3. Report all suspected and confirmed information security and privacy incidents and breaches to the

HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable

Information, HHS, and HRSA incident response policies when handling PII breaches.

5. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

g) Position Sensitivity Designations

1. All contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

T2S Moderate Risk Background Investigation.

h) Homeland Security Presidential Directive (HSPD)-12

The contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at https://www.dhs.gov/home land-security-presidential-directive-12

i) Roster

The contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR, with a copy to the CO, within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 14 days of the change. If changes include new staff that require a security clearance, then the roster shall be submitted within 14 days after granted security clearance. The COR will notify the contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the contractor shall provide a position description and the Government will determine the appropriate suitability level.

j) Contract Initiation and Expiration

General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately http://www.dhs.gov/home protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

HHS EA requirement may be located here:

HHS Policy for Enterprise Architecture (EA) | HHS.gov

1. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

2. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

3. Notification. The contractor (and/or any subcontractor) shall notify the CO and/or COR within 10 days before an employee stops working under this contract.

4. Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the contractor shall provide a certification that all government information has been properly sanitized and purged from contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

5. The contractor (and/or any subcontractor) shall perform and document the actions identified in the

HRSA Contractor Employee Separation Checklist when an employee terminates work under this contract within 10 days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

V. SCHEDULE OF DELIVERABLES

Section 508 requires that all external public facing content and non-public facing official agency communications be accessible. Regardless of format, all digital content or communications materials produced as deliverables under this contract must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities.

The contractor shall complete and submit the applicable HHS Section 508 Accessibility Compliance Checklist per Section 508 deliverable. The checklist will serve as an artifact declaration of the Section 508 deliverable's compliance. Remediation of any Section 508 deliverables that do not comply with the applicable requirements as set forth below shall be the contractor's responsibility. HHS guidance and https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.hhs.gov%2Fweb%2Fgovernance%2Fdigital-strategy%2Fit-policy-archive%2Fhhs-policy-for-enterprise-architecture.html&data=05%7C02%7CJWerner%40hrsa.gov%7C04055428fc0a498798a708dd1b9a9c4e%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638697073330579100%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2FIXeyxZdWXTw8kdRQNAwweqqtyrHsQ7Fka85Q%2F6MSVc%3D&reserved=0 checklists regarding accessibility of documents can be found at https://www.hhs.gov/web/section- 508/accessibility-checklists/index.html.

ITEM DESCRIPTION QUANTITY DUE DATE FORMAT SUBMIT TO

1 Federal Records Management Training.

Provide Records Management training completion certificates.

(Section IV, Task 2)

One (1) per contractor employee performing work under BPA Call Orders.

Federal Records Management Training due within 30 days after contract award and upon new staff onboarding and thereafter completing the annual refresher course during the life of the contract

PDF Email to

COR.

2 Kick-off Meeting (Section IV, Task 3)

One (1) per BPA Call Order (as needed)

Meeting held within 14 days of effective date of BPA Call Order;

Minutes within three (3) days of meeting.

PDF Email to

COR.

3 HRSA Led Training (Section IV, Task 4.a)

As scheduled by COR.

Training held at time requested by

COR.

Virtual Training

Email to COR with participants.

4 Training Certificates

(HHS/HRSA

Contractor Information Security Awareness, Privacy, and Records Management Training Certificate & Rules of Behavior Training Certificate).

(Section IV, Task 4.b, c, d).

One (1) certificate per training completed per contractor employee performing work under BPA Call Orders.

The training records shall be provided to the CO and/or COR within 30 days after the first BPA Call Order issued in each period of performance and annually thereafter or upon request.

Online training, PDF certificates.

Email to the

COR.

5 Status Meeting.

(Section IV, Task 5)

As scheduled by COR.

Meeting Minutes within three (3) days of Status Meeting

PDF Email to COR.

6 Monthly Status Report. (Section IV, Task 6).

One (1) per month after BPA Call Order.

Monthly Status Report due within five (5) business days after end of calendar month.

PDF Email to COR.

https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html

7 Technical Review Progress Report.

(Section IV, Task 7.a).

One (1) per BPA Call Order Award as assigned.

Due within 15 business days after assignment by HRSA.

Task completed in EHB.

Submitted in

EHB.

8 Technical Review Progress Report.

(Section IV, Task 7.b).

One (1) per week during progress reporting period;

includes all assigned awards during that period.

Due weekly;

within 15 business days after assignment by HRSA.

Microsoft Excel file

Email to COR.

9 Project Management Plan (PMP). (Section IV, Task 8).

One (1) per 12 month period. Max of two (2) updates per 12 month period.

PMP due within 30 days of BPA Call Order Award.

Updates due within 30 days of changes.

Microsoft Word document

Email to COR.

10 Partnering Meeting.

(Section IV, Task 9).

As scheduled by COR.

Meeting Minutes due within three

(3) business days of meeting.

PDF Email to COR.

11 Scoping A/E Project Technical Review.

(Section IV, Task 10.1(a)).

One (1) per review.

Scoping A/E Project Technical Review due within three

(3) business days of notification by HRSA of the availability of a review.

Information to be entered into EHB.

Information to be entered into EHB.

12 Scoping A/E Project Technical Review Back Check. (Section IV, Task 10.1(b))

One (1) per review.

Back Check of Scoping A/E Project Technical Review due within two (2) business days of notification by HRSA of the availability of a review.

Information to be entered into EHB.

Information to be entered into EHB.

13 Major Submission Review.

(Section IV, Task 10.2.a).

One (1) per review.

Review due within three

(3) business days of notification by HRSA of the availability of a submission.

Information to be entered into EHB.

Information to be entered into EHB.

14 Minor Submission Review.

(Section IV, Task 10.2.b).

One (1) per review.

Project Completion Certification for Construction Projects due with three (3) business days of notification by HRSA of the availability of a submission.

Information to be entered into EHB.

Information to be entered into EHB.

15 Capital Updates. (Section IV, Task 10.3).

One (1) per review.

Capital Updates due within five (5) business days of notification by HRSA of the availability of a submission.

Information to be entered into EHB.

Information to be entered into EHB.

16 Project Re- budgeting Technical Review.

(Section IV, Task 10.4).

One (1) per review.

Post-Award Project Re-budgeting Technical Review due within five (5) business days of notification by HRSA of the availability of a review.

Information to be entered into EHB.

Information to be entered into EHB.

17 Non-Disclosure Agreement (Section IV, Task 11.e)

One (1) per contractor employee performing work.

After BPA Call Order Award and prior to commencing work.

PDF Email to COR.

18 Incident Response (Section IV, Task 11.f)

One (1) per issue reported.

Within one (1) hour.

In any medium or form, HRSA

Security Operations including paper, oral, or electronic.

Center

(SOC), COR,

CO, HRSA

SOP (or designee).

19 Position Sensitivity Designations (Section IV, Task 11.g)

One (1) per employee.

Prior to work start by personnel.

PIV Card obtained

Confirmation delivered to COR via email.

20 Roster.

(Section IV, Task 11.i)

One (1) per Call Order.

Within 14 days of BPA Call Order Award and updated as needed.

Word Document or PDF

Delivered to COR via email.

21 Contract Initiation and Expiration (Section IV, Task 11.j)

One (1) per Call Order

At close out of Call Order

Word Document or PDF

Delivered to COR via email.

VI. PAYMENT SCHEDULE

This is a Firm Fixed Price BPA. Payment schedules will be provided with BPA Call Orders. See the Price Schedule for details on BPA pricing.

BPA call orders will be placed using BPA Call Orders and the BPA Call Order Form.