A19- RFP 75D301-26-R-73414.pdf

PAGES

15A. NAME

AND

ADDRESS

OF

OFFEROR

SEC. PAGE(S) SEC. PAGE(S)

(Date) (Hour)

CALENDAR DAYS

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amend-ments to the SOLICITATION for offerors and related documents numbered and dated:

(Type or Print)

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

1 112

2. CONTRACT NO.

3. SOLICITATION NO.

75D301-26-R-73414

4. TYPE OF SOLICITATION

SEALED BID (IFB)

X NEGOTIATED (RFP)

5. DATE ISSUED

3/2/2026

6. REQUISITION/PURCHASE

NO.

7. ISSUED BY CODE 15948 8. ADDRESS OFFER TO (If other than Item 7)

OFR - Office of Acquisition Services

Chamblee Campus Building 108

4770 Buford Highway

Atlanta, GA 30341-

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in See Section L until 2:00p local time 4/02/2026

CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Sheena Delaine

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2974

C. E-MAIL ADDRESS

Kpz5@cdc.gov

11. TABLE OF CONTENTS

(x) DESCRIPTION (x) DESCRIPTION

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 903

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 8 X J LIST OF ATTACHMENTS 104

X D PACKAGING AND MARKING 52 PART IV – REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 53 REPRESENTATIONS, CERTIFICATIONS, AND

X F DELIVERIES OR PERFORMANCE 54 X K OTHER STATEMENTS OF OFFERORS 105

X G CONTRACT ADMINISTRATION DATA 55 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 111

X H SPECIAL CONTRACT REQUIREMENTS 57 X M EVALUATION FACTORS FOR AWARD 117

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

AMENDMENT NO. DATE AMENDMENT NO. DATE

CODE FACILITY 16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 15948 25. PAYMENT WILL BE MADE BY CODE 434

OFR - Office of Acquisition Services

Chamblee Campus Building 108

4770 Buford Highway

Atlanta, GA 30341-

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE Prescribed by GSA

FAR (48 CFR) 53.214©

K

RFP# 75D301-26-R-73414

Section B - Supplies Or Services And Prices/Costs

Base Period, Year 1: 05/01/2026 – 04/30/2027

ITEM SUPPLIES/SERVICES QTY/UNIT UNIT PRICE EXTENDED PRICE

Technical Support Services

Services to be performed as outlined in the SOW as specifically ordered for

(Tasks 1 - 3).

Period of Performance: 05/01/2026 -

04/30/2027

Firm Fixed Price Line Item

Severable Line Item

1 Job

Legacy Systems Maintenance &

Transition (Optional Task 4)

Respondent Remuneration Costs (Task

5)

(See Section 6, Subsection B-Contract support hours for survey respondents in accordance with Task 5 as described in the Statement of Work. Hours for this are estimated for purposes only for

Remuneration costs for one Project)

Severable Line Item Cost

Reimbursement Line Item

Advertisement (Optional Task 6)

0005 Optional Purchase - Qualtrics or the equivalent (Task 4.1)

Base Period Total aggregate amount $________________

Option Period 1, Year 2 - 05/01/2027 – 04/30/2028

Technical Support Services

(Tasks 1 - 3)

Period of Performance:

05/01/2027 - 04/30/2028

Legacy Systems Maintenance

& Transition (Optional Task 4)

Remuneration (Task 5)

(See Section 6, Subsection B-

Contract support hours for survey respondents in accordance with Task 5 as described in the Statement of

Work. Hours for this are estimated for purposes only for

Remuneration costs for one

Project)

Cost Reimbursement Line

Item

Advertisement

(Optional Task 6)

Optional Purchase - Qualtrics or the equivalent (Task 4.1)

Option Period 1 Total aggregate amount $______________

Option Period 2, Year 3- 05/01/2028 – 04/30/2029

ITEM SUPPLIES/SERVICES QTY/UNIT UNIT PRICE TOTAL

2001 Technical Support Services

05/01/2028 - 04/30/2029

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

2002 Legacy Systems Maintenance

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

2003 Remuneration (Task 5)

(See Section 6, Subsection B-

Contract support hours for survey respondents in accordance with Task 5 as described in the Statement of

Work. Hours for this are estimated for purposes only for

Cost Reimbursement CLIN

05/01/2028 - 04/30/2029

Cost Reimbursement Line

Item

Severable Line Item

1 Job $ $

2004 Advertisement

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

2005 Optional Purchase - Qualtrics

Firm Fixed Price Line Item

1 Job $ $

Option Period 2 Total aggregate amount $________________

Option Period 3, Year 4: 05/01/2029-04/30/2030

3001 Technical Support Services

05/01/2029 - 04/30/2030

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

3002 Legacy Systems Maintenance

Firm Fixed Price Line Item

Severable Line Item

3003 Remuneration (Task 5)

(See Section 6, Subsection B-

Contract support hours for survey respondents in accordance with Task 5 as described in the Statement of

Work. Hours for this are estimated for purposes only for

Cost Reimbursable Line Item

Severable Line Item

1 Job $ $

3004 Advertisement

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

3005 Optional Purchase - Qualtrics

Firm Fixed Price Line Item

Option Period 3 Total aggregate amount $________________

Option Period 4, Year 5: 05/01/2030-04/30/2031

ITEM SUPPLIES/SERVICES QTY/UNIT UNIT PRICE TOTAL

4001 Technical Support Services

05/01/2030 - 04/30/2031

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

4002 Legacy Systems

Maintenance

Transition (Optional Task 4)

Firm Fixed Price Line Item

Severable Line Item

4003 Remuneration (Task 5)

(See Section 6, Subsection

B-Contract support hours for survey respondents in accordance with Task 5 as described in the Statement of Work. Hours for this are estimated for purposes only for Remuneration costs for one Project)

Cost Reimbursable Line

Item

Severable Line Item

1 Job $ $

4004 Advertisement

Firm Fixed Price Line Item

Severable Line Item

1 Job $ $

4005 Optional Purchase - Qualtrics

Firm Fixed Price Line Item

Option Period 4 Total aggregate amount $________________

Total aggregate amount base + options amount $________________

This acquisition is being issued as a Total Small Business Set-Aside in accordance with FAR 19.104-1.

Only Offers from smal business concerns will be considered for award.

NAICS Code for this procurement is 541900 – Other Professional, Scientific, and Technical

Services with a small business size standard of $19,500,000.00.

The Government contemplates award of a Firm Fixed Price type contract.

Section C - Description/Specification/Work Statement

Title: Collaborating Center for Questionnaire Design and Evaluation Research (CCQDER) Mission

Support Services

SECTION 1 – BACKGROUND

The Centers for Disease Control and Prevention (CDC) is recognized as the lead federal agency for protecting the health and safety of people – at home and abroad, providing credible information to enhance health decisions, and promoting health through strong partnerships. CDC serves as the national focus for developing and applying disease prevention and control, environmental health, health promotion and education activities. As part of CDC, the National Center for Health Statistics (NCHS) located in

Hyattsville, Maryland provides statistical information that will guide actions and policies to improve the health of the American People. As the Nation’s principal health statistics agency, NCHS leads the way with accurate, relevant and timely data. Within NCHS, The Division of Research and Methodology

(DRM) plans, coordinates, and stimulates the NCHS' applied and basic research program in the fields of mathematical statistics, survey design and methodology, cognitive and interpretive aspects of survey measurement, and automated statistical, graphical, and geographical technologies, conducts research in each of these fields. The Division serves as the Center's consultants in the fields of survey design and methodology, data collection, data analysis, and question design, and formulates and implements statistical standards in these areas.

Within DRM, The Collaborating Center for Questionnaire Design and Evaluation Research (CCQDER) was established as a resource for CDC, NCHS, and other Federal statistical agencies to develop and test survey instruments. Continuing in this capacity, the fundamental mission of the CCQDER is to improve the quality and usefulness of Federal statistics by improving the reliability and validity of CDC, NCHS survey instruments and providing an understanding of the substantive meaning represented in survey statistics. As an expanding focus, the CCQDER seeks to understand how response processes and response error might differ across socio-cultural or diverse language populations that is necessary for developing comparable health measures intended for global use and among varied cultural and economic populations.

Various qualitative and mixed methods are used by CCQDER researchers to evaluate survey questions including cognitive interviewing, focus groups, usability testing and the Research and Development web-panel survey. Purposive, small samples of respondents are recruited relevant to the survey questions being evaluated to participate in an hour or 1 ½ hour cognitive interview, focus group or in-depth interview and are given remuneration. Cognitive interviews, focus groups and in-depth interviews are audio or video recorded. CCQDER data is protected under the Confidential Information Protection and Statistical

Efficiency Act (CIPSEA) and requires special storage and handling to ensure its confidentiality and integrity.

Customs, internally developed applications were developed to rigorously and systematically examine the cognitive interviewing, focus group, and usability testing data collected by CCQDER. These are: Q-

Video, Q-Notes, Q-Bank and the CCQDER Recruitment Tool. However, CCQDER is phasing these legacy systems out in favor of commercial off-the-shelf (COTS) products and in-house solutions. While

CCQDER currently still relies on, and will require support for, these legacy systems during the transition, the goal is to fully replace them in the near future.

Mission support services are vital to CCQDER’s day-to-day operations. It is the mission of the CCQDER to not only evaluate questions for optimal design, but also to provide documentation supporting the validity of NCHS, CDC and Federal statistical agencies survey data.

This contract will also involve daily interaction between Contractor and CCQDER federal staff for time sensitive activities that require continuity, a high degree of collaborative problem solving, and time sensitive decision making.

SUBSECTION A – ONLINE AND INTERNAL APPLICATIONS

Q-Video is CCQDER's video storage system, used to store and catalogue research recordings, create transcripts, and decommission existing data in a digitized way. As Q-Video is phased out, video and transcript data will be stored on a CIPSEA-approved, internal secure cloud environment.

Q-Notes is a qualitative data analysis program developed to assist in the management of and allow for more rapid, yet thorough systematic collection and analysis of cognitive interviewing studies. Q-Notes provides interviewers and analysts real-time access to interview data and allows interviews to be conducted in multiple geographical regions so that comparability can be examined for multi-national and multi-lingual surveys. As use of Q-Notes is phased out, alternative COTS products (such as Excel or

NVivo) will be utilized.

Q-Bank is an application consisting of evaluated questions from Federal surveys and links each question to the scientific report that evaluated the survey question. Questions are searchable by survey title, question topic, information type, response category, and response error. CCQDER reports are currently hosted on both Qbank and the NCHS publications page. Eventually, Qbank will be phased out.

Additional applications that support CCQDER’s work include the Qualtrics platform for respondent recruitment and respondent database management.

SECTION 2 – PURPOSE/OBJECTIVE

The objective of this acquisition is to support and assist the CDC/NCHS/DRM/CCQDER in performing their mission through management, maintenance, operation, support, and potential development of systems, applications, and methods.

SECTION 3 – SCOPE OF WORK

The contractor shall be responsible for supporting and assisting CCQDER in performing their mission.

The Contractor shall be expected to provide a broad range of skilled personnel in areas including the following: 1) project management; 2) implementation, maintenance and support of CCQDER hardware, systems and applications; 3) managing cognitive interview data; 4) maintenance and transition of

CCQDER legacy systems; 5) remuneration payment to respondents; and 6) coordination of advertisement payments via various outlets for recruitment efforts.

The scope of work incorporates the following contractual tasks:

Task# Scope of Work

Task 1 Project Management

Task 2

Implementation, Maintenance and Support of CCQDER Hardware, Systems and

Applications

Task 3 Cognitive Interview Data Management

Optional Task 4 CCQDER Legacy Systems Maintenance and Transition

Task 5 Remuneration Payment to Respondents

Optional Task 6 Coordination of Advertisement Payments for Recruitment Efforts

SECTION 4 – TASKS TO BE PERFORMED

The contractor shall be required to perform the following tasks for the CCQDER:

Task 1: Project Management

1. Establish e-mail contact with the COR and relevant CCQDER project staff within 5 business days of the contract award and maintain that contact throughout the contract.

2. Schedule in-person kick-off meeting within 7 business days after contract award at

NCHS, Hyattsville, MD. The contractor and at least two of the contractor’s key personnel shall meet with the COR and relevant CCQDER staff to review the tasks and discuss issues related to the conduct of work.

3. Manage contracted employees in completing NCHS Confidentiality Training within 30 business days after contract award or hire.

4. Manage contracted employees in reading and signing Non-disclosure Affidavit

(provided by NCHS/Attachment 1) on the day of employee orientation before starting work.

5. Manage and develop projects without fully developed, defined, or detailed requirements.

6. Manage projects that include video & digitized video recording, digitized database systems, and text data applications in support of structured and ad-hoc research and analysis.

7. Manage hardware and software selection, system, application, and network architecture, development, deployment, documentation, and user orientation in open as well as secure environments.

8. Manage projects in a secure/confidential environment.

9. Manage projects where a high level of confidentiality of respondents’ identifiable data is required.

10. Manage, work, and coordinate with the Cyber Security Program Office (CSPO), the

Office of Chief Information Officer (OCIO), CDC/NCHS Office of Informatics, Governance & Assurance, and the CDC OCIO and/or Infrastructure Services Branch

(ISB).

11. Perform final systems justification and recommendation and sign off as required.

12. Work with CCQDER staff to develop timelines and priorities.

13. Work with Agency, technical, supplier, and program staff at all levels.

14. Work with CCQDER program staff, Office of Acquisition Services (OAS), and the

Financial Management Office (FMO) in matters related to the projects and complete related contract, invoice, documentation and funds balance log.

15. Write and submit monthly Activity/Status Report to the COR summarizing activities outlined in all tasks (1-6). Report is due the 15th business day following the month reported.

Task 2: Implementation, Maintenance and Support of CCQDER Hardware, Systems and

Applications

2.1 - IT Support

1. Maintain list of all CCQDER hardware and software applications

2. Orient or assist in the orientation of CCQDER staff on any updates and/or changes to the internal CCQDER systems and applications.

3. Work in conjunction with the Office of Chief Information Officer (OCIO) to provide

Desktop support for CCQDER staff.

4. Plan, implement, and conduct system security checks at the CDC and CCQDER levels required to improve, continue, maintain, recover and restore data.

5. Record, report, track, and document CCQDER system problems and malfunctions discovered during these activities.

6. Recommend, justify, and manage the purchase of CCQDER upgrades and replacement hardware, software, and systems following established procedures and controls.

7. Coordinate and work with CCQDER Staff, the Office of Chief Information Officer

(OCIO), and CDC/NCHS IT and purchasing staff following established procedures and controls.

8. Install new CCQDER hardware and software upgrades and configure the various operating systems and applications.

9. Act as the administrator for hardware and software on the CCQDER Network.

10. Maintain, support, and troubleshoot the CCQDER Network, system, administration, and desktop computers, servers, routers, video cameras, and related audio and video equipment.

11. Monitor, evaluate, resolve, tune and analyze CCQDER Network system performance to maintain maximum effectiveness and efficiency.

12. Monitor and manage CCQDER’s digital video storage hardware usage and future requirements.

13. Support systems, processes, and procedures for various CCQDER/NCHS projects and any organizations contracted to support CCQDER/NCHS projects and/or in storing data on Q-Video. Procedures include the use of the CDC’s Secure Access Management

Services (SAMS).

14. Conduct CCQDER video system back-ups, performance tuning, and problem resolution on site.

2.2 - Software Support

1. Maintain, and support CCQDER lab operations support systems and applications as needed, which could include but is not limited to troubleshooting, providing documentation and user orientation; in collaboration with CCQDER staff.

2. Ensure software applications support collection, analysis and handling of data in compliance with applicable laws and regulations such as CIPSEA.

3. Coordinate and work with CCQDER staff, the CDC OCIO and/or Infrastructure

Services Branch (ISB), CDC/NCHS Office of Informatics, Governance & Assurance and the Office of Chief Information Officer (OCIO) in defining and analyzing requirements for architecture, design, and development alternatives of all CCQDER existing system enhancements and new application development. Provide council and recommendations on best approaches.

4. Complete CCQDER CDC System Assessment & Authorization (SA&A) forms and documentation for all new, modified, and renewals as required and gain Authorization to Operate (ATO) following established, modified, and/or newly developed procedures and controls.

5. Complete CCQDER CDC and NCHS 508 application requirements and gain CDC and

NCHS 508 approval for various requests following established procedures and controls.

6. [Optional Subtask] - Contractor shall acquire Qualtrics software application or another Commercial Off the Shelf software application with similar capabilities and approved by NCHS.

a) This task item will only be needed if NCHS does not already have an existing application as described above.

2.3 Admin

1. Provide technical support to the CCQDER CDC System Assessment & Authorization (SA&A) process for new systems or modifications to existing systems. Provide technical information, guiding the development process in order to meet current security policy.

2. Complete and adhere to CDC OCIO and/or Infrastructure Services Branch (ISB), CCQDER change control process documentation and supporting documentation following established procedures and controls.

3. Function as support to the CCQDER System Security Steward for all CCQDER systems, responsible for managing the security system and reporting all of

CCQDER data to complete necessary certification and required renewals annually.

Task 3: Cognitive Interview Data Management

Cognitive interviews are either audio or video recorded. These recordings are the raw data used for analysis for CCQDER research. Currently, over 3,000 video/audio recorded interviews are stored on on-site servers and accessible through a secure onsite LAN. The contractor shall conduct the following onsite in the CCQDER lab:

1. Manage the storage of video/audio interview recordings.

2. Develop and maintain a catalogue of all CCQDER data including all archived and future video/audio recordings and transcripts. Catalogue should include metadata and file location.

3. Oversee and execute the transcription of all archived interviews using approved software(s).

4. Manage the storage of transcriptions on CIPSEA approved cloud storage environment.

5. Execute and document the destruction of transcribed files.

Optional Task 4: CCQDER Legacy Systems Maintenance and Transition

1. Complete first line user testing of CCQDER Legacy Applications (Qbank, QNotes, QVideo, CCQDER Respondent database and Recruitment Tool).

2. Provide updated Application User Guides with current content based on latest user tests and programming changes for all CCQDER Legacy Applications (Qbank, QNotes, QVideo, CCQDER Respondent database and Recruitment Tool).

3. Provide rapid response (within 2 hours) and troubleshooting for CCQDER’s Legacy

Applications (Qbank, QNotes, QVideo, CCQDER Respondent database and

Recruitment Tool) outages and/or system problems.

4. Assist in transition and integration from CCQDER Legacy Systems (Qbank, QNotes, QVideo, CCQDER Respondent database and Recruitment Tool) to new COTS applications.

5. Assist in migration of data from CCQDER Legacy Systems (Qbank, QNotes, QVideo, CCQDER Respondent database and Recruitment Tool) to new COTS applications and storage systems.

6. Manage the CDC Change Control Process, as needed, and successfully manage the architecture, design, testing and implementation of system enhancements and new development.

7. Complete CCQDER CDC System Development Life Cycle (SDLC) prototyping life cycle framework or methodology and manage requirements following established procedures and controls. Provide recommendations for the effective use of new and emerging technologies throughout the program life cycle.

8. Complete and maintain the CCQDER Enterprise Systems Catalog (ESC) and Systems

Inventory and the Enterprise Performance Life Cycle (EPLC) following established, modified, and/or newly developed procedures and controls. Provide recommendations for the effective use of new and emerging technologies throughout the program life cycle.

Task 5: Remuneration Payment to Respondents

Provision of token remuneration payment to survey respondents is usual, customary, reasonable, and is in direct support of the CCQDER mission. It is estimated that CCQDER will require respondent remuneration to conduct approximately 8-12 English language cognitive interviewing projects, focus groups, and usability tests consisting of approximately 300-400 respondents annually. The remuneration process provides the CCQDER the needed flexibility to pay survey respondents cash and/or eGift card remunerations while maintaining the required level of confidentiality and anonymity for those survey respondents.

1. Remuneration is a cost reimbursement line item.

2. When requesting remuneration for CCQDER specific cognitive interviewing studies, focus groups, or usability tests, a member of the CCQDER Operations Team (to be identified) will submit in writing to the contractor a request for respondent remuneration funds to remunerate survey respondents participating in various

CCQDER cognitive testing studies, focus groups, and usability tests. The request includes the project name, the expected number of survey respondents, the amount required to pay them, and the testing dates and date that the funds are needed. The designated CCQDER Operations Team member will acknowledge in writing

(electronically or in-person) receipt of remuneration funds via cash or eGift cards, received for specific cognitive interviewing studies, focus groups, and usability tests.

3. The contractor shall provide the government with the eGift card information provided from the eGift card company(s). Neither the contractor nor the government is in control of how the cards are received from the company(s). There will be no PII included for the eGift cards. The government will safeguard and store all eGift cards in a password protected folder on a CDC secured server.

4. The CCQDER Operations Team will provide participants with access to the eGift cards. Participants will forfeit their remuneration if they allow the card to expire.

5. Neither the contractor nor the government is in control of the fees associated with the purchasing of eGift cards. The government will determine the eGift card company(s) that satisfy the needs of the government.

6. The contractor shall maintain accounting records of the funds given to the government and eGift cards purchased for survey respondent remuneration. The government will keep track of the disbursement of the survey respondent remunerations.

7. The contractor shall include remuneration cost reimbursement in the invoices to the government, as interviews are conducted, and payments are made to the respondents.

An approved remuneration of $50 is allocated for standard 60-minute cognitive interviews, and $100 for 90-minute focus groups and establishment studies. These amounts were approved on January 31, 2023, for CCQDER generic data collection under Office of Management and Budget (OMB) No. 0920-0222.

Optional Task 6: Coordination of Advertisement Payments for Recruitment Efforts

1) The contractor shall support the recruitment efforts for cognitive interviews and focus groups by coordinating the purchasing of print, digital, social media, and other advertisements by making payments for various approved advertisement platforms included but not limited to: Craigslist, Facebook, Twitter, LinkedIn, Instagram, YouTube, Google Ads and other social media tools. The contractor shall adhere to all relevant HHS and CDC policies related to posting on social media sites. The Government will direct the Contractor to the ideal and approved platforms to best reach target markets.

a. CCQDER Operations Team shall develop all advertisements for posting and provide the contractor with access to all advertising platforms for payment of approved content.

b. It is estimated that CCQDER will require the coordination of advertisement payments for approximately 8-12 cognitive interviewing projects, focus groups, and usability tests annually.

SECTION 5 – GOVERNMENT FURNISHED PROPERTY

All information must be processed on authorized CDC information resources. As such, CDC will provide contractor personnel with government-furnished property (e.g. CDC laptops) necessary to perform services requested in this statement of work including: the physical cognitive laboratory, CDC/NCHS furnished workstations, chairs, filing cabinets, office supplies, telephones (landline/non-mobile phone), fax, computers with appropriate CDC and CCQDER LAN connections, printers, software, hardware, tools and testing equipment, etc.

CDC will provide contractors participating in situational telework with government-furnished encrypted laptops.

The control and accountable record keeping for such property shall be retained by the Government. The

Contractor shall remain accountable for loss or damage but will not be required to submit an annual inventory or place its own bar code on the items. The Government will provide and install CDC/NCHS bar code labels and other identification for the Government-furnished property.

SECTION 6 – PLACE OF PERFORMANCE AND CONTRACT SUPPORT HOURS

SUBSECTION A – PLACE OF PERFORMANCE

Tasks 1-4 are primarily performed onsite in Hyattsville, MD which operates on a five day a week schedule (Monday-Friday). Depending on the nature of the tasking, situational telework may be available.

Telework arrangements would be mutually agreed to by the Contractor, the COR, the NCHS

Confidentiality Officer, and the CCQDER Director. Task 5 (remuneration payments to CCQDER) and

Optional Task 6 (advertisement payments) are performed virtually and/or at a local location mutually agreed upon by the Contractor and CCQDER.

SUBSECTION B – CONTRACT SUPPORT HOURS

The following table demonstrates functional work task categories and estimated number of hours and estimated labor categories for Tasks 1-6 based on the prior contract history, as well as program projections of the new statement of work. Given the dynamic nature of the mission, the actual workload may vary during the period of performance, and the contract may be modified accordingly. The table is only an example and is not intended to be the only possible solution to the requirement.

To evaluate the offer’s understanding of the statement of work it is a mandatory requirement that the offeror include a table in the technical proposal for Tasks 1- 6 outlining the proposed functional work task categories, number of work category staff, the number of hours per performance period, and a description of the skills and experience per functional work task categories.

Based Period

Functional Work Task Category Estimated Support hours

Task 1: Project Management 1,355

Task 2: Implementation, Maintenance and Support of CCQDER

Hardware, Systems and Applications 4,320

Task 3: Cognitive Interview Data Management 1,440

Optional Task 4: CCQDER Legacy Systems Maintenance and

Transition 960

Task 5: Remuneration Payment to Respondents* 60

Optional Task 6: Coordination of Advertisement Payments for

Recruitment Efforts* 25

*Note: Tasks 5 & 6 are historically managed by the Project Manager

The functional work task categories and estimated number of hours established in the contract may be modified during the period of performance to reflect current mission requirements.

If the execution of work to be performed by the contractor requires the hiring of sub-contractors, the prime contractor must clearly state this in the proposal. Sub-contractors must be identified and the work they will perform must be defined.

SECTION 7 – TRAVEL

Travel is not an anticipated requirement for this contract. NCHS in Hyattsville, MD does not provide parking permits and does not validate parking. A public parking garage is adjacent to NCHS. The

Contractor shall be responsible for paying contracted employees parking fees.

SECTION 8 – REFERENCE MATERIALS

Not applicable

SECTION 9 – MINIMUM VENDOR QUALIFICATIONS

The Contractor employee must possess the following qualifications:

1. Proven knowledge of developing user-facing software applications used for data analysis.

2. Must have specific experience with projects that include video recording, digitized video database systems, and text data applications in support of structured and ad-hoc research and analysis.

3. Must have experience in managing projects in a secure/confidential environment.

4. Must be experienced in the management of hardware and software selection, system, application, and network architecture, development, deployment, documentation, and user orientation in open as well as secure environments.

5. Must have experience managing a project without fully developed, defined, or detailed requirements.

6. Must demonstrate experience developing applications without firm fixed requirements.

7. Must have demonstrable understanding or experience in architecting, designing and developing systems that have gained an Authorization to Operate (ATO) as well as experience in developing modifications and enhancement that conform to, and maintain, the System Assessment & Authorization

(SA&A) achieved. Must be experienced in providing any input necessary to update the SA&A and maintain the ATO as may be necessary.

8. Must be experienced in developing 508 compliant applications in government environments.

9. Must demonstrate a thorough understanding of working in the CDC Change Control Process or the equivalent and successfully managing the architecture, design, testing and implementation of system enhancements and new development.

10. Must have knowledge and maintain current understanding of the CDC System Development Life

Cycle (SDLC) or the equivalent, necessary to ensure the development life cycle employed will address the minimum requirements of the CDC SDLC.

11. Must have knowledge of completing and maintaining the CDC Enterprise Systems Catalog (ESC) and

Systems Inventory or the equivalent.

12. Must have ability to manage a project and work in coordination with the Cyber Security Program

Office (CSPO), the Office of Chief Information Officer (OCIO), CDC/NCHS IT, and the CDC OCIO and/or Infrastructure Services Branch (ISB) or the equivalent offices for regulations and approvals.

13. Must have ability to work with program staff, the Office of Acquisition Services (OAS), and the

Financial Management Office (FMO) in matters related to the project.

14. Must have experience working with Agency, technical, supplier, and program staff at all levels.

15. Must have the ability to deliver and/or complete both cash and/or electronic incentives to study participants following accounting best practices.

16. Must have the ability to purchase print, digital, social media, and other advertisements by making payments for various approved advertisement platforms.

SECTION 10 – INFORMATION SECURITY & PRIVACY REQUIREMENTS

508 COMPLIANCE:

1. Baseline Security Requirements:

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor

(and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the CDC mission. In addition to the Federal

Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

▪ Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

▪ Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

▪ Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of

CDC/NCHS and information systems that store, process, and/or transmit CDC information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II:

Appendices to Guide for Mapping Types of Information and Information

Systems to Security Categories. Based on information provided by the System

Security and Privacy Officer (previously referred to as ISSO), CISO, CDC

CPO, or other representative, the impact level for each Security Objective

(Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

▪ Confidentiality: [ ] Low [X] Moderate [ ] High

▪ Integrity: [ ] Low [X] Moderate [ ] High

▪ Availability: [X] Low [ ] Moderate [ ] High

▪ Overall Impact Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of CDC/NCHS regardless of location or purpose.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the CDC/NCHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the

CO/COR or CDC/NCHS security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-

53, and applicable CDC Component privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally

Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, CDC uses a privacy analysis process to assess the risks associated with CDC's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how CDC collects, disseminates, maintains, or disposes of the public's

PII.

iii. The Contractor must support the agency with conducting a Privacy

Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

▪ If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 30 days of project kickoff and after completion of the

PTA and in accordance with CDC policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-

Government Act of 2002.

▪ The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle

(SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as

"information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The

Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling

CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of

CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy

Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST

SP 800-171, Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations if handled by internal Contractor system; and,

iv. Returned to HHS/CDC control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the

Contractor (and/or any subcontractor) by CDC or collected by the Contractor on behalf of

CDC must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the

Contractor. Each Contractor employee or any of its subcontractors to whom any CDC records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS/CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential

Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for

Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115- 232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The Contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to always assume HTTPS to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended.

Consult HHS/CDC Policy for Internet and Email Security for additional information. According to the CDC Web policy, all CDC web content must reside on a CDC.gov domain and must be hosted on CDC or CDC-authorized information systems.

k. Contract Documentation. The Contractor must use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing

Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet CDC and

CDC Component-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The

Contractor must provide a written copy of the validation documentation to the COR at Project Kickoff.

v. Use the Key Management system on the CDC personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to CSPO.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the CDC non-disclosure agreement:

https://www.cdc.gov/nchs/data/nnhsd/non-disclosure-form.pdf,, as applicable.

Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements:

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable CDC Contractor Information Security Awareness, Privacy, and Records

Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete required training (e.g., CDC SAT, NCHS/CIPSEA, etcetera). CDC Information Security Awareness, Privacy, and Records Management training is required at least annually, during the life of this contract. All provided training must be compliant with CDC training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role- based training annually commensurate with their role and responsibilities in accordance with HHS/CDC policy and the CDC Role-Based

Training (RBT) of Personnel with Significant Security Responsibilities.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training http://csrc.nist.gov/publications/…