REQUEST FOR QUOTATIONS

(THIS IS NOT AN ORDER)

THIS RFQ IS X IS NOT A SMALL BUSINESS SET-ASIDE.

PAGE OF PAGES

1 47

1. REQUEST NO.

75D301-26-Q-79233

2. DATE ISSUED

3. REQUISITION/PURCHASE REQUEST NO.

000HCCRK-2026-98946

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY

Centers for Disease Control and Prevention

Chamblee Campus Building 102, MS S102-4

4770 Buford Hwy

Atlanta GA 303413717

6. DELIVERY BY (Date)

5b. FOR INFORMATION CALL (No collect calls)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

Sandra Adams (770) 488-5543 x

8. TO: 9. DESTINATION

a. NAME b. COMPANY a. NAME OF CONSIGNEE

c. STREET ADDRESS b. STREET ADDRESS

c. CITY

d. CITY e. STATE f. ZIP CODE d. STATE e. ZIP CODE

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

Request for Quotation (RFQ) for the Centers for Disease

Control and Prevention (CDC) in support of the National

Institute for Occupational Safety and Health (NIOSH)

Quotes due: August 27, 2026, at 10AM EST to

Sandra Adams at ab41@cdc.gov.

“See Continuation Page”

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS

b. 20 CALENDAR DAYS

c. 30 CALENDAR DAYS

d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER 14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF

QUOTATION

a. NAME OF QUOTER

b. STREET ADDRESS 16. SIGNER

a. NAME (Type or print) b. TELEPHONE

c. COUNTY AREA CODE

d. CITY e. STATE f. ZIP CODE c. TITLE (Type or print) NUMBER

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (REV. 6-95)

Previous edition not usable Prescribed by GSA FAR (48 CFR) 53.215-1(a)

7. DELIVERY

FOB

DESTINATION

OTHER

(See Schedule)

SECTION B-CONTRACT LINE ITEMS (CLINs)

PERIOD OF PERFORMANCE: 09/01/2026-11/16/2026

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Borehole drilling

A contractor is required by the federal government to drill a surface borehole for the monitoring of fracture permeability in the strata above a longwall panel associated with a Virginia coal mine.

Specifications for the borehole drilling and configuration are provided by NIOSH and the contractor will provide a bid for completing the job at the selected site within the specified time frame after receiving the statement of work and conducting a drill site visit. Contractor activity will begin at the site begin in FY

2026 and will be completed in FY2027.

There are two rotary drilling vendors approved by the mine operator to conduct drilling on mine property. This contract will be configured as firm fixed price contract.

FIRM FIXED PRICE

NON-SEVERABLE

PERIOD OF PERFORMANCE:

09/01/2026-11/16/2026

1 Each

TOTAL AGGREGATE AMOUNT__________________

SECTION C-CONTRACT DOCUMENTS, EXHIBITS OR ATTACHMENTS

Statement of Work DATED: August 13, 2025

Statement of Work Title: Drilling Vertical Borehole

Period of performance of this contract is: 09/01/2026-11/16/2026

SECTION 1 – BACKGROUND

The National Institute for Occupational Safety and health (NIOSH) conducts research to improve the safety and health of workers in the mining sector and to improve mining operation based on scientific input. This contract proposes to drill a borehole at the site of a collaborating coal mine to monitor changing permeability over an active longwall panel. The overburden above the mined panel is deformed by the extraction of the mine coal seam creating caving and fracturing which produce pathways of coalbed gas movement to mine workings that can create an explosion hazard to the underground workforce. Keeping this mining environment safe is the subject of research by

NIOSH’s ventilation and methane control researchers to assist industry and worker groups.

NIOSH research relies on quality data and information from experimentation and monitoring exercises.

Prior NIOSH research projects have been in some ways related to this drilling effort through a contractor. The prior project “Development of Engineering Guidelines for Shale Gas Wells

Influenced by Longwall Mining (CAN 9390G0U)” was configured to research safety issues occurring at the intersection between coal mining and unconventional natural gas industries where gas wells passed though coal mine pillars to intercept much deeper gas reserves. The current research project “Panel Design Optimization and Mine Ventilation Considerations around Gas

Wells (CAN9390P06)” includes safety and health research aimed at conventional and unconventional gas wells near limestone mines. Although these are related efforts the proposed drilling effort does not duplicate this prior work in any way.

SECTION 2 – PURPOSE/OBJECTIVE

A new initiative to address longwall methane control and ventilation issues in gassy mines using methane control technology is in progress. This NIOSH/PMRD/MSSB research will be greatly enhanced by experimental data on the mining-induced fracture permeability acquired from a borehole into the overburden associated with an active panel. The borehole collar location will be the former frack well pad Z35D. This is a request for a quote for drilling of a vertical well, site preparation, and reclamation for a surface site. The drill site is located on Coronado Coal Company’s Buchanan mine property, ID 4404856.

ECTION 3 – SCOPE OF WORK

The contract includes site preparation activities and site reclamation costs for the restoration of the site once drilling related activity is completed. These activities could be completed by the drilling contractor or a subcontractor. We require that work begin at the site by 09/01/26 and be completed by 11/16/26.

SECTION 4 – TASKS TO BE PERFORMED

Task 1: Site Visit

a. Confirm training for all NIOSH employees participating in site visit

b. Conduct site visit with Buchanan mine personnel and approved drilling contractors

c. If NIOSH is participating remotely, then Buchanan mine personnel will physically show the site location to the contract drillers.

Task 2: Purchase pipe-minimum pf 3.5’’ OD casing

a. Purchase pipe (Minimum of 3.5” New or used steel casing)

b. Borehole depth anticipated to be about 1700 ft from the surface to the bottom of

Pocahontas 7 coal bed or equivalent.

Task 3: Site preparation

a. One call or equivalent-verify no utilities present, right of way

b. Install erosion and sedimentation controls as per regulatory and Buchanan mine company policy.

c. Attain any regulatory permits to work on location

d. Establish roadway access to planned drill pad

e. Clear area and build drilling pad of at least 50 ft by 50 ft to accommodate the NIOSH permeability borehole.

a. Stack any trees or shrub in one location

f. Configure pit for drill cuttings

a. Use either a drill cuttings pit that is brought to the site or dig a pit of sufficient size and install a liner to protect the soil

Task 4: Borehole drilling

1. The contractor will move the drill onto the site

2. Drill borehole to a total depth of about 1700 ft from surface to bottom of

Pocahontas 7 horizon.

a. Borehole must be large enough to accommodate steel casing of

3.5 inch outside diameter, prefer bit size to be kept small to manage costs but large enough to accommodate the casing and trimmy line.

b. The final borehole depth and casing configuration dimensions to be determined by downhole geophysical sensing.

c. Borehole configuration will be provided by NIOSH/geophysical testing vendor from downhole data to interpret lithological data.

3. Solid steel casing will make up the casing string to the designated top of the P7 horizon. Slotted steel casing will be located in the lowest about 4-30 ft of borehole, with dimensions confirmed from geophysics on the adjacent exploratory borehole previously drilled.

a. The slotted casing will consist of slots of 1” by 12” with slots at 90 degree phasing.

4. The casing will be set on bottom of borehole. Use a minimum of two grout baskets positioned above the slotted section in competent strata

5. Fill the outside annulus with cement grout from the baskets to the surface with inner annulus remaining open. This material performance must seal the pipe in and isolate the borehole. (Some bentonite may be used depending on the factors encountered while drilling)

a. Provide any water needed for cementing

6. At the surface, the casing should extend approximately 3’ above the surface and be finished with a hinged cover for instrument access

Task 5: Demobilization of rig

1. Demobilize drill rig off of the site

Task 6: Site reclamation

1. Replace topsoil

2. Grade the contour in the vicinity of the site, approximate original contours away from drill pad

3. Reclaim or remove cuttings pit

4. Build road

a. Establish drainage for road.

b. Install stone on road about 6 inches deep

5. Install stone on drill pad

a. Place around well

b. Stone on pad vehicle parking

6. Seed and mulch disturbed area

7. Install metal fencing (e.g., dog box) around the boreholes.

a. Metal fencing with a door for entering and exiting area where the borehole is located

8. Clean the site of any trash or waste

Task 7: Demobilization of Equipment

1. Move equipment off the site

The approved contractor will perform all drilling and installation operations and will coordinate with

NIOSH/PMRD/MSSB, and CONSOL mine personnel.

Safety and Compliance

The contractor will comply with all on-site safety policies including but not limited to the Mine

Safety and Health Administration, Virginia Energy's Division of Coal Mine Safety and Division of

Mineral Mining, Coronado Coal Company, and NIOSH/PMRD. The contractor will cooperate with all on-site hazard/safety training and procedures, including making all personnel and equipment available for inspection at any time while entering, leaving, or working at the site.

Option 1: Drilling contractor provides geophysical service for downhole sensing in borehole development

The Drilling contractor provides geophysical services for running sensing tools in the NIOSH borehole, to include at least gamma ray and density measuring instruments. The potential permeability monitoring zones of the Pocahontas 7 of high importance to identify the top and bottom of these strata, if present. All lithology from TD to the surface will be identified with emphasis on all coal units and their position but also all coal measure strata with an interpretation of the borehole survey data provided. Any digital information will be in the form of hard copy and potentially thumb drives to be stored on a project, NIOSH lab computer connected only to the aisle.

No more than ½ day of downtime is expected to provide information to the driller on the final borehole completion configuration with the location of the slotted pipe and grout baskets.

SECTION 5 – GOVERNMENT FURNISHED PROPERTY

N/A

SECTION 6 – PLACE OF PERFORMANCE

SUBSECTION A

Coranado's Buchanan mine property

1636 Honaker Branch Rd, Raven, Virginia 24639

SUBSECTION B – CONTRACT SUPPORT HOURS

The contractor shall perform delivery and installation activities during normal business hours, defined as Monday through Friday, 8:00 a.m. to 5:00 p.m., excluding Federal holidays, unless otherwise coordinated with the Contracting Officer’s Representative

SECTION 7 – TRAVEL

Not applicable

SECTION 8 – DELIVERABLES/REPORTING SCHEDULE

Deliverables

SUBSECTION A – PERFORMANCE MATRIX

PERFORMANCE

OBJECTIVE

STANDARD PERFORMANCE

THRESHOLD

ACCEPTABLE

QUALITY LEVELS

(AQLs)

METHOD OF

SURVEILLANCE

The contractor shall conduct Complete site visit prior to 100% Compliance Periodic Inspection

PERFORMANCE

OBJECTIVE

STANDARD PERFORMANCE

THRESHOLD

ACCEPTABLE

QUALITY LEVELS

(AQLs)

METHOD OF

SURVEILLANCE

a site visit providing quote for drilling contract

Zero Deviation from standard

The contractor shall purchase drill pipe

Complete purchase to have pipe available at the start of drilling

100% Compliance

Zero Deviation from standard

Periodic Inspection

The contractor shall prepare the drill site

Complete prior to the initiation of drilling

100% Compliance

Zero Deviation from standard

Periodic Inspection

The contractor shall conduct borehole drilling

Borehole drilling will be done to total depth borehole will be cased, completed, and grouted.

The driller will provide a copy of the drillers log to

NIOSH

100% Compliance

Zero Deviation from standard

Periodic Inspection

The contractor shall conduct demobilization of the rig

Following borehole completion, the rig will be demobilized

100% Compliance

Zero Deviation from standard

Periodic Inspection

The contractor shall conduct site reclamation

Reclamation shall be done to allow for use of the site

100% Compliance

Zero Deviation from standard

Periodic Inspection

The contractor shall demobilize the equipment

All equipment will be demobilized from the site

100% Compliance

Zero Deviation from standard

Periodic Inspection

SECTION 9 – REFERENCE MATERIALS

A drilling contract for a borehole completed by a contractor and purchased by NIOSH is attached. This work was completed in southwestern Pennsylvania in 2023. The costs are very different than the new contract the new borehole will be subject to greater depth, challenging terrain, and prior coal mining activity near the drill site.

D1 75D30123 P17163 FEC.pdf

SECTION 10 – MINIMUM VENDOR QUALIFICATIONS

The approved drilling contractor must have prior experience at rotary drilling boreholes to greater than 2000 ft with the capability to perform all needed casing and grouting exercises. Through their own company or a subcontractor, they must provide downhole the sensing services as specified in the contract. These services will be needed on site in a timely manner to finalize the completion of the borehole.

The approved drilling contractor must also be an approved vendor for Coronado Coal Company’s Buchanan mine, so they have access to the site, roads and any approved resources needed to complete the contract.

SECTION 11 – ADDITIONAL REQUIREMENTS

Information Security and Privacy

Information Security and Privacy

Baseline Security Requirements

1.Applicability. The requirements herein apply whether the entire contract ororder (hereafter

“contract”), or portion thereof, includes either or both of thefollowing:

a.Access (Physical or Logical) to Government Information: AContractor (and/or any subcontractor) employee will have or will begiven the ability to have, routine physical (entry) or logical(electronic) access to Government information b.Operate a Federal System Containing Information: A Contractor(and/or any subcontractor) employee will operate a federal systemand information technology containing data that supports the

U.S.Department of Health and Human Services (HHS) mission. Inaddition to the Federal Acquisition

Regulation (FAR) Subpart 2.1definition of “information technology” (IT), the term as used in thissection includes computers, ancillary equipment (including imagingperipherals, input, output, and storage devices necessary for securityand surveillance), peripheral equipment designed to be controlled bythe central processing unit of a computer, software, firmware andsimilar procedures, services (including support services), and relatedresources

2.Safeguarding Information and Information Systems. In accordance with theFederal Information

Processing Standards Publication (FIPS)199, Standards forSecurity Categorization of Federal

Information and Information Systems, the Contractor(and/or any subcontractor) shall:

a. Protect Government information and information systems in order toensure:

i.Confidentiality, which means preserving authorized restrictionson access and disclosure, based on the security terms found in thiscontract, including means for protecting personal privacy andproprietary information ii.Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity iii.Availability, which means ensuring timely and reliable access toand use of information b.Provide security for any Contractor systems, and informationcontained therein, connected to an

HHS network or operated bythe Contractor on behalf of HHS regardless of location. Inaddition, if new or unanticipated threats or hazards are discoveredby either the agency or contractor, or if existing safeguards haveceased to function, the discoverer shall immediately, within one(1)hour or less, bring the situation to the attention of the otherparty c.Adopt and implement the policies, procedures, controls, andstandards required by the HHS

Information Security Program toensure the confidentiality, integrity, and availability ofGovernment information and Government information systems forwhich the Contractor is responsible under this contract or to whichthe Contractor may otherwise have access under this contract.Obtain the HHS information Security Program securityrequirements, outlined in the HHS Information Security andPrivacy Policy (IS2P), by contacting the CO/COR or emailingfisma@hhs.gov d.Comply with the Privacy Act requirements and tailor FAR clauses as needed

3.Information Security Categorization. In accordance with FIPS 199 and NationalInstitute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II:Appendices to Guide for Mapping Types of Information and Information Systems toSecurity Categories, Appendix C, and based on information provided by the ISSO, CISO,or other security representative, the risk level for each Security Objective and the OverallRisk Level, which is the highest watermark of the three factors.

(Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] [X] [ ]

Low Moderate High

Integrity: [ ] [X] [ ]

Low Moderate High

Availability: [ ] [X] [ ]

Low Moderate High

Overall Risk [ ] [X] [ ]

Level: Low Moderate High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves*:

[X]No PII [ ] Yes PII

4.Personally Identifiable Information (PII). Per the Office of Management andBudget (OMB)

Circular A-130, “PII is information that can be used to distinguish or tracean individual's identity, either alone or when combined with other information that islinked or linkable to a specific individual.” Examples of PII include, but are not limited tothe following: social security number, date and place of birth, mother‘s maiden name,biometric records, etc.

PII Confidentiality Impact evel has been determined to be: [ ] Low [X ] Moderate [ ] High

5.Controlled Unclassified Information (CUI). CUI is defined as “information thatlaws, regulations, or Government-wide policies require to have safeguarding ordissemination controls, excluding classified information.” The Contractor (and/or anysubcontractor) must comply with Executive Order

13556, Controlled UnclassifiedInformation, (implemented at 32 CFR, part 2002) when handling

CUI. 32 C.F.R.2002.4(aa) As implemented the term “handling” refers to “…any use of

CUI,including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitiveinformation that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a.marked appropriately;

b.disclosed to authorized personnel on a Need-To-Know basis;

c.protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified

Information in NonfederalInformation Systems and Organizations if handled by internal

Contractorsystem; and d.returned to HHS control, destroyed when no longer needed, or held untilotherwise directed.

Destruction of information and/or data shall beaccomplished in accordance with NIST SP 800-88, Guidelines for MediaSanitization.

6.Protection of Sensitive Information. For security purposes, informationis or may be sensitive because it requires security to protect its confidentiality,integrity, and/or availability. The Contractor

(and/or any subcontractor) shallprotect all Government information that is or may be sensitive in accordancewith OMB Memorandum M-06-16, Protection of Sensitive AgencyInformation by securing it with a FIPS 140-2 validated solution.

7.Confidentiality and Nondisclosure of Information. Any informationprovided to the contractor

(and/or any subcontractor) by HHS or collected bythe contractor on behalf of HHS shall be used only for the purpose of carryingout the provisions of this contract and shall not be disclosed or made known inany manner to any persons except as may be necessary in the performance ofthe contract.

The Contractor assumes responsibility for protection of theconfidentiality of Government records and shall ensure that all workperformed by its employees and subcontractors shall be under the supervisionof the Contractor. Each Contractor employee or any of its subcontractors towhom any

HHS records may be made available or disclosed shall be notifiedin writing by the Contractor that information disclosed to such employee orsubcontractor can be used only for that purpose and to the extent authorizedherein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the

HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a.18 U.S.C. 641 (Criminal Code: Public Money, Property orRecords);

b.18 U.S.C. 1905 (Criminal Code: Disclosure of ConfidentialInformation); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8.Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shallcomply with

OMB Memorandum M-05-22, Transition Planning for Internet ProtocolVersion 6 (IPv6).

9.Government Websites. All new and existing public-facing Governmentwebsites must be securely configured with Hypertext Transfer ProtocolSecure (HTTPS) using the most recent version of

Transport Layer Security(TLS). In addition, HTTPS shall enable HTTP Strict Transport

Security(HSTS) to instruct compliant browsers to assume HTTPS at all times toreduce the number of insecure redirects and protect against attacks thatattempt to downgrade connections to plain HTTP.

For internal-facingwebsites, the HTTPS is not required, but it is highly recommended.

10.Contract Documentation. The Contractor shall use provided templates,policies, forms and other agency documents to comply with contractdeliverables as appropriate.

11.Standard for Encryption. The Contractor (and/or any subcontractor)shall:

a.Comply with the HHS Standard for Encryption of ComputingDevices and Information to prevent unauthorized access toGovernment information.

b.Encrypt all sensitive federal data and information (i.e., PII, protectedhealth information [PHI], proprietary information, etc.) in transit(i.e., email, network connections, etc.) and at rest (i.e., servers,storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c.Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) thatstore and process Government information and ensure devices meetHHS and CDC-specific encryption standard requirements.

Maintaina complete and current inventory of all laptop computers, desktopcomputers, and other mobile devices and portable media that store orprocess sensitive Government information (including

PII).

d.Verify that the encryption solutions in use have been validatedunder the Cryptographic Module

Validation Program to confirmcompliance with FIPS 140-2. The Contractor shall provide a writtencopy of the validation documentation to the COR.

e.Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

12.Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/orany subcontractor) employee having access to non-public Governmentinformation under this contract shall complete the

CDC non-disclosureagreement, as applicable. A copy of each signed and witnessed NDA shall besubmitted to the Contracting Officer (CO) and/or CO Representative (COR)prior to performing any work under this acquisition.

13.Non-Commercial and Open-Source Computer Software Procurements.The Contractor

(and/or any subcontractor) shall follow secure coding bestpractice requirements, as directed by the

United States ComputerEmergency Readiness Team (US-CERT) specified standards and the

OpenWeb Application Security Project (OWASP) that will limit system softwarevulnerability exploits.

14.Information Technology Application Design, Development, or Support.

15.The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges. 2) The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as 25 Purchasing of Noncommercial Computer

Software and Open Source Licenses (2012) information may be found at 26 OMB M-04-16, Software Acquisition, July 1, 2004, may be found at https://obamawhitehouse.archives.gov/omb// CDC Implementation of HHS Security and Privacy

Language for Information and Information Technology Procurements Language, Version 1.0 Page 36

Office of the Chief Information Security Officer (OCISO) directed by United States Computer

Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security

Project (OWASP), that will limit system software vulnerability exploits. 3) The Contractor (and/or any subcontractor) shall ensure that computer software developed on behalf of HHS or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with Government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the HHS environment. No sensitive data shall be used during software testing. 4) The

Contractor (and/or any subcontractor) shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably-available information, is deemed sensitive or proprietary by HHS shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract. 5) The Contractor (and/or any subcontractor) shall remediate all risks or vulnerabilities immediately after the risks or vulnerabilities have been identified in the software.

16. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) –The Contractor shall assist the CDC Senior Official for Privacy (SOP) ordesignee with conducting a PTA for the information system and/orinformation handled under this contract in accordance with HHS policy andOMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of

2002.

a.The Contractor shall assist the CDC SOP or designee in reviewing thePIA at least every three years throughout the system developmentlifecycle (SDLC)/information lifecycle, or when determined by theCDC SOP that a review is required based on a major change to thesystem (e.g., new uses of information collected, changes to the wayinformation is shared or disclosed and for what purpose, or when newtypes of PII are collected that could introduce new or increasedprivacy risks), whichever comes first.

17.Capital Planning and Investment Control Training 1.The contractor shall implement an Earned Value Management System(EVMS) as mandated by the

U.S. Department of Health and HumanServices (HHS) Office of the Chief Information Officer

(OCIO) Policy forInformation Technology (IT) Earned Value Management (EVM). See linkbelow for the HHS OCIO Policy. Items in this contract are consideredMajor/Tier 1 Investments under HHS

EVMS policy. Accordingly, thecontractor shall develop and implement a fully compliant EVM

Systemthat meets all of the applicable 32 guidelines defined by the ANSI/EIA-748-1998A standard.

See link below for the 32 guidelines. The contractorshall build an EVMS with the management processes and tools that arerequired for ANSI/EIA-748-1998A certification. The contractor shallprovide EVMS data in the standard CPR format so that CDC canconsolidate EVMS data across multiple contract vehicles for submissionto HHS and OMB. The contractor may implement a fully certified EVMSin phases such as those listed below:

a. Phase 1 - EV Data Reporting based on current artifacts

b. Phase 2 - Implementation of a fully compliant ANSI/EIA-748- 1998A EVMS

c. Phase 3 - Operation of an ANSI/EIA-748-1998A-compliantprogram management approach

LINK for HHS OCIO Policy and 32 Guidelines: https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-334-major-system-acquisition/index.html

The contractor shall produce a Full EVM report NLT the 10th day of each month.

1.The contractor shall provide Project Management Support in

Project/Program Strategy/Roadmap development, associatedmeetings/discussions, adhere to

Enterprise Performance Life Cycle (EPLC) governance and Stage Gate requirements, Work-

Breakdown Structure development/maintenance, master project/program schedule development and maintenance, EVM tracking, reporting/ maintenance, scope, risk, Change-control management and any applicable reporting tailored for DIBBs.

2.Support and assist in the development, implementation, management,and support processes, platforms, and artifacts that assist functional areasand initiatives while complying with federal and

CDC policyrequirements. This includes Capital Planning and Investment Control(CPIC), EPLC, OMB and other federal and CDC policies.

3.Any associated IT costs must be identified and captured in theEnterprise Systems Catalog (ESC) as part of the IT Capital Planningprocess. All IT projects in support of this task must adhere to the

CDCEPLC requirements and pass each Stage Gate. Contractors shall followthe EPLC Framework which provides a standard structure for planning,managing, and overseeing IT projects over their entire life cycle.

Training

1.Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall completethe applicable HHS/CDC

Contractor Information Security Awareness,Privacy, and Records Management training (provided upon contract award)before performing any work under this contract. Thereafter, the employeesshall complete CDC Security Awareness Training (SAT), Privacy, andRecords Management training at least annually, during the life of thiscontract. All provided training shall be compliant with HHS training policies.

2. Role-based Training. All Contractor (and/or any subcontractor)employees with significant security responsibilities (as determined by theprogram manager) must complete role-based training

(RBT) within 60 daysof assuming their new responsibilities. Thereafter, they shall complete RBTat least annually in accordance with HHS policy and the HHS Role-BasedTraining (RBT) of Personnel with Significant Security ResponsibilitiesMemorandum.

All HHS employees and contractors with SSR who have not completed therequired training within the mandated timeframes shall have their useraccounts disabled until they have met their RBT requirement.

3.Training Records. The Contractor (and/or any subcontractor) shall maintaintraining records for all its employees working under this contract in accordance with HHSpolicy. A copy of the training records shall be provided to the CO and/or COR within 30days after contract award and annually thereafter or upon request.

Rules of Behavior

1.The Contractor (and/or any subcontractor) shall ensure that all employeesperforming on the contract comply with the HHS Information TechnologyGeneral Rules of Behavior and any additional guidance provided by the CDC.

2.All Contractor employees performing on the contract must read and adhere tothe Rules of Behavior before accessing Department data or other information,systems, and/or networks that store/process

Government information, initially atthe beginning of the contract and at least annually thereafter, which may bedone as part of annual CDC Security Awareness Training. If the training isprovided by the contractor, the signed ROB must be provided as a separatedeliverable to the CO and/or COR per defined timelines above.

Incident Response

1.FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes,without lawful authority, the integrity, confidentiality, or availability of information or aninformation system;

or (2) constitutes a violation or imminent threat of violation of law,security policies, security procedures, or acceptable use policies. The HHS Policy for ITSecurity and Privacy Incident

Reporting and Response further defines incidents as eventsinvolving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of,unauthorized disclosure or destruction of data, and so on.

2.A privacy breach is a type of incident and is defined by Federal Information

SecurityModernizationAct (FISMA) as the loss of control, compromise, unauthorized disclosure,unauthorized acquisition, or any similar occurrence where (1) a person other than anauthorized user accesses or potentially accesses personally identifiable information or (2) anauthorized user accesses or potentially accesses personally identifiable information for another than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable

Information” (03 January 2017) states:

Definition of an Incident:

1.An occurrence that (1) actually or imminently jeopardizes, without lawful authority, theintegrity, confidentiality, or availability of information or an information system; or (2)constitutes a violation or imminent threat of violation of law, security policies, securityprocedures, or acceptable use policies.

Definition of a Breach:

1.The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, orany similar occurrence where (1) a person other than an authorized user accesses orpotentially accesses personally identifiable information or (2) an authorized user accesses orpotentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

2.A breach is not limited to an occurrence where a person other than an authorized userpotentially accesses PII by means of a network intrusion, a targeted attack that exploitswebsite vulnerabilities, or an attack executed through an email message or attachment. Abreach may also include the loss or theft of physical documents that include PII and portableelectronic storage media that store PII, the inadvertent disclosure of PII on a public website,or an oral disclosure of PII to a person who is not authorized to receive that information. Itmay also include an authorized user accessing PII for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1.The contractor shall cooperate with and exchange information with CDC officials, asdeemed necessary by the CDC Breach Response Team, to report and manage a suspected orconfirmed breach.

2.All contractors and subcontractors shall properly encrypt PII in accordance with OMBCircular A-

130 and other applicable policies, including CDC-specific policies, and complywith HHS-specific policies for protecting PII. To this end, all contractors and subcontractorsshall protect all sensitive information, including any PII created, stored, or transmitted in theperformance of this contract so as to avoid a secondary sensitive information incident withFIPS 140-2 validated encryption.

3.All contractors and subcontractors shall participate in regular training on how to identifyand report a breach.

4.All contractors and subcontractors shall report a suspected or confirmed breach in anymedium as soon as possible and no later than 1 hour of discovery, consistent with applicableCDC IT acquisitions guidance, HHS/CDC and incident management policy, and UnitedStates Computer Emergency

Readiness Team (US-CERT) notification guidelines. To thisend, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators ofCompromise (IOCs) provided by HHS

Computer Security Incident Response Center(CSIRC) or CDC Computer Incident Response Team

(CSIRT) within 24 hours via email atcsirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative.

5.All contractors and subcontractors shall be able to determine what Federal informationwas or could have been accessed and by whom, construct a timeline of user activity,determine methods and techniques used to access Federal information, and identify theinitial attack vector.

6.All contractors and subcontractors shall allow for an inspection, investigation, forensicanalysis, and any other action necessary to ensure compliance with HHS/CDC Policy and theHHS/CDC Breach

Response Plan and to assist with responding to a breach.

7.Cloud service providers shall use guidance provided in the FedRAMP IncidentCommunications

Procedures when deciding when to report directly to US-CERT first ornotify CDC first.

8.Identify roles and responsibilities, in accordance with HHS/CDC Breach ResponsePolicy and the

HHS/CDC Breach Response Plan. To this end, the Contractor shall NOTnotify affected individuals unless and until so instructed by the Contracting Officer ordesignated representative. If so instructed by the Contracting Officer or representative, allnotifications must be pre-approved by the appropriate

CDC officials, consistent withHHS/CDC Breach Response Plan, and the Contractor shall then send

CDC- approvednotifications to affected individuals; and, 9.Acknowledge that CDC will not interpret report of a breach, by itself, as conclusiveevidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

Position Sensitivity Designations

1.All Contractor (and/or any subcontractor) employees must obtain a backgroundinvestigation commensurate with their position sensitivity designation that complies withParts 1400 and 731 of

Title 5, Code of Federal Regulations (CFR).

Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security

Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal

Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of

Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1§1.2.

Roster.

The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a Government information system(s). The roster shall be submitted to the COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the

Government will determine the appropriate suitability level.

Contract Initiation and Expiration

1.General Security Requirements. The Contractor (and/or any subcontractor)shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012). HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html CDC EPC Requirements: https://www2a.CDC.gov/CDCup/library/other/eplc.htm

2.System Documentation. Contractors (and/or any subcontractors) must follow andadhere to NIST

SP 800-64, Security Considerations in the System Development Life Cycle,at a minimum, for system development and provide system documentation at designatedintervals (specifically, at the expiration of the contract) within the EPLC that require artifactreview and approval.

3.Sanitization of Government Files and Information. As part of contract closeout and atexpiration of the contract, the Contractor (and/or any subcontractor) shall provide allrequired documentation to the CO and/or COR to certify that, at the Government’s direction,all electronic and paper records are appropriately disposed of and all devices and media aresanitized in accordance with NIST SP 800-

88, Guidelines for Media Sanitization.

4.Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or CORand system ISSO before an employee stops working under this contract.

5.Contractor Responsibilities Upon Physical Completion of the Contract. Thecontractor (and/or any subcontractors) shall return all Government information and ITresources (i.e., Government information in non-Government-owned systems, media, andbackup systems) acquired during the term of this contract to the CO and/or COR.Additionally, the Contractor shall provide a certification that all Government informationhas been properly sanitized and purged from Contractor-owned systems, including backupsystems and media used during contract performance, in accordance with

HHS and/or CDCpolicies.

6.The Contractor (and/or any subcontractor) shall perform and document the actionsidentified in the

CDC Out-Processing

Checklist(http://intranet.cdc.gov/od/hcrmo/pdfs/hr/Out_Processing_Checklist.pdf) when an employeeterminates work under this contract. All documentation shall be made available to the

COand/or COR upon request.

Records Management and Retention

1.The Contractor (and/or any subcontractor) shall maintain all information in accordancewith

Executive Order 13556 -- Controlled Unclassified Information, National Archivesand Records

Administration (NARA) records retention policies and schedules and HHSpolicies and shall not dispose of any records unless authorized by HHS.

2.In the event that a contractor (and/or any subcontractor) accidentally disposes of ordestroys a record without proper authorization, it shall be documented and reported as anincident in accordance with HHS policies.

Deliverables Deliverable

Title/Deliverable Type Description Due Date

Roster Roster Within 30 days of the effective date of this contract

Contractor Employee Non-

Disclosure Agreement (NDA)

Contractor Employee Non-

Disclosure Agreement

(NDA)

Prior to performing any work on behalf of HHS

Privacy Threshold Analysis Assist in the completion of a Within 60-90 days after

(PTA)/ Privacy Impact

Assessment (PIA)

PTA/PIA form contract award

Training Records Copy of training records for all mandatory training

In conjunction with contract award and annually thereafter or upon request

Rules of Behavior Signed ROB for all employees

Initiation of contract and at least annually thereafter

Incident Response Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

Personnel Security

Responsibilities

List of Personnel with defined roles and responsibilities

Within 7 days; that is before an employee begins working on this contract.

Personnel Security

Responsibilities

Off-boarding documentation, equipment and badge when leaving contract

Within 5 days or less after the Government’s final acceptance of the work under this contract, or in the event of a termination of the contract.

Background Investigation Onboarding documentation when beginning contract.

Prior to performing any work on behalf of HHS

Certification of Sanitization of Government and

Government Activity-

Related Files, Information, and Devices.

Form or deliverables required by OpDiv.

At contract expiration.

Contract Initiation and

Expiration

If the procurement involves a system or cloud service, additional documentation will be required, such as

Disposition/Decommission

Plan

At contract expiration

Paperwork Reduction Act (PRA):

PRA has been determined not applicable to this task order. However, offerors are advised that any activities involving information collections (i.e., surveys, questionnaires, applications, audits, data requests, reporting, recordkeeping and disclosure requirements, etc.) from 10 or more non-Federal entities, including State and local governmental agencies, are subject to the conditions of the PRA.

Under the PRA, a Federal agency sponsoring a standardized data collection or directly obtaining standardized or substantially similar information from ten or more persons or entities (other than

Federal employees within the scope of their employment) in any 12-month period must obtain advance written approval from the Office of Management and Budget (OMB).” Regardless of form or format (oral, written, or electronically transmitted), responses of opinion or fact requested or required by or for CDC, except those specifically exempted or excluded, are subject to the provisions of the PRA and its implementing regulation, 5 CFR 1320 (Controlling Paperwork Burdens on the

Public).” The program agrees to submit a separate

PRA determination for each information collection activity upon awarding of funds. All such information collections must undergo OMB project determinations by CDC and may require OMB

PRA clearance prior to the start of the proposed activity.

Human Subjects Protections in Research

This contract does not involve research with human subjects as defined in 45 CFR Part 46 (Common

Rule). No activities conducted under this contract will include direct interaction or intervention with human subjects, nor will they involve the collection of identifiable private information for research purposes.

Accordingly, Institutional Review Board (IRB) review and approval are not required, and human subjects protections requirements are not applicable to this contract.

Human Subjects Protections in Research

Paperwork Reduction Act (PRA)

Printing

Section 508 Compliance

Part A – Provision

Reference HHSAR 352.239-73[8] Electronic Information and [Communication] Technology

Accessibility Notice.

(Deviation)

(a) Any offeror responding to this solicitation must comply with established HHS Information and Communication Technology (ICT) accessibility standards. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-79 Information and Communication Technology Accessibility. In order to facilitate the Government’s determination whether proposed ICT supplies, products, platforms, information, and documentation meet applicable Section 508 accessibility standards, offerors must submit an appropriate HHS Section 508 Accessibility Conformance Checklist

(see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an

Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility

Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), in accordance with the completion instructions. The purpose of the checklists and conformance reports are to assist HHS acquisition and program officials in determining whether proposed ICT supplies, products, platforms, information, and documentation conform to applicable Section 508 accessibility standards. Checklists and ACRs evaluate—in detail—whether the ICT conforms to specific

Section 508 accessibility standards and identifies remediation efforts needed to address conformance issues.

(c) If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies, products, platforms, information, documentation, or services support delivered do not conform to the described accessibility standards, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(d) In order to facilitate the Government's determination whether proposed ICT supplies meet applicable Section 508 accessibility standards, offerors must submit an Accessibility

Conformance Report, in accordance with its completion instructions and tailored to the requirements in the solicitation.