A19. 75D301-26-Q-79261.pdf

COMBINED SYNOPSIS/SOLICITATION FOR SYSTEMATIC INFORMATION REVIEW AND

LITERATURE VALIDATION SUPPORT SERVICES

Solicitation Number: 75D301-26-Q-79261

Part 1 – Introduction

i. This is a combined synopsis/solicitation for commercial services prepared under FAR Subpart 12.6. This announcement constitutes the only solicitation; a written solicitation will not be issued.

ii. The solicitation number is 75D301-26-Q-79261, issued as a Request for Quotation

(RFQ).

iii. Provisions and clauses in effect are those of the current Federal Acquisition Circular: FAC 2026-01, dated 03/13/2026.

iv. NAICS Code: 541990 – All Other Professional, Scientific, and Technical Services;

Small Business Size Standard: $19.5M. This is a 100% small business set-aside.

v. This is a performance-based service acquisition under FAR 37.602. The Government contemplates award of a single Firm-Fixed-Price, deliverable-based commercial services contract with a nonseverable, fully funded 36-month period of performance organized into Contract Years 1–3.

Part 2 – Background and Purpose

The Centers for Disease Control and Prevention (CDC), National Institute for Occupational Safety and Health (NIOSH), conducts scoping reviews, systematic reviews, and meta-analyses under the Occupational Safety and Health Act of 1970 (29 U.S.C. § 669) to inform evidence-based recommendations, hazard evaluations, and public health guidance for occupational settings.

NIOSH seeks a commercially available, end-to-end automated service — which may incorporate artificial intelligence with human-in-the-loop features — to support systematic information review lifecycles and generate traceable, reproducible pools of scientific literature underpinning occupational safety and health (OSH) risk management strategies across multiple topics and years. This acquisition is for the application, configuration, validation, and refinement of an existing commercial service under a modified commercial service determination (FAR 2.101(3)(i)/(ii)); it is not for the purchase, development, or operation of a standalone platform, software product, source code, or Government-owned federal information system.

Part 3 – Section B: Supplies or Services and Prices/Costs

The Contractor shall provide commercial systematic review and evidence synthesis support services in accordance with the PWS (Part 4), under a deliverable-based, Firm- Fixed-Price CLIN structure across the 36-month period of performance.

CLIN Description Contract Year

Unit Qty

0001 Initial validation using first NIOSH/REB starting set (kickoff; initial/repeat search;

comparative analysis)

CY 1 Job 1

0002 Secondary validation search package and summary report

CY 1 Job 1

0003 Additional starting set evaluation package and summary report

CY 2 Job 1

0004 Specific service-type topic evaluation package and summary report

CY 2 Job 1

0005 Minimal and key change assessment reports

CY 2 Job 1

0006 Minimal change effectiveness report CY 2 Job 1

0007 Key change effectiveness report CY 2 Job 1

0008 Priority modification implementation plan and progress reporting

CY 2 Job 1

0009 Updated service methodology search results package – 1st CY3 strategy category

CY 3 Job 1

0010 Evaluation summary report – 1st CY3 strategy category

CY 3 Job 1

0011 Updated service methodology search results package – 2nd CY3 strategy category

CY 3 Job 1

0012 Evaluation summary report – 2nd CY3 strategy category

CY 3 Job 1

Payment for each CLIN is contingent upon Government acceptance of the associated deliverable(s), per PWS Section 9.0. No payment is authorized absent a completed, accepted deliverable.

Offerors shall submit a pricing sheet consistent with this CLIN structure. If an offeror's commercial pricing model differs (e.g., subscription/license plus labor), the offeror shall map its standard pricing structure to this CLIN framework and explain any variance in its business/price proposal.

Part 4 – Statement of Work (Performance Work Statement)

1.0 Purpose

This PWS supports CDC/NIOSH's use of the best available commercial service for systematic information review lifecycles and literature validation, including the human-in-the-loop labor necessary to evaluate, refine, and apply that service to OSH evidence-generation workflows. As noted in Part 2, this acquisition is not for a standalone platform, software product, source code, or Government-owned system. The objective is to determine whether the contractor's service and methodology can generate literature pools and analytic outputs that are useful, reproducible, auditable, and comparable to NIOSH/REB-generated results.

2.0 Background

NIOSH conducts scoping reviews, systematic reviews, and meta-analyses under the OSH Act of 1970 to inform evidence-based recommendations and public health guidance for occupational settings. This process forms the foundation for synthesizing scientific information into workplace safety recommendations and prevention strategies across diverse industries.

NIOSH reviews often span large volumes of human epidemiologic, animal toxicology, and mechanistic/in vitro literature. Rigorous, reproducible review requires at minimum two independent title/abstract screeners, full-text review, structured data extraction, bias evaluation, and quantitative/qualitative synthesis (NIOSH 2020). Current methods are resource-intensive, often taking months to years, due to limited staff, competing demands on staff time, and large information volumes. AI tools that can replicate human review tasks would streamline this process.

Epidemiological evidence for OSH is predominantly observational (case-control or cohort), with randomized trials rarely available — a factor affecting both which evidence is suitable for recommendations and how bias is assessed. Synthesizing human, animal, and mechanistic data in appropriate combinations requires correctly targeted evidence identification when scoping exposure-outcome associations for risk mitigation.

Developing an equivalent capability in-house would require substantial upfront investment in design, development, testing, and validation, plus ongoing costs for hosting, cybersecurity, updates, quality assurance, and staffing. NIOSH has therefore determined it is more cost-effective to acquire an existing commercial service, with appropriate Government usage rights, than to build a new one. This effort is intended to improve the efficiency, traceability, and reproducibility of OSH evidence synthesis while advancing Federal adoption of AI-assisted evidence methods.

2.1 References

• Abogunrin, S., Muir, J. M., Zerbini, C., & Sarri, G. (2025). How much can we save by applying artificial intelligence in evidence synthesis? Frontiers in Pharmacology, 16, 1454245.

• Exec. Order No. 14,179, 90 FR 8741 (2025). Removing Barriers to American Leadership in Artificial Intelligence.

• Exec. Order No. 14,365, 90 FR 58499 (2025). Ensuring a National Policy Framework for Artificial Intelligence.

• Michelson, M., & Reuter, K. (2019). The significant cost of systematic reviews and meta-analyses. Contemporary Clinical Trials Communications, 16, 100443.

• NIOSH [2020]. Current Intelligence Bulletin 69: NIOSH Practices in Occupational Risk Assessment. DHHS (NIOSH) Publication No. 2020-106 (Revised 03/2020).

• OSHA [1970]. OSH Act of 1970, Public Law 91-596, 84 Stat. 1590, as amended through January 1, 2004.

• Tóth, B., Berek, L., Gulácsi, L., Péntek, M., & Zrubka, Z. (2024). Automation of systematic reviews of biomedical literature. Systematic Reviews, 13(1), 174.

3.0 Objectives

The Contractor shall provide a commercially available service, trained personnel, project controls, and required documentation sufficient to: (1) conduct phased validation of literature search outputs against classic, human-generated published outputs; (2) provide search outputs and extracted information consistent with standard systematic review extraction procedures; (3) identify service workflow, business logic, and data-quality issues; (4) recommend and implement prioritized changes; and (5) apply the improved service in later contract years to additional risk-management strategy categories and topics designated by NIOSH/REB.

At baseline, the service shall be able to conduct data extraction; auto-populate structured, editable Excel extraction forms with quotes and page numbers per field; apply table parsing and OCR to tables/figures; and support human-in-the-loop review. It shall also conduct data synthesis and meta-analysis, auto-select and extract appropriate effect measures (e.g., relative risks, odds ratios, mean differences) with human-in-the-loop review, generate meta-analytic models, and produce narrative summaries.

4.0 Scope

The Contractor shall provide commercial systematic review and evidence synthesis support services for CDC/NIOSH OSH topics. At baseline, the service shall support human-in-the-loop workflows and produce traceable, reproducible, auditable outputs. The Government is procuring a service outcome, not a standalone technology platform, software product, source code, or Government-owned information system.

This is a performance-based acquisition. The Contractor is responsible for achieving PWS outcomes while maintaining auditable outputs, configuration control over changes affecting outputs, and traceability between inputs, outputs, and conclusions. Using its existing platform at time of award, the Contractor shall: generate and refine literature retrieval outputs; support title/abstract and full-text review workflows; produce structured outputs and documentation; conduct comparative/QA analyses against NIOSH-provided starting information and human-generated results; identify gaps and improvement opportunities; and implement approved platform or workflow modifications within the 36-month period of performance.

Work shall span multiple OSH topics, review types, and evidence streams (human, animal, mechanistic/in vitro), as directed by the Government. Outputs shall be provided in Government-specified formats (e.g., Excel, CSV, RIS, EndNote-compatible files, PDF, narrative reports) with sufficient documentation of methods, decision logic, comparison points, and version history to enable review, replication, and performance assessment.

The Contractor shall collaborate through recurring project management activities — kickoff and biweekly progress meetings, pre-meeting summaries, and iterative revision cycles — and shall provide recommendations for workflow and platform refinements per Section 7.0.

This effort evaluates and applies an existing commercial service; except as required for configuration, refinement, or modification of existing capabilities under awarded tasks, it does not include creation of a new platform, unrelated R&D, or open-ended configuration outside the task structure, deliverables, and period of performance set forth herein.

The service will process only publicly available scientific and technical information (bibliographic records, abstracts, full-text publications, reports, supplemental materials). It will not process sensitive personal information, protected health information, classified information, or non-public CDC data.

Scope by year: CY1 — initial validation, comparative analysis, secondary validation; CY2 — additional evaluations, change assessments, effectiveness reviews, prioritized modification implementation; CY3 — updated-platform testing on additional NIOSH review topic categories.

5.0 Definitions & Acronyms

Term Definition

REB Risk Evaluation Branch (NIOSH/DSI)

COR/PO Contracting Officer's Representative / Project Officer

NIOSH National Institute for Occupational Safety and Health

OSH Occupational safety and health

POC Point of Contact

GFI/GFP Government-Furnished Information/Property

QASP/PRS/CDRL/IGCE Quality Assurance Surveillance Plan;

Performance Requirements Summary;

Contractor Data Requirements List; Independent Government Cost Estimate

ICT Information and Communication Technology

FCI Federal Contract Information

FIPS Federal Information Processing Standards

SCAP Security Content Automation Protocol

FDCC Federal Desktop Core Configuration

POA&M Plan of Action and Milestones

6.0 Period and Place of Performance

The contract is a 36-month, fully funded period of performance organized into Contract Years 1–3 for schedule and deliverable-management purposes. Where a task-specific schedule is expressed relative to receipt of Government information, comments, or a milestone, that schedule controls.

The principal place of performance is the contractor facility or approved contractor-hosted environment, with virtual collaboration as the default method of interaction unless the Government directs otherwise.

7.0 Performance Requirements

7.1 General Performance Requirements

The Contractor shall maintain the commercial service framework in a manner that preserves auditability and reproducibility, including a configuration-controlled record of material platform changes, model/service updates affecting outputs, search-approach refinements, and data-processing changes materially affecting generated literature pools or analytics. At baseline, the service shall support human-in-the-loop workflows and produce traceable, reproducible, auditable outputs. All outputs shall be delivered in industry-standard formats acceptable to NIOSH/REB, with acceptable file formats confirmed not later than 2 weeks before each results-package delivery where required.

Governing requirement for all CLINs (0001–0012): the Contractor shall attend biweekly progress meetings throughout the 36-month period of performance, provide a pre-meeting overview at least 24 hours in advance, and maintain recurring written status updates, action tracking, and modification forecasting.

7.2 Contract Year 1 Performance Requirements

CLIN Service Requirement Time Standard / Trigger

0001 Attend kickoff meeting.

Validate the platform using the first NIOSH/REB starting set for a hazard identification activity; conduct initial and repeat searches; compare outputs to human-generated results provided by

NIOSH/REB.

Kickoff organized by PO/COR within 2 weeks of award. Begin within 1 month of receiving starting information. Initial outputs due within 2 months.

Follow-on repeat/comparison work follows Section 9.0 feedback cycles.

0002 Apply the process to a starting set from a different NIOSH risk-management strategy type and compare to previously published work for validation.

Begin within 1 month after the CLIN 0001 final feedback trigger and receipt of Government comparison information.

7.3 Contract Year 2 Performance Requirements

CLIN Service Requirement Time Standard / Trigger

0003 Evaluate additional starting sets/topics for the service-type evaluated in CLIN 0002, for topics with existing NIOSH in-house validation information.

Begin within 1 month after CLIN 0002 feedback and receipt of Government starting sets.

0004 Apply the process to additional topics for the same service-type lacking validated information, as a pilot for the modified service.

Begin within 1 month after CLIN 0003 feedback and receipt of Government topic information.

0005 Identify minimal and key platform changes and summarize improvement needs.

Begin within 1 month after review of CLIN 0004 feedback.

0006 Evaluate effectiveness of minimal changes and identify additional minimal improvements.

Draft due within 1 month after Government confirmation changes are ready for evaluation; Government review 4 weeks; final due within 2 weeks after comments.

0007 Evaluate effectiveness of key changes and identify additional key improvements.

Draft due within 2 months after Government confirmation changes are ready for evaluation; Government review 6 weeks; final due within 4 weeks after comments.

0008 Implement Government-prioritized minimal and key changes; document plan and progress.

Plan due after Government prioritization; progress updates as agreed; draft summary due not later than 3 months before end of CY2.

7.4 Contract Year 3 Performance Requirements

CLIN Service Requirement Time Standard / Trigger

0009 Generate literature pools for the first CY3 Government-designated strategy category using updated service methods.

Search results package due not later than 2 months after CY3 start and receipt of Government starting information.

0010 Evaluate updated platform performance for the first CY3 category and identify further improvement opportunities.

Draft due not later than 6 months after CY3 start, or as otherwise directed; final due after Government review.

0011 Generate literature pools for the second CY3 Government-designated strategy category using updated service methods.

Search results package due not later than 7 months after CY3 start and receipt of Government starting information.

0012 Evaluate updated platform performance for the second CY3 category and identify additional improvement needs.

Draft due not later than 3 months before end of CY3; final due after Government review and before contract closeout.

8.0 Applicable Documents, Standards, and Regulatory Framework

The Contractor shall comply with all applicable Federal statutes, regulations, policies, standards, and directives associated with this modified commercial services requirement.

The contract file will incorporate only those FAR and HHSAR clauses and provisions needed for this acquisition, based on the commercial-services strategy, contractor-operated/hosted environment, Federal contract information handling, records/data rights, and ICT accessibility requirements. Final clause inclusion is subject to Contracting Officer review against the FAR, HHSAR, and active HHS class deviations in effect at solicitation issuance and award.

9.0 Deliverables and Reporting Schedule

Deliverables shall be provided in the formats and timeframes below unless modified in writing by the Contracting Officer. Relative schedules keyed to receipt of Government information, comments, or direction control where more specific than Section F.

Each CDRL item also includes a biweekly status overview and progress report, per the governing requirement in Section 7.1; this is not repeated in each row below.

CDRL CY Months After Kickoff

Deliverable CLIN Format Draft/Initial Due Gov't Review

Final Due

A001 1 0 Kickoff meeting materials and startup agenda

0001 Email memo/agenda/slide deck

Not later than 2 weeks after contract start

During kickoff

Completed at kickoff

A002 1 2 Initial search results package – first validation set

0001 Excel/EndNote/other approved format

Not later than 2 months after receipt of starting information

4 weeks Corrected package as directed

A003 1 2–3 Initial search draft/final summary report – first validation set

0001 Word/PDF Not later than 2 months after receipt of starting information

4 weeks Within 2 weeks after comments

A004 1 4–6 Repeat search results package and publication PDFs – first validation set

0001 Excel/EndNote/PDF library Not later than 2 months after Government feedback initiating repeat phase

4 weeks Corrected package as directed

A005 1 7–9 Initial vs. repeat and human-generated comparative report

0001 Word/PDF With repeat-search analysis or as directed

4 weeks Within 2 weeks after comments

A006 1 10–12 Secondary validation search package and summary report

0002 Excel/EndNote/Word/PDF Not later than 2 months after first validation-set feedback cycle

4 weeks Within 2 weeks after comments

A007 2 13–14 Additional starting set evaluation package and summary report

0003 Excel/EndNote/Word/PDF Per Government schedule after secondary validation feedback cycle

4 weeks After comment cycle

A008 2 15–16 Specific service-type topic evaluation package and summary report

0004 Excel/EndNote/Word/PDF Per Government schedule after starting-set evaluation feedback cycle

4 weeks After comment cycle

A009 2 17 Minimal and key change assessment report and updated search results

0005 Word/PDF/search files Per approved schedule after topic evaluation feedback

4 weeks Corrected package as directed

A010 2 18 Minimal change effectiveness report

0006 Word/PDF Not later than 1 month after confirmation of readiness

4 weeks Within 2 weeks after comments

A011 2 19–20 Key change effectiveness report

0007 Word/PDF Not later than 2 months after confirmation of readiness

4 weeks Within 2 weeks after comments

A012 2 17–24 (draft by Mo. 21)

Priority modification implementation plan and progress reporting

0008 Word/PDF/email updates After Government prioritization

4 weeks Draft summary not later than 3 months before end of CY2

A013 3 26 CY3 updated-platform search results package – first strategy category

0009 Excel/EndNote/other approved format

Not later than 2 months after CY3 start

4 weeks Corrected package as directed

A014 3 30 CY3 evaluation summary report – first strategy category

0010 Word/PDF Not later than 6 months after CY3 start, or as directed

4 weeks After comment cycle

A015 3 31 CY3 updated-platform search results package – second strategy category

0011 Excel/EndNote/other approved format

Not later than 7 months after CY3 start

4 weeks Corrected package as directed

A016 3 33 draft / 36 final

CY3 evaluation summary report – second strategy category

0012 Word/PDF Not later than 3 months before end of

CY3

4 weeks After comment cycle and before contract closeout

Each deliverable will be evaluated for acceptance against the criteria defined in this PWS.

The Government shall pay the Contractor the specified amount for each deliverable only upon Government acceptance.

9.1 Deliverable Update Process

Each draft, revised, final, corrected, or updated deliverable is a configuration-controlled submittal. The Contractor shall assign a unique version identifier, preserve the prior version, and accompany each revised submittal with a change summary identifying material changes, assumptions, and Government comments addressed.

Unless a task-specific schedule governs, revised deliverables are due within 10 business days after receipt of consolidated Government comments, accompanied by a comment-response matrix (comment, disposition, location of update). No post-acceptance substantive change shall be made without Contracting Officer direction or written Government authorization.

10.0 Quality Assurance and Surveillance

The Government will evaluate performance using 100 percent inspection of critical deliverables, schedule surveillance, meeting attendance review, technical review, and security/accessibility review as applicable.

Deficiencies may be documented via written comments, meeting minutes, acceptance memoranda, or deficiency notices from the COR or Contracting Officer. The Contractor shall promptly correct deficiencies at no additional cost unless the Government directs a contract change.

Surveillance Area Objective Method Frequency Government Action

Schedule adherence Timely start and completion of task-triggered work

Review against Section F dates and task-triggered due dates

Biweekly and at each submittal

COR issues deficiency notice or requests corrective action plan.

Technical quality Completeness and validity of search results and analyses

100 percent inspection of deliverables and subject matter review

At each draft and final submittal

Contractor revises and resubmits with change log and comment matrix.

Format and usability Government-approved file types and readable deliverables

Open, test, and inspect all files upon receipt

At each data package

Replace unusable files within Government-directed timeframe.

Program management Recurring meeting support and status communication

Attendance review and inspection of pre-meeting overview and action log Biweekly

Discuss in meeting and document in action tracker.

Security and privacy Compliance with HHS and CDC security requirements

Review plans, access records, incident notifications, and assessment artifacts

Before system use and during performance

Immediate corrective action and possible suspension of access pending remediation.

Digital accessibility Conformance of ICT and document deliverables with HHS digital accessibility expectations

Accessibility inspection and testing of representative deliverables

At initial submission and before final acceptance

Remediation at no additional cost before Government acceptance.

11.0 Contract Line Item Number (CLIN) Structure

The table below maps the 36-month task structure to contract administration units for pricing, funding, and monitoring, consistent with Sections 7.2–7.4 above.

CY CLIN Title Major Work Elements

Primary Deliverables

PWS

Ref.

1 0001 Initial validation

– first

NIOSH/REB

starting set

Kickoff; validate platform on first starting set;

initial and repeat searches;

compare to human-generated results.

Kickoff materials;

search packages;

draft/final summary and comparative analysis reports.

7.2

1 0002 Secondary validation – different strategy type

Apply process to a different NIOSH risk-management strategy type;

compare to prior published work.

Secondary validation search package and summary report.

7.2

2 0003 Additional starting set evaluation

Evaluate additional starting sets/topics with existing NIOSH validation data.

Search packages;

draft/final summary report; QA metrics and findings.

7.3

2 0004 Specific topic evaluation

Apply process to topics without validated information (pilot).

Search packages;

publication PDFs;

draft/final summary reports.

7.3

2 0005 Minimal and key change assessment

Identify minimal/key platform

Change assessment report and

7.3 changes;

summarize improvement needs.

updated search results.

2 0006 Minimal change effectiveness evaluation

Evaluate effectiveness of minimal changes; identify further improvements.

Draft/final minimal change effectiveness report.

7.3

2 0007 Key change effectiveness evaluation

Evaluate effectiveness of key changes;

identify further improvements.

Draft/final key change effectiveness report.

7.3

2 0008 Priority modification implementation

Implement Government-prioritized changes;

document approach and outcomes.

Modification plan, progress reporting, draft summary report.

7.3

3 0009 Updated methodology – first strategy category

Generate literature pools using updated methods for first CY3 category.

Search results package.

7.4

3 0010 Evaluation summary – first strategy category

Evaluate updated performance;

identify further improvements.

Draft/final evaluation summary report.

7.4

3 0011 Updated methodology – second strategy category

Generate literature pools using updated methods for second CY3 category.

Search results package.

7.4

3 0012 Evaluation summary – second strategy category

Evaluate updated performance;

identify additional improvements.

Draft/final evaluation summary report.

7.4

12.0 Government Furnished Property/Information

The Government will provide the initial starting set of information, human-generated comparison material when available, and written feedback per the task structure above, and will identify acceptable delivery formats and review/acceptance timing in accordance with the schedule or as otherwise directed by the Contracting Officer or COR.

Government-provided information and data remain Government property; Contractor use to perform this PWS confers no rights to that information (FAR 52.227-14, Rights in Data – General). The Government retains rights to all information and data the Contractor generates in performing this contract, and to the business logic, workflow logic, configuration, validation materials, documented methods, and instruction/documentation manuals for the modified service and its updates, in perpetuity (FAR 52.227-19).

13.0 Baseline Security Requirements

1) Applicability.

The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following: a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information. b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the

Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems.

In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization.

In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: Low [ X] Moderate [ ] High Integrity: [ ] Low [X ] Moderate [ ] High Availability: [ ] Low [X ] Moderate [ ] High Overall Risk Level: [ ] Low [X ] Moderate [ ] High [ ]

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves: [X ] No PII [ ] Yes PII

4) Personally Identifiable Information (PII).

Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc. PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg.

63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be: a. marked appropriately; b. disclosed to authorized personnel on a Need-To-Know basis; c. protected in accordance with NIST SP

800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies.

Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations: a. 18 U.S.C. 641 (Criminal Code:

Public Money, Property or Records); b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate. See Appendix D for baseline deliverables.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall: a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information. b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution. c.

Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII). d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR. e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition. See Appendix C for the Contractor Non-Disclosure Agreement.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities.

Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on. A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states: Definition of an Incident: An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. It further adds: A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”. Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements: 1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach. 2) All contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting PII. To this end, all contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption. 3) All contractors and subcontractors shall participate in regular training on how to identify and report a breach. 4) All contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC and incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866- 655-2245, whether the response is positive or negative. 5) All contractors and subcontractors shall be able to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector. 6) All contractors and subcontractors shall allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with HHS/CDC Policy and the HHS/CDC Breach Response Plan and to assist with responding to a breach. 7) Cloud service providers shall use guidance provided in the FedRAMP Incident Communications Procedures when deciding when to report directly to US-CERT first or notify CDC first. 8) Identify roles and responsibilities, in accordance with HHS/CDC Breach Response Policy and the HHS/CDC Breach Response Plan. To this end, the Contractor shall NOT notify affected individuals unless and until so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, all notifications must be pre-approved by the appropriate CDC officials, consistent with HHS/CDC Breach Response Plan, and the Contractor shall then send CDC- approved notifications to affected individuals; and, 9) Acknowledge that CDC will not interpret report of a breach, by itself, as conclusive evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

E. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The requiring activity representative, in conjunction with Personnel Security, shall use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

F. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. . For additional information, see HSPD-12 policy at:

https://www.dhs.gov/homeland-security-presidentialdirective-12) Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

G. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012). HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html CDC EPC Requirements:

https://www2a.CDC.gov/CDCup/library/other/eplc.htm 2) System Documentation.

Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation…