AoU_CLAD_ROA_OTA-23-003 FAQ.pdf

National Institutes of Health (NIH) Office of the Director (OD) All of Us Research Program

Frequently Asked Questions

All of Us Center for Linkage and Acquisition of Data No. OTA-23-003

Issue Date: February 15, 2023

General Notes About the FAQ 3

The All of Us Research Program 3

Award Considerations 5

Data Linkage Platform / Cloud 7

Data Linkage 8

FedRAMP 12

Health Information Network / Health Information Exchange Questions 12

Humans Subjects Research Protections 13

Security 13

General Notes About the FAQ This FAQ is provided to offerors to answer questions that have been received about the Center for Linkage and Acquisition of Data (CLAD) Research Opportunity Announcement (ROA).

Offerors who wish to submit additional questions about this ROA may do so. The questions should be concise and direct. For each question submitted, the relevant section, page, and paragraph of the ROA must be referenced. Questions should be submitted to the email address listed in section 2.1 of the ROA. They must be submitted at least 14 calendar days prior to the full technical and cost proposal submission deadline. If questions are submitted in less than 14 calendar days from the deadline, they may not be answered. As additional questions are asked by offerors, the FAQ will be updated and reposted as quickly as possible.

The All of Us Research Program Question 1. What are the overall goals of the All of Us Research Program?

All of Us has set six goals for 2026:

○ Enroll 1 million participants who reflect the diversity of the U.S., cover the lifespan, and have shared all baseline elements. Of these participants, 500,000 are actively engaged in the program.

○ Expand data available for 1 million participants, to include surveys, health data streams, a whole genome sequence, environmental data, and physical measures.

○ Develop and launch a scalable ancillary studies program that expands the cohort and delivers additional phenotypic, lifestyle, environmental, and biologic data.

○ Establish a diverse global community of 10,000 researchers productively using All of Us data.

○ Incorporate participant return of value into data collections and assess its impact, including return of information to participants on genomics and Electronic Health Records.

○ Enable the full potential of the All of Us Research Program through organizational accountability, strategic and data-driven decision-making, effective core processes, and team capacity and development.

Question 2. What are the current data sources for the All of Us Research Program? What is the awardee’s expectation regarding continued support of these existing data sources?

All of Us collects:

○ EHR data from partners who are health care provider organizations; EHR data is also acquired from Apple Health records and from participant-mediated connections to provider portals.

○ Survey responses directly from participants through the All of Us Research Program participant-facing platform.

https://allofus.nih.gov/about/program-goals

○ Physical measurements data during on-site appointments and through height and weight measurements directly from participants through the All of Us Research Program participant-facing platform.

○ Mobile health data from Fitbit devices, and other physical activity devices that participants link to the program through Apple Health.

○ Biospecimens (blood, urine, saliva) for bioassays. DNA extracted from blood or saliva is sent to genome centers for genomic analysis, including whole genome sequencing, and genome-wide genotyping.

○ For more information, please refer to https://www.researchallofus.org/data-tools/data-sources/.

During the base period, the awardee will be responsible only for the linkages that are specified in the ROA. After a linkage has been successfully completed, the government will decide on the frequency of repeating a linkage. This frequency will be driven primarily by scientific utility.

Question 3. Does the All of Us Research Program have a Master Patient Index (MPI) infrastructure today?

The All of Us Research Program does not currently have a Master Patient Index (MPI) infrastructure.

Question 4. Has the All of Us Research Program been conducting data linkages between sources, and if so, how is it currently being done?

Current linkage is done with combinations of participant personally identifiable information (PII). Additionally, some experimental work has been conducted using Privacy Preserving Record Linkages (PPRL). We refer you to several presentations that, in part, provide additional information:

https://ipdln2022.com/events/ancillary-data-record-linkage-to-characterize-the-completeness-of-data-for-the-all-of-us-research-program/ https://ijpds.org/article/view/2090 https://gpctr.unmc.edu/wp-content/uploads/2022/06/2022-06-07-Berman-Lew-Great-Plains-Conf erence-FINAL.pptx

Question 5. Does the All of Us Research Program have a Data Catalog for their existing data solution?

Please refer to the Controlled Tier Data Dictionary.

Question 6. What is the current technology stack utilized within the All of Us environment?

The All of Us environment is a mix of cloud-based technologies, including services from AWS, Google Cloud Services, and Azure. The data repository for researchers is managed through Google’s BigQuery, and the Researcher Workbench runs on a modification of the Broad Institute’s Terra platform, providing Jupyter Notebooks to researchers.

https://www.researchallofus.org/data-tools/data-sources/ https://ipdln2022.com/events/ancillary-data-record-linkage-to-characterize-the-completeness-of-data-for-the-all-of-us-research-program/ https://ipdln2022.com/events/ancillary-data-record-linkage-to-characterize-the-completeness-of-data-for-the-all-of-us-research-program/ https://ijpds.org/article/view/2090 https://gpctr.unmc.edu/wp-content/uploads/2022/06/2022-06-07-Berman-Lew-Great-Plains-Conference-FINAL.pptx https://gpctr.unmc.edu/wp-content/uploads/2022/06/2022-06-07-Berman-Lew-Great-Plains-Conference-FINAL.pptx https://docs.google.com/spreadsheets/d/1ZTVpTJBCZgUaGVafmUBBgoQv_Q1x6zbzhuwmKom1d_8/edit#gid=183931508

Question 7. How does All of Us retrieve EHR data? Is data retrieved via scheduled batch, streaming, or on-demand?

EHR data is retrieved from Health care Provider Organizations via secure protocols. Data is received by batch, mostly on a quarterly basis.

Question 8. How is EHR data received from existing data sources (HL7 messages, CCDA documents, API transactions, MLLP, flat files, etc.)?

EHR data is received primarily from All of Us Research Program Health care Provider Organizations (HPOs) as an OMOP extract using secure transfer mechanisms. Other EHR data, from participant mediated methods and Apple Health records, are received as FHIR-format JSON files.

Question 9. Does All of Us use IAL2 as a method for verification of participants upon recruitment?

All of Us does not require IAL2 for ID proofing. The current use case for ID proofing in the program is to meet FDA requirements when capturing electronic signatures for consent. All of Us must complete ID verification to be able to offer health-related return of results to participants.

All of Us sites use our policy as a minimum threshold, but sites may have specific requirements that go above and beyond this policy.

Award Considerations Question 10. Are for-profit entities and small businesses eligible for the Center for Linkages and Acquisition of Data (CLAD) award?

The award is open to all entities listed in the Research Opportunity Announcement (ROA) Section 6: Eligibility Information, including for-profit organizations and small businesses. There is no specific set-aside for small businesses in this award. For-profit entities can propose profit in their cost proposal but their cost proposal must break out the profit for NIH review and negotiation.

Question 11. Will the program provide potential collaborating partners for offerors?

No. Offerors are encouraged to seek out collaborating partners as they see fit and that they are confident they can work with well. Collaboration is a key element of the All of Us Research Program. Consequently, all collaborating partners on the offeror’s team should anticipate working in a collaborative environment.

Question 12. Are third tier sub-contracts allowed as part of this mechanism?

Yes, but any Lower Tier Agreements with subcontractors must include the flow down terms required in the OTA Terms and Conditions for the CLAD award.

Question 13. Are lower tier agreements allowed?

During the performance of the awarded OT Agreement between the awardee and NIH, either party may recommend to the other the need for a Lower Tier Agreement. The authorization process for establishing Lower Tier Agreements will be documented in the terms and conditions of the awarded OT. A current draft of this process can be found in Article VI of the Terms and Conditions in Appendix A of the ROA.

Question 14. Does NIH have a defined list of expected roles or key team members the offeror will be expected to provide?

There is a list of anticipated key team personnel for CLAD. These key personnel are aligned with CLAD cores. Key personnel also have an associated minimum Level of Effort (LoE). The applicant may identify different or additional key members and their associated LoE to successfully execute this work. Details are provided in the full announcement.

Question 15. Will NIH issue the Other Transactions Award directly from the agency, or through an Other Transactions Consortium Manager? If the latter, what is the name of Consortium Manager that will be used?

The Other Transactions Award will be issued directly from NIH.

Question 16. Is a cost share expected under the Other Transactions Award?

Cost share is not a requirement under the Other Transactions Award.

Question 17. Is an estimate available for the number of Data Acquisition Partners and Health Information Networks that will be included in scope?

Offerors will find in the milestones the number of data linkages that are expected to be completed during the base period of the award. Offerors are encouraged to find partners, as needed, to fulfill the scope of work and milestones. The number of partners and the formulation of teams to complete milestones and acquire data is to be determined by each offeror.

Question 18. Are offerors expected or required to apply for all cores of the CLAD ROA?

Each proposal must include a team that can satisfy the functional capabilities for all four cores and the milestones / objectives. Offerors may choose how to staff cores. The submitting entity may submit alone or as a primary entity in a submission that includes one or more other collaborating entities. An entity is limited to a single submission as a prime, but may be included as a collaborating entity on more than one application.

Question 19. Are the All of Us Research Program Participant and Partner Services Center (PPSC) and the Center for Linkage and Acquisition of Data (CLAD) opportunities linked in any way?

The PPSC and CLAD are independent program opportunities. Please see OTA-23-002 for more details on the PPSC.

https://sam.gov/opp/f9fba45eefaf41a6915e3c7ef784ab37/view#attachments-links

Question 20. Are any of the technical components of the solution open source?

The components of the CLAD solution are to be determined by the offeror.

Question 21. Is the CLAD awardee required to have all linkages or will you have a consortium each with one or more specialities?

CLAD will result in a single award. Offerors should decide on the mix of partners that are needed to fulfill all of the milestones associated with CLAD.

Data Linkage Platform / Cloud Question 22. Does All of Us have a preferred cloud provider?

No, but the program does prefer cloud solutions to on-premises solutions.

Question 23. Does the All of Us Research Program have a preferred cloud vendor; a preferred list of platforms (such as terra.bio); or preferred technologies that should be considered to better integrate with existing systems?

The existing participant and study staff applications and platforms supported under the Participant Technology Systems Center (PTSC) and the Participant Center (TPC) awards are hosted and managed using the Amazon Web Services platform. The program currently hosts all Data and Research Center (DRC) platforms, data, and analytic tools on Google Cloud Services, and is in the process of expanding that to Azure and Amazon Web Services. Awardees are not limited in their choice of cloud provider and are welcome to work with whichever vendor they prefer. Fluency in the different cloud providers is worth noting within your application.

The All of Us Research Program does not have a preferred list of platforms.

Question 24. Is the CLAD data linkage platform to be made available to external researchers?

No. The CLAD data linkage platform will only be available to the awardee, All of Us Research Program government staff, and specific partners. Examples of partners who may require access include the Data and Research Center (DRC) and contractors to the All of Us Research Program.

The offeror should anticipate that this would be about 50 individuals or less. These staff will need access to the dashboards that are created to monitor linkage progress and potentially some analytic capability to review data linkage datasets before they are delivered to the Data and Research Center. These staff will also need access to CLAD managed tools such as Jupyter Notebooks, R, and Python on the data linkage platform for these activities.

Question 25. Does All of Us prefer a federated, centralized, or other approach to data connection and storage?

All of Us EHR data is currently aggregated at the Data and Research Center using a centralized approach for data collection and storage. Similarly for CLAD, a centralized cloud-based solution is required. Data from CLAD linkages will be transferred to the Data and Research Center.

https://allofus.nih.gov/funding-and-program-partners/participant-technology-systems-center https://allofus.nih.gov/funding-and-program-partners/participant-center https://allofus.nih.gov/funding-and-program-partners/data-and-research-center

Question 26. The notice of future ROA mentioned that “Data collected through passive data streams will be transmitted to the All of Us Research Program Data and Research Center (DRC) for inclusion in the Researcher Workbench.” Please clarify if CLAD’s cloud-based platform must be hosted by the same cloud provider as the Researcher Workbench. Is All of Us open to using another cloud-provider within the NIH STRIDES Initiative if the team determines that it is technically feasible?

The CLAD cloud-based platform does not need to be hosted by the same cloud provider as the Researcher Workbench. We are open to other providers that are technically feasible and meet the security requirements of NIH and the All of Us Research Program. The platform must meet FISMA Moderate compliance.

Question 27. Can the All of Us data stored on the CLAD platform exist in the same database or cloud environment as data used on other non-All of Us programs or effort?

No. All of Us data must not be commingled with data that is not part of CLAD and the All of Us Research Program.

Question 28. Will the CLAD data linkage platform be accessible to external researchers interested in analyzing this data?

No.

Data Linkage Question 29. In cases where All of Us has identified new passive data streams for acquisition as part of the CLAD ROA, has All of Us identified the sources from where this data will be retrieved from? If so, will All of Us direct the awarded recipient of this ROA to the source of the passive data (i.e., a Data Warehouse, partner/provider organization, electronic health records), or will the awarded recipient be expected to locate and acquire this data independently?

The All of Us Research Program has requirements-gathering objectives for each linkage. This collaborative process will result in per-linkage recommendations for sources. Once the program has agreed to the source, the awardee will acquire the data. However, the ROA document has noted instances in which the All of Us Research Program has already identified a specific data source for a linkage.

Question 30. Which datasets should offerors use in their proposal for each of the base period milestones?

As part of the proposal, offerors will recommend a specific candidate dataset for most linkages, a rationale for that selection, and should account for this in the cost proposal. When offerors justify a candidate dataset, they should keep this in mind:

1. The candidate dataset should maximize scientific utility.

2. Consider the potential for return of value by returning data to All of Us participants.

3. All of Us has a special focus on collecting data from individuals that have been traditionally under-represented in biomedical research (UBR). Candidate datasets that result in linkage data for a high percentage of UBR individuals is important.

Specifically from the perspective of cost, offerors should include in their proposal: candidate datasets for mortality, residential history, geocoding, and claims. Furthermore, offerors should recognize that all of the addresses acquired for residential history will be geocoded as part of CLAD. Moreover, the CLAD environmental data linkage requires that offerors use data from the Centers for Disease Control and Prevention. This will require the residential history and or geocoded information. Finally, the HIN/HIE effort is a pilot and offerors have room to propose a design that aligns with the All of Us UBR targets. It is also an attempt to understand if existing All of Us Research Program EHR data gaps can successfully be filled with such an approach.

Nonetheless, acquiring data through an HIN/HIE may require address information. The residential history data may be useful for this purpose.

Question 31. Is data within the All of Us Research Program linked internally at this time?

Yes.

Question 32. How many data integrations does the All of Us Research Program hope to accomplish in the first period of the CLAD award?

Details are provided in the ROA.

Question 33. What types of environments should data linkage analytic tools be developed in?

Currently, the Researcher Workbench is built to support Jupyter Notebooks, R and Python. Thus, the offeror will develop data linkage tools for dissemination to the Researcher Workbench in Jupyter Notebooks, R, and Python. In the future, we anticipate that other environments such as SAS, Stata, and non-programming environments (e.g., Tableau) will be supported on the Researcher Workbench. At that time we anticipate asking the offeror to support analytic tools in these environments as well. Supporting these additional environments will not occur during the base period of CLAD.

Question 34. Within the existing data systems, will the selected offeror be required to establish methods to develop linkages inside the existing dataset or will new linkages be focused on the new sources brought in as part of the CLAD effort?

The selected offeror will be primarily required to establish methods to link new sources of data to the existing All of Us Research Program participant population. Some of this new data may require new methods of curation, harmonization, and standardization. The data will need to be processed in such a manner that it is de-identified and may be disseminated on the All of Us Researcher Workbench to increase research utility. There may be cases in which some of the data is to be returned to study participants. There may be some cases where the offeror is linking in new data for an existing source of data that is part of the All of Us Research Program. For example, EHR is currently collected on All of Us. The CLAD award has a specific milestone to pilot linking in EHR data from HIN/HIE.

Question 35. Will the CLAD data linkages be stored in conjunction with the existing data, or will it be connected at the Researcher Workbench?

CLAD acquired data will be transferred to the All of Us Data and Research Center (DRC). The DRC will take the final steps to move this data to the All of Us Researcher Workbench for dissemination to researchers.

Question 36. Will the Occupational History and Residential History data to acquire be specified, or is the role of the offeror to identify and the appropriate dataset(s) to integrate?

At this time All of Us is not requiring a linkage for occupational history during the base period.

For the base period linkages, All of Us will require the awardee to complete a requirements-gathering stage as part of each linkage milestone to determine the best source of data for the linkage. Where NIH has a preferred source for data, this will be specified in the ROA. Please refer to the ROA to see the list of specific data linkages that are to be completed during the base period. Note, for the proposal, awardees should specify the source of data that the offeror thinks is best to satisfy the data linkage requirements.

Question 37. How will the geocodes and residential history be used?

Geocodes may be used during the base period of the CLAD award to link in the environmental data from the CDC. It may also be needed for the HIN/HIE pilot.

The procedures for geocoding may encounter some challenges with accurately linking in specific levels of geography. For example, this may occur in rural areas, where there are irregular roads or under other circumstances. Consequently, the offeror should include in their response the dataset and methods that will be used to ensure accurate multi-level geocodes.

Question 38. Are these linkage data continually refreshed?

The data linkages will be refreshed based on scientific need, research utility, and available funding.

Question 39. Will the All of Us Research Program only do the linkages specified in the base period or will there be different linkages conducted during the optional period?

It is the intention of the All of Us Research Program to expand the availability of data on the Researcher Workbench with new data. During the base period several data linkages have been specified. It is anticipated that during the optional years of the award that additional linkages will be made. The specific linkages will depend on the scientific priorities of the program. Potential examples of additional data could include cancer registry data, immunization registry data, and additional environmental data.

Question 40. How should offerors provide costs for the optional periods if the linkages are not specified?

Cost estimates for optional periods are not being requested in Phase I proposals but may be requested in Phase III for planning and budgeting purposes. The Phase III offeror may be requested to provide an estimate for the optional periods by assuming each of the linkages will be repeated during each optional period. This should also include the cost of documenting these linkages and the update to the tools that were created during the base period. It should also include the cost of operating and maintaining the data linkage platform.

Question 41. What should an offeror use for data quality metrics?

The All of Us Research Program uses several steps in the data curation pipeline to assess and improve EHR data quality. These steps are described in Appendix B of the ROA. We recommend that offerors review this for the data linkages that are part of CLAD. Offerors may choose to use this in whole, modify it, or propose a different approach and apply it to the CLAD linkages. The plan will be reviewed and approved by the All of Us Research Program.

Question 42. The linkage milestones include objectives for the development of analytic tools to “jump start” analyses on the Researcher Workbench. Who decides on the tools that are required for these linked data? Who is the targeted audience for these tools?

The offeror should ensure they include staff and expertise for the development of analytic tools that will be moved to the Researcher Workbench. The tools will be in the form of Jupyter notebooks with R and Python code. They should provide examples of how to analyze linked data on the Researcher Workbench. This might include the production of basic descriptive statistics, more complex analyses that integrate other All of Us data, or benchmark analytic models that may be difficult for individual investigators to create on their own. The targeted users of these analytic tools will be registered researchers using the Researcher Workbench.

Question 43. Are there a specific platform, method, or type of privacy-preserving record linkage tokens that the All of Us Research Program prefers?

No. It is possible that linkages may occur with PII, tokens, or potentially other techniques. All of Us is neutral to the platform, method, and/or tokens that may be used. However, All of Us participant privacy must be protected vigorously. In addition, matches should be done in a way that results in high certainty. This is important because the certainty of the match may affect research utility. And, if any of the data from a match is returned to study participants, it is of vital importance that the data from a match must be correct. Moreover, the linkage should result in acceptable levels of sensitivity, specificity, positive predictive value, and negative predictive value. Also, the offeror should provide a rationale for choosing specific methods for matching when considering the development of the data linkage platform and how each of the matches will be conducted.

Question 44. Will the linkages conducted during the base period be repeated during the option periods?

We anticipate that some of the linkages during the base period will be repeated during the option periods. This will depend on the scientific needs of the program and the availability of funds.

Question 45. How should participant matching be considered during the linkage efforts?

Correctly matching an All of Us Research Program participant to a linked dataset is of vital importance as it affects research utility and potentially the return of data to study participants.

Therefore, offeror’s should propose as part of their solution, methods that will result in high sensitivity, specificity, positive predictive value, and negative predictive value.

Question 46. Will CLAD be used to acquire EHR data from the existing All of Us Research Program network of healthcare provider organization partners?

Not at this time. CLAD will begin with a pilot study to assess acquisition of EHR data from HIN/HIE. Depending upon the success of this pilot study, this may become a partial solution for acquisition of EHR data for All of Us Research Program study participants. In the future, we envision that other methods for EHR acquisition may be conducted through CLAD. This could include using standards such as Health Level 7® Fast Healthcare Interoperability Resources (FHIR), Qualified Health Information Networks (QHIN), and other interoperability standards and methods.

Question 47. Will CLAD be used to onboard new healthcare provider organizations joining the All of Us Research Program?

Not at this time. However, lessons learned from the HIN/HIE pilot may help facilitate this activity in the future if the pilot is successful and can be scaled for the demographic and geographic coverage considerations of All of Us.

FedRAMP Question 48. For this award, can FEDRAMP certification fees be included in the budget?

NIH and the All of Us Research Program cannot currently provide funding to an offeror for FedRAMP certification during the base period of the CLAD award. The All of Us Research Program may consider funds for this activity during an option year after the CLAD platform has been established.

Question 49. Will FedRAMP certification (a FedRAMP Authorization to Operate) alone be sufficient for this award to achieve “compliance with a Federal Information Security Modernization Act (FISMA) moderate level?”

No, although FedRAMP certification helps demonstrate the security of the system, the specific integration will still need to be described and tested.

Question 50. Does the NIH agree to be the sponsor for FedRAMP certification for the awardee of this contract? For example, in a situation where the awardee is not currently FedRAMP certified but will become so if awarded?

The program will not sponsor or support the costs of FedRAMP certification during the base period, but is open to doing so in a renewal period. Even in the case where the awardee uses their own funds to pay for FedRAMP certification, the NIH will not be able to sponsor the awardee during the CLAD base period.

Health Information Network / Health Information Exchange Questions Question 51. How does the All of Us Research Program currently reconcile identities between HIEs?

All of Us Research Program is not currently acquiring data through HIEs.

Question 52. Has the All of Us Research Program identified likely HIN/HIE sources to which linkages should be established?

As part of the CLAD award the All of Us Research Program is requiring a pilot study to acquire HIN/HIE EHR data for study participants. All of Us is open to an HIE/HIN design and solution that provides geographic and demographic coverage that is relevant to the Program; the All of Us Research Program has not identified specific HIN(s) or HIE(s).

It is important to recognize that All of Us has a primary principle of enrolling individuals who have been traditionally under-represented in biomedical research. Moreover, All of Us Research Program participants are broadly distributed throughout the U.S.and territories (see https://www.researchallofus.org/data-tools/data-snapshots/ for more information). Consequently, offerors should consider in their ROA response a pilot design to acquire EHR data that aligns with UBR benchmarks, results in quality data, and is constructed such that it ensures broad geographic coverage to match the volume of All of Us participants enrolled throughout the US.

Question 53. Can a single HIE apply to this award?

Offerors should review the ROA and determine whether they individually or as part of a team or consortium can satisfy the requirements to apply for this award.

Humans Subjects Research Protections Question 54. Is the awardee expected to interact with the program’s IRB?

The awardee is expected to prepare materials related to the data linkages that are necessary for submission to the IRB. In addition, the awardee is expected to answer questions that the IRB may have regarding these linkages.

Question 55. Will the CLAD awardee have any interaction with All of Us Research Program participants?

No.

Question 56. Does All of Us have authorization to acquire EHR data?

All of Us obtains a signed HIPAA authorization form from participants who agree to share their EHR data. This authorization meets the requirements of HIPAA, as well as relevant state https://www.researchallofus.org/data-tools/data-snapshots/ regulations (based on the self-reported state where care was delivered to the individual participant), for disclosure of protected health information (PHI) to All of Us.

Security Question 57. What are the security requirements for the CLAD awardee and platform?

Ensuring the security of participant data is an essential element of the program. All partners in the All of Us Research Program are required to adhere to the policies and procedures to maintain compliance with the following All of Us Research Program principles.

● Precision Medicine Initiative: Data Security Policy Principles and Framework

● Precision Medicine Initiative: Privacy and Trust Principles

The awardee will work closely with the All of Us Research Program DRC, external providers of data, and may work with other program partners to support secure transfer of data and tools.

Applicants for the CLAD award must describe their organizations’ information technology (IT) platform, approach to data security, and prior experience with the security requirements.

Technical details that will enable secure and reliable data exchange with the program partners (e.g., DRC) and external providers of data will be provided by the offeror.

All of Us will require the awardee to provide documentation describing how it will design and implement technical and policy safeguards necessary to ensure data security, as required to comply with the Precision Medicine Initiative Security Policy Principles and Framework.

Awardees are expected to understand and apply guidelines from the National Institute of Standards and Technology (NIST) for meeting Federal Information Security Management Act (FISMA) Moderate requirements.

The awardee will have to demonstrate controls compliance by engaging with a third-party controls assessor prior to receiving a required Authorization to Operate (ATO) from NIH. The third-party controls assessor is required to be chosen from an NIH-approved list.

Awardee should be prepared to follow the NIST Risk Management Framework and comply with the All of Us Security Authorization Process to meet security compliance. Additionally, awardee(s) must adhere to continuous monitoring policies that include monthly reporting of asset inventory, account management reporting, training and awareness, incident response, configuration change, and risk management.

https://allofus.nih.gov/protecting-data-and-privacy/precision-medicine-initiative-data-security-policy-principles-and-framework-overview https://allofus.nih.gov/protecting-data-and-privacy/precision-medicine-initiative-privacy-and-trust-principles