A.19 Solicitation.docx

2 RFP # 75D301-22-R-72357

RFP Table of Contents:

SECTION A DESCRIPTION OF THE REQUIREMENT

(1) Description

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. The Centers for Disease Control and Prevention intends to award a FIRM-FIXED-PRICE contract type for the requirement.

(ii) The solicitation number is 75D301-22-R-72357. The solicitation is issued as a Request for Proposals (RFP).

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2022-06 effective 05/26/2022.

(iv) This procurement has been designated a Full & Open competed under NAICS 541380– Testing Laboratories.

(v) See Section B of this solicitation for contract line item number structure.

(vi) See Section C for the Performance Work Statement. This procurement is for commercial collection, testing, and genetic sequencing of biological samples (e.g. nasal and saliva) from international travelers’ arriving in the United States, and aircraft wastewater testing and sequencing to detect SARS-CoV-2variants in aircraft wastewater samples .

(vii) The contract anticipated period of performance is 08/12/2022 – 08/11/2024.

(viii) The provision at FAR 52.212-1, Instructions to Offerors-Commercial, applies to this acquisition.

(ix) The provision at FAR 52.212-2, Evaluation-Commercial Items, is applicable and indicates the evaluation procedures to be used.

(x) The provision at FAR 52.212-3, Offeror Representations and Certifications-Commercial Items, is to be included as part of the System for Award Management registration. If for any reason it is not a part of the System for Award Management registration, then include a copy with the proposal.

(xi) The FAR clause at 52.212-4, Contract Terms and Conditions-Commercial Items, applies to this acquisition.

(xii) A The clause at FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items, applies to this acquisition. The additional FAR clauses cited in the clause are applicable to the acquisition.

(xiii) Additional contract terms and conditions are included in this solicitation in Section D, Terms and Conditions, and Section E, Solicitation Provisions, Instructions to Offerors, & Evaluation Criteria.

(xiv) The Defense Priorities and Allocations System (DPAS) is not applicable. See note in Section B regarding Health Resources Priorities and Allocations System

(xv) The date, time and place offers are due is indicated in the System for Award Management posting.

(xvi) The name, telephone number, and email address of the individual to contact for information regarding the solicitation is indicated in the System for Award Management posting.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2022 – 8/11/2023

Optional Task 2

See Optional Task 2-Surge Testing and Maximum Quantities

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2022 – 8/11/2023

Sample Collection:

maximum of 34,650 pools;

maximum of 415,800 samples;

Optional Task 2

See Optional Task 2-Surge Testing and Maximum Quantities

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2022 – 8/11/2023

Optional Task 3-Additional Airports

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2022 – 8/11/2023

Maximum 3 additional airports

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2023 – 8/11/2024

12 months

Optional Task 2

See Optional Task 2-Surge Testing and Maximum Quantities

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2023 – 8/11/2024

34,650 pools;

maximum of 415,800 samples;

Per Sample

Optional Task 2

See Optional Task 2-Surge Testing and Maximum Quantities

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2023 – 8/11/2024

Optional Task 3-Additional Airports

Firm fixed price

Severable Services

Anticipated Period of Performance:

8/12/2023 – 8/11/2024

Maximum 3 additional airports

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A— Health Resources Priorities and Allocations System. \

B.3 CLINs and Optional CLINs

Each of the Optional CLINs (0002, 0003, 0004, 1002, 1003, and 1004) above may be exercised for any quantity up to maximum specified within each CLIN and exercised as many times needed up to the maximum quantity. There is no guarantee the full amount of these quantities will be required by CDC. If actual sequences delivered are less than the maximum quantity of the CLIN, the contractor cannot invoice and will not be paid for any undelivered quantities

SECTION C-STATEMENT OF WORK

Title: Traveler-based SARS-CoV-2 Genomic Surveillance Program

SECTION 1 – BACKGROUND

Despite layered mitigation measures, international travel during the COVID-19 pandemic continues to facilitate global spread of SARS-CoV-2, including introduction of novel variants of concern (VOCs).[footnoteRef:1] Although SARS-CoV-2 genomic sequencing has increased significantly in US communities, there is still a need for early detection of new variants being imported to the United States among arriving travelers. Early detection and sequencing of new variants entering the United States can provide vital information about the transmissibility, virulence, and effectiveness of existing vaccines, diagnostics and therapeutics, which can guide our public health response. [1: World Health Organization. Novel Coronavirus (2019-nCoV) Situation Report 21 January 2020. Accessed December 21, 2021. ]

On November 26th, 2021, the World Health Organization (WHO) designated Omicron (B.1.1.529) a variant of concern.[footnoteRef:2] The WHO classification as a VOC was based on epidemiological data indicating an increase in infections in South Africa that coincided with detection of Omicron. Omicron has many concerning spike protein substitutions, some of which are known from other variants to be associated with reduced susceptibility to available monoclonal antibody therapeutics or reduced neutralization by convalescent and vaccinee sera. The European Center for Disease Prevention and Control also classified this variant as a VOC due to concerns regarding immune escape and increased transmissibility compared to the Delta variant. [2: World Health Organization. WHO Classification of Omicron (B.1.1.529): SARS-CoV-2 Variant of Concern. Accessed December 21, 2021. ]

During November 28, 2021 through January 23, 2022, unpublished CDC data from a pilot traveler-based SARS-CoV-2 genomic surveillance program enabled identification of two Omicron sublineages, BA.2 and BA.3, respectively weeks before they were reported elsewhere in the United States and North America.

During December 6 through January 2022 there was a high test-positivity among arriving international air travelers despite the requirement for a negative predeparture test within one day before flying to the United States.[footnoteRef:3] Reasons for this may include, timing of infection (i.e., before detection by available testing), use of certain testing modalities with lower sensitivity, or infection soon after predeparture sample collection.[footnoteRef:4] Longer flight times may lead to detection of more positive tests on arrival. During this time period, testing a proportion of international air travelers on arrival was sufficient to detect rare sublineages of Omicron and rare mutations earlier than they were reported elsewhere in the United States. [3: Centers for Disease Control and Prevention. Requirements for Negative Pre-Departure Covid-19 Test Result or Documentation of Recovery from Covid-19 for All Airline or Other Aircraft Passengers Arriving Into the United States From Any Foreign Country; 86 Fed. Reg. 69,256; December 7, 2021. ] [4: Johansson MA, Wolford H, Paul P, et al. Reducing travel-related SARS-CoV-2 transmission with layered mitigation measures: symptom monitoring, quarantine, and testing. BMC medicine. 2021;19(1):1-13.]

Public health surveillance for importation of emerging infectious diseases has traditionally focused on travelers presenting to health clinics after symptom onset.[footnoteRef:5] COVID-19 presents unique challenges since transmission often occurs before symptom onset or in asymptomatic infected persons. By the time VOCs are detected through routine surveillance there is already community transmission. Earlier detection of SARS-CoV-2 mutations, including variants, allows researchers and public health officials to gather necessary information about transmissibility, virulence, and vaccine effectiveness to guide changes to treatment and prevention strategies.[footnoteRef:6] [5: Hamer DH, Rizwan A, Freedman DO, Kozarsky P, Libman M. GeoSentinel: past, present and future. Journal of Travel Medicine. 2020;27(8):taaa219.] [6: Michaels D, Emanuel EJ, Bright RA. A National Strategy for COVID-19: Testing, Surveillance, and Mitigation Strategies. JAMA. 2022;doi:10.1001/jama.2021.24168]

CDC’s Travelers’ Health Branch (CDC THB) works to prevent illnesses, hospitalizations, and deaths from communicable disease among global travelers by determining incidence and trends, identifying sources, identifying emerging threats, and developing relevant prevention strategies. CDC THB has the necessary knowledge, resources, and expertise to analyze and publish data related to SARS-CoV-2 circulation among travelers.

Traveler-based SARS-CoV-2 genomic surveillance provides a model of pathogen detection that can be used as an early warning, sentinel system for future outbreaks affecting international travelers or pandemics.

SECTION 2 – PURPOSE

The purpose of the program is to detect and monitor importation of new and emerging variants and lineages of SARS-CoV-2 among arriving international travelers using molecular testing and genomic sequencing. The program is a voluntary program that includes travelers from a wide array of countries. Prioritization of arriving flights will be based on travel volume, country sequencing capability, country vaccination coverage, seasonality, global hemisphere, etc. The program will have the ability to scale up and scale back depending on prevalence of COVID and circulating global variants. The de-identified raw data collected will be shared within CDC. The program will enable the near-real-time (NRT) detection of circulating and novel COVID-19 variants and sublineages entering the United States by collecting population-based samples and individual samples from travelers and performing reverse transcription PCR (RT-PCR) testing and genetic sequencing on all positive samples. The program will leverage a variety of sampling modalities, including but not limited to individual testing, pooled testing, wastewater testing, and a variety of genomic sequencing approaches.

SECTION 3 – SCOPE OF WORK

The contractor will establish sample collection sites in five (5) major US international airports: New York John F Kennedy, Newark International, San Francisco International, Hartsfield Jackson Atlanta, and Dulles Airport Washington DC. The contractor will also develop digital data collection instruments, digital enrollment materials and collect biological samples (e.g. nasal and saliva) from travelers’ arriving in the United States at the five designated airports. Demographic, travel, and clinical information from participating passengers will be collected. At the airport, the contractor will conduct pooled sampling of travelers with double collection of individual samples from participants in the pooled collection. All samples will be stored at appropriate temperature in the laboratory. The contractor will ensure that samples are processed, stored, and tested appropriately using testing modalities including SARS-CoV-2 RT-PCR and whole genome sequencing of positive samples for lineage determination. The contractor will provide a digital registration and tracking system to collect meta-data from pool participants. The contractor will follow all federal, state and local reporting requirements.

The contractor will provide raw data outputs including sequencing and individual based demographic clinical and travel data to CDC. The contractor will develop and provide a report that includes a summary of the findings.

SECTION 4 – TASKS TO BE PERFORMED

Task 1

1.1 Sample collection

a. The Contractor will establish a sample collection site (kiosk, booth etc) at 5 major US International airports in multiple US states.

b. The contractor will set up a kiosk at the arrivals area to enroll and collect dry nasal swab samples from travelers from international flights at a minimum of 5 selected major US International airports. This may be in the baggage claim area of the airport or the Customs and Border Protection (CBP) Federal Inspection Services (FIS) area depending on airport layout and approvals.

c. The contractor will collect pooled samples from arriving passengers who opt in from the designated flights in scope. Samples will be pooled by flight and/or flight origin.

d. The contractor will collect and properly store a second dry nasal swab from each individual in the pool to enable reflex individual testing of those in the pooled samples as needed and directed by CDC.

e. The contractor will collect a minimum of 483,000 samples per year and 35,000 pools per year.

f. All testing will be performed at no charge to travelers.

1.2 Sample processing

a. Contractor shall pool all samples at the point of collection in the airport

b. Contractor shall ship pooled samples to a laboratory for RT-PCR.

c. Once received, Contractor shall report results of the PCR test within 24-48 hours.

d. Contractor shall ensure that positive samples will undergo whole genome sequencing to determine the viral lineage and variant identification.

e. The contractor shall conduct this RT-PCR testing and sequencing in consultation with CDC technical subject matter experts. While any EUA-approved RT-PCR test is acceptable, ThermoFisher TaqPATH™ is preferred, given the proven diagnostic utility of S-gene target failure (SGTF) on the platform. Sequencing may include Oxford Nanopore™ and/or Illumina™- based methods.

f. Contractor shall report sequencing results sequencing results within 6-8 days after PCR results and no later than 11 days after the PCR results;

g. When a pooled sample is positive, the contractor will, in consultation with CDC subject matter experts, RT-PCR test duplicate swabs that were collected from all individuals within that pool and sequence all positive samples.

h. The contractor shall have in-house bioinformaticians reviewing and using latest software for determining lineages, in consultation with CDC subject matter experts.

1.3 Notifications of results to passengers and health departments

a. Individuals who are in a positive pool and have had their individual tests run will be notifiedby the contractor through the contractor’s secure messaging system.

b. The contractor shall notify Health Departments of all individual positive individual results from the Health Department’s jurisdiction through the APHL Informatics Messaging Services (AIMS) platform for routine clinical laboratory reporting.

c. The contractor shall also notify the relevant health departments about pooled test results when indicated by and in collaboration with CDC, using CDC’s Epidemic Information Exchange (Epi-X) secure, web-based network.

d. The contractor shall notify CDC immediately anytime a sequencing result indicates a new or concerning variant, lineage, or mutation.

e. The Contractor shall provide all results using the contractor’s secure messaging system or by phone. The Contractor shall notreport results to participants for any test that does not have Clinical Laboratory Improvement Amendments (CLIA) approval.

1.4 Lab processing and reporting

a. Contractor shall inform the participant of results through the contractor’s secure messaging system within 24-48 hours of receipt of any individual sample. Pooled sample results are not reported to participants.

b. Contractor shall ensure all positive samples undergo genetic sequencing to determine lineage and variant identification. Contractor shall report sequencing results within 6-8 days after initial PCR report, but no later than 11 days after PCR result is reported. Contractor shall not report results to participants for any test that does not have Clinical Laboratory Improvement Amendments (CLIA) approval.

c. Contractor shall ensure a turnaround time for the entire process of approximately 6-10 days. Contractor shall ensure expediated turnaround using faster techniques (e.g. Oxford Nanopore) as determined in conjunction with CDC when necessary.

d. Contractor shall implement a multi-modal approach to testing with the ability to identify and use an appropriate test at any given time depending upon the expediency necessary and the circulating variant.

1.5 Sampling and testing of wastewater

The contractor shall perform aircraft wastewater COVID-19 surveillance, including testing for SARS-CoV-2 in aircraft lavatory drains and in airport terminal wastewater.

a. Contractor shall provide an operational plan for performing aircraft lavatory wastewater testing, with sample collection from airport lavatory drain(s) and airport terminal wastewater collection, and ability to transport collected samples to a laboratory.

b. Contractor shall collect and process wastewater samples from aircraft lavatories for 50 flights per week yielding 2600 samples per year and shall conduct RT-PCR of all samples for SARS-CoV-2 and conduct genetic sequencing of all positive samples for variant detection using several possible methodologies including but not limited to targeted sequencing with amplification and shotgun sequencing.

c. Contractor shall report sequencing results to CDC within 6-8 days after the initial PCR result, and no later than 11 days after PCR report.

d. Contractor shall perform bioinformatic analysis of SARS-CoV-2 variant and lineage detection in wastewater.

e. Contractor shall provide CDC with a management plan for detection of SARS-CoV-2 in tested samples, including knowledge of and compliance with CDC recommendations for submitting wastewater testing data to the National Wastewater Surveillance System.

f. Contractor shall secure contractual agreements with airports and aircraft operators to obtain wastewater sample collection in airport and aircraft facilities.

g. Contractor shall enhance passenger sampling on flights where wastewater surveillance yields lineages and variants that need to belinked to traveler sampling.

1.6 Optional novel modalities for sampling and testing

a. Contractor shall monitor and report monthly to CDC on any new modalities, technologies, and approaches that could be used to enhance or improve this genomic surveillance system.

b. Contractor shall have the ability to perform a pilot study of any new technology in consultation with CDC subject matter experts.

c. Contractor will implement new modalities wherever possible as directed by CDC to improve this surveillance program.

1.7 Data Analysis and Reporting

Contractor shall provide the following data, including raw de-identified and appropriate reports, to CDC biweekly.

a. Results of SARS-CoV-2 RT-PCR tests for pools and individuals (positive, negative, or inconclusive).

b. Early indication of an S-Gene Target Failure or other specific mutations as appropriate by variants of interest or concern using appropriate laboratory tests.

c. Sequencing data: consensus genome, VCF, BAM files for each sample (sequences with ≥90% coverage and ≥10% read depth).

d. SARS-CoV-2 lineage reports.

e. Epidemiologic data including positivity rates, genomic information, vaccination data and travel information.

f. Interpretation of findings by trained bioinformatician, in consultation with CDC subject matter experts.

g. Contractor shall develop , maintain, and provide CDC access to a dashboard for all traveler, laboratory and wastewater data.

h.

1.8 Access to Secure Airport Terminals

The contractor shall have an established capacity to obtain staff access to the Security Identification Display Area (SIDA, defined at 49 CFR 1542.205) and Customs security areas (defined at 19 CFR 122.181) within the participating airports included in this contract, to include access to secure Customs and Border Protection areas such as the Federal Inspection Services (FIS) area and the CDC Quarantine Station area.

NOTE: Access requirements can vary depending on the airport, and the contractor is responsible for researching and meeting these access requirements with the local badging and CBP offices at each airport. Most airports require contractor s to establish Authorized Signatories before issuing airport identification badges. At some locations, contractor s may have to obtain airport security bonds and CBP customs seals (as described in 19 C.F.R. 122.181-189), complete vetting and clearing processes, complete airport-specific training, or fulfill other requirements before staff can obtain the necessary credentials to access SIDA and Customs security areas within the airport. Contractor is responsible for training, and escorting staff who have not yet been issued SIDA badges by the airport.

Contractors shall comply with any additional airport policies, procedures, or requirements for access to airport grounds or the SIDA. Contractor ’s badging authority at the port of entry may be revoked if infractions of airport rules occur. Contractors at the San Diego and El Paso Quarantine Stations, shall comply with any additional office building access requirements and CDC federal identification badging to access land border ports of entry.

Note for staffing plan purposes: airport security processing for non-US citizens can take more than 60 days.

1.9 Self-Monitoring and Safety Reporting Requirements

Contractors shall comply with any airport, building or port safety policies, procedures, or requirements for access to airport grounds or the SIDA, building or port facility. For example, anyone accessing a CDC facility must wear a face covering, complete a CDC self-monitoring check list and have their temperature taken before entering the facility.

Optional Task 2

Surge Testing Contractor may be asked to perform an increase in testing during the Period of Performance; optional surge testing CLINs may be exercised multiple times during the period of performance up to the maximum numbers indicated below. Optional Task 2 includes a repeat of Tasks 1.1 - 1.7 as specified above, with the addition of:

1. a maximum of 34,650 pools and 415,800 samples

1. collection and processing of 25% of individual samples from travelers in positive pools as directed by CDC

1. collection and processing of waste-water samples from an additional 50 flights per week yielding a maximum of 7800 additional samples.

Optional Task 3

Additional Airports Contractor may be asked to establish additional collection sites during surge periods. Optional surge CLINs may be exercised multiple times during the period of performance up to a maximum of 3 additional collection sites at US international airports.

SECTION 5 – TRAVEL

Domestic travel may be required to fulfill activities. All travel shall be authorized by the COR prior to occurrence. All travel shall be reimbursed according to Federal Travel Regulations (FTR). Travel CLINs shall be reimbursed for costs-only. Proposed costs to include all expenses associated with travel for pre-deployment requirements.

The Contractor shall coordinate all travel requirements with the COR and obtain written approval from the COR prior to beginning such travel. Final travel vouchers must also be submitted and approved by the COR. The Contractor will only be reimbursed for actual expenses incurred for approved travel. The Contractor shall submit receipts for airfare, lodging, car rentals, and other incidental travel-related expenses to the COR. Travel costs shall not exceed the maximum per diem rates set forth in the Federal Travel Regulation (FTR).

SECTION 6 – GOVERNMENT FURNISHED MATERIALS

There will be no Government Furnished Materials.

SECTION 7 – PERIOD OF PERFORMANCE

The period of performance of this contract shall be for a Base period of 12 months from the effective date of the contract. There will be one option period for this contract.

Base Period of Performance: 8/12/2022- 8/11/2023 Optional Period 1: 8/12/2023-8/11/2024

SECTION 8 – DELIVERABLES/REPORTING SCHEDULE

Pooled and reflex individual sample collection and processing

Set up airport sampling sites at 5 major US international airports within 1 month of award

Collect and process a minimum of 35,000 pools with approximately 12 travelers per pool for a minimum of 420,000 samples per year as directed by CDC Project Officer

Collect and process a minimum of 63,000 individual samples per year from travelers in positive pools as directed by CDC

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Weekly

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Monthly

Optional Task 2

Collect and process 25% of individual samples from travelers in positive pools as directed by CDC

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Weekly

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Sequencing results are expected within 6-8 days after the initial PCR result, but shall be reported to CDC no later than 11 days after PCR report.

Weekly

Within 1 week of option period

Required Reports/Documentation and Content

(1) Monthly Technical Report The Contractor shall prepare and submit monthly technical progress reports in narrative form which shall contain technical results of the work accomplished during the reporting period. This report shall be in sufficient detail to disclose all work started and results achieved during the reporting period, an indication of any current problems which may impede performance, the proposed corrective action, and the work forecast for the next period. This document shall report progress and planning to correspond with the work schedule contained in the Center approved program plan.

(2) Monthly Financial Letter Report The Contractor shall prepare and submit monthly financial reports which will summarize in tabular form the expenditures for the current month and the cumulative expenditures through the current month. The report shall contain a detailed actual cost breakdown in the same categories which appeared in the Contractor's cost proposal (including the extent of cost sharing) both for the current month and cumulatively through the current month. A graph comparing actual and planned cumulative expenditures versus time will be included. Any gross deviations should be explained. In addition, any outstanding commitments as of the end of the reporting period shall also be reflected in the report.

(3) Monthly Property Report The Contractor shall prepare and submit a report on property as required by CDCA.H040 Government Property.

(4) Draft Final Report Upon completion of all work under the contract, the Contractor shall prepare and submit to the Government a final report covering in detail all the work accomplished under the contract. The final report shall document and summarize the entire contract work and shall include recommendations and conclusions based on the experience and results obtained. The final report shall include tables, graphs, photos, and diagrams in sufficient detail to comprehensively explain the results achieved under the contract. The report shall also include an analysis of salient findings, a presentation of general conclusions, and any guidance or recommendations deemed pertinent for future consideration by the Division of Global Migration and Quarantine (DGMQ), Travelers Health Branch (THB). The Government shall be allowed sixty (60) days to review the draft and notify the Contractor in writing of approval or of recommended changes to be made in the final copy. If the Government does not approve or recommend changes within sixty (60) days of receipt of the draft final report, the report shall be deemed approved.

(5) Final Report Within thirty (30) days of receipt of a notice of approval from the Contracting Officer, the Contractor shall furnish the Government with a reproducible master and the required number of copies of the final report in final form. The reproducible master shall be prepared in accordance with the guidelines referenced under DRAFT FINAL REPORT.

Reporting Period

All monthly reporting periods shall end on the last day of a calendar month.

(1) For contracts awarded (i.e., effective date) on or before the fifteenth (15th) of a calendar month, the initial reporting period shall end on the last day of the calendar month during which the contract became effective.

(2) For contracts awarded (i.e., effective date) on or after the sixteenth (16th) of a calendar month, the initial reporting period shall end on the last day of the month immediately following the month during which the contract became effective.

Delivery of Reports One copy of each report, in draft and/or final form as required by the contract, shall be delivered prepaid to: CDC Contracting Officer.

Attention: TBD Contract No.: TBD All remaining copies of reports shall be delivered prepaid to the Government’s Contracting Officer’s Representative (COR) designated by the Contracting Officer.

SECTION 9 – REFERENCE MATERIALS

No reference materials will be provided for this contract.

SECTION 10 – SPECIAL CONSIDERATIONS

Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats is available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

SECTION 11 – INFORMATION SECURITY

The below information complies with CDC Security and Privacy compliance requirements for E-Government Act of 2002 (FISMA 2002) and Federal Information Security Modernization Act of 2014 (FISMA 2014) Security Compliance Standard-1: Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ x ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ x ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Cybersecurity Program Office (CSPO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

A. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy.