Appendix 5-FDA-CDRH Document Control Ceneter (DCC) Tracking System Requirements.pdf

Contractor-Hosted Fully Integrated Records Facility (FIRF) IDIQ Recompete Request for Proposal (RFP) No. 75F40126R00009

Attachment A: Statement of Work Appendices Appendix 5: FDA/CDRH Document Control Center (DCC) Tracking System Requirements

FDA/CDRH Document Control Center (DCC) Tracking System Requirements

Scope

The Contractor shall provide, configure, maintain, and support a Document Control Center (DCC) Tracking System that meets the requirements set forth in this section. The system shall support all document tracking, quality control, production monitoring, courier and destruction tracking, scanning and imaging, access control, automated alerting, system integration, SLA compliance monitoring, analytics, and disaster recovery functions required under this Task Order.

System Requirements

The following requirements define the minimum functional capabilities of the DCC Tracking System. The Contractor shall ensure all requirements are satisfied prior to system deployment and shall maintain compliance throughout the period of performance.

Requirements are organized by functional area and shall be traceable to applicable Task Order deliverables, performance standards, and Acceptable Quality Levels (AQLs).

Note: If a cloud-based solution is proposed for this aspect of the requirement, it must be FedRAMP certified at the time of proposal in accordance with HHSAR clause 352.239-77 CLOUD COMPUTING SERVICES (FEB 2024) (DEVIATION) [HHSAR CD 2024-01, Amendment 1 (Mar. 1, 2024)].

REQ-01 | Document Tracking & Workflow Management The DCC Tracking System shall provide end-to-end tracking of every document through its full lifecycle, from initial receipt through final disposition. The system shall serve as the authoritative record of document location, status, and processing history at all times. The Contractor shall ensure the system supports same-day processing requirements and provides supervisors with real-time visibility into workflow status. At a minimum, the system shall:

• Log carrier tracking numbers, delivery date and time, and assign a unique internal tracking number upon receipt of each document or submission.

• Record real-time processor assignments and maintain an individual work queue for each staff member, displaying documents assigned, in-progress, and completed.

• Assign and display a current status for each document (e.g., Received, In Process, On Hold, Pending, Completed) and flag unprocessed items for supervisory follow-up.

• Maintain a pending list of all received but unprocessed documents to prevent submissions from being overlooked and to support same-day processing requirements.

• Track the physical or digital location of each document at each workflow stage, including identification of the responsible office, reviewer, or storage location.

• Track the original file name of digital documents and record the final status of each document, including the submission number under which it was processed or explanatory comments if the document was not processed or was forwarded to another group.

REQ-02 | Quality Control (QC) Data Capture & Reporting The DCC Tracking System shall serve as the primary quality control data capture repository for all human-conducted inspections conducted under this Task Order. The system shall support non-conformance management and generate the quality control reporting required in the Contractor's Quality Control Plan and monthly progress reports. At a minimum, the system shall:

• Record the results of all quality control inspections at the employee and submission level, including error frequency and error type at each QC checkpoint.

• Support non-conformance tracking, including creation, assignment, tracking, and resolution of Non-Conformance Reports (NCRs), consistent with the Contractor's quality control procedures.

• Generate configurable QC summary reports (e.g., weekly Quality Control Reports) suitable for management review and inclusion in the monthly progress report submitted to the FIRF IDIQ COR, TO COR, and TOPM.

• Validate delivery confirmations, data entry accuracy, and scanning completeness in support of Acceptable Quality Level (AQL) requirements.

REQ-03 | Production Metrics & Performance Monitoring The DCC Tracking System shall capture, store, and report productivity and timeliness metrics at the individual employee and submission-type level, enabling supervisors to monitor performance against applicable AQLs and SLA thresholds. The system shall support workload management and trend analysis required for program reviews and reporting. At a minimum, the system shall:

• Provide real-time throughput data showing current processing rates and remaining document volumes by submission type.

• Record time-to-complete for each workflow step, by employee and document/form type, in support of AQL tracking and monthly reporting requirements.

• Support workload balancing by enabling supervisors to monitor individual work queues and reassign documents in real time.

• Identify workload trends over time to support management decision-making, staffing planning, and program review discussions.

REQ-04 | Mail, Courier & Destruction Tracking The DCC Tracking System shall support all tracking functions associated with inbound mail receipt, inter-facility courier operations, and document destruction, consistent with the courier and document maintenance requirements of this Task Order. At a minimum, the system shall:

• Log all inbound deliveries, including carrier, arrival date and time, and tracking number, consistent with same-day processing requirements.

• Track documents in transit between the Contractor's Fully Integrated Records Facility (FIRF) and the FDA White Oak Campus, including courier departure and arrival times.

• Support barcoding and transmittal sheet generation to facilitate physical document tracking during courier operations.

• Support the document destruction workflow, including manifest check-off, Certificate of Destruction generation, and shredding activity reporting for monthly progress reports.

REQ-05 | Scanning, Imaging & Reporting The DCC Tracking System shall maintain complete scan and photocopy logs and support the imaging and reporting functions required for processing premarket and postmarket submissions. The system shall provide the management reporting infrastructure required for daily, monthly, and program-level oversight. At a minimum, the system shall:

• Maintain scan and photocopy logs capturing technician name, date and time, page counts, file name and location, and any image defects identified during QC review.

• Confirm image uploads to IMAGE 2000+ and track scanning inventory and compliance with defined scanning volume requirements.

• Support daily, weekly, and monthly reporting on production and quality metrics for inclusion in the Daily Report and Monthly Progress Report submitted to the FIRF IDIQ COR, TO COR, and TOPM.

• Provide a management dashboard with configurable views for supervisors, managers, and program reviewers, supporting bi-annual program reviews.

REQ-06 | Attribute-Based Access Control (ABAC) & Audit Trails The DCC Tracking System shall implement controls to restrict access to government information and system functions in accordance with FDA Information Security Program requirements and applicable federal law. The system shall maintain audit records sufficient to support oversight, compliance review, and incident response activities. At a minimum, the system shall:

• Implement Attribute-Based Access Control (ABAC), restricting data access and system functions based on user role, clearance level, organizational unit, and document sensitivity classification.

• Maintain a tamper-evident, timestamped audit log of all user actions, including document access, status changes, data edits, report generation, and administrative changes.

• Retain audit logs in an immutable format in accordance with applicable federal records retention schedules and NARA requirements.

• Support periodic access reviews and produce access reports for oversight and compliance purposes, available to the COR upon request.

REQ-07 | Automated Alerts & Escalation Rules The DCC Tracking System shall generate automated notifications to support timely supervisory action on processing delays, QC exceedances, and SLA risks. Alert and escalation rules shall be configurable without requiring code changes. At a minimum, the system shall:

• Generate automated notifications (e.g., email, dashboard alert) when documents exceed defined processing time thresholds, consistent with same-day AQL requirements.

• Support configurable escalation rules that automatically notify supervisors or managers when SLA deadlines are at risk, and alert designated personnel when QC error rates exceed defined thresholds.

• Allow alert rules and escalation paths to be configured by authorized administrators without requiring code changes, to support dynamic workload conditions and evolving FDA processing requirements.

REQ-08 | System Integration & Interoperability The DCC Tracking System shall integrate with CDRH data systems as needed to support seamless data exchange, eliminate manual re-entry, and maintain data integrity throughout all processing workflows. The Contractor shall be responsible for designing, implementing, and maintaining all integration interfaces throughout the period of performance. At a minimum, the system shall:

• Provide interoperability capabilities that enable seamless, automated data exchange between the system and specific CDRH systems, internal platforms, and authorized external systems.

• Document, version, and maintain all integration interfaces in conformance with modern interoperability standards; documentation shall be kept current and made available to FDA upon request or at defined delivery milestones.

• Subject all system-to-system interactions, automated data transfers, and programmatic interface activity to the same access control, authentication, and audit trail requirements governing user-facing system functions.

• Have an integration design that eliminates or substantially reduces the need for manual data re-entry, minimizing the risk of transcription error and supporting data integrity throughout all exchange workflows

• Maintain a complete, tamper-evident log of all interface activity, available for FDA review.

• Utilize integration technologies and data exchange formats consistent with current industry best practices and federal interoperability standards, capable of supporting evolving FDA data exchange requirements without requiring significant re-architecture.

REQ-09 | Configurable SLA & Compliance Monitoring The DCC Tracking System shall support real-time monitoring of contractor performance against Service Level Agreement (SLA) thresholds, consistent with the Acceptable Quality Levels (AQLs) established in this Task Order. SLA parameters shall be configurable by authorized administrators to accommodate changes in FDA processing requirements. At a minimum, the system shall:

• Allow authorized administrators to define and configure SLA parameters for each document type and workflow stage, consistent with the AQLs specified in this Task Order.

• Automatically measure and report actual performance against defined SLA thresholds in real time, supporting same-day and multi-day AQL requirements.

• Provide SLA compliance dashboards accessible to management and contracting oversight personnel, including the FIRF IDIQ COR, TO COR, and TOPM.

• Generate automated SLA breach notifications and include SLA performance data in scheduled monthly progress reports and program reviews.

REQ-10 | Disaster Recovery & High Availability The DCC Tracking System shall be architected for high availability and business continuity, consistent with federal continuity-of-operations requirements and the Task Order requirement for same-day processing of all incoming submissions. The Contractor shall document and test disaster recovery capabilities throughout the period of performance. At a minimum, the system shall:

• Be architected for high availability with redundant hosting and automated failover capabilities, supporting the Contractor's obligation to perform same-day processing of all incoming documents.

• Define and meet documented Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) in alignment with federal continuity-of-operations requirements, reviewed and approved by FDA oversight personnel.

• Replicate data to a geographically separate backup environment with regular, automated backup schedules.

• Test disaster recovery plans at defined intervals, with results documented and made available to the FIRF IDIQ COR, TO COR, and TOPM.

Contractor Responsibilities

In addition to meeting the system requirements above, the Contractor shall fulfill the following responsibilities related to the DCC Tracking System throughout the period of performance:

• Maintain the DCC Tracking System in a fully operational state at all times, ensuring availability during normal FDA business hours (8:00 AM – 5:00 PM Eastern, Monday through Friday, excluding Federal Government holidays).

• Provide User Acceptance Testing (UAT) support for the DCC Tracking System and any integrated CDRH applications, collaborating with system integrators during requirements gathering sessions and reporting progress to the TOPM.

• Ensure system documentation, including Standard Operating Procedures (SOPs) related to system use, is maintained and updated in accordance with the SOP requirements of this Task Order.

• Ensure all system users complete applicable FDA information security awareness, privacy, and records management training prior to accessing the system, and annually thereafter, in accordance with training requirements of this Task Order.

• Report all suspected or confirmed information security incidents or breaches involving the DCC Tracking System to the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC), COR, and CO within one (1) hour of discovery, in accordance with incident response requirements of this Task Order.

• Retain all system-generated records in accordance with NARA records retention policies and schedules and HHS Policy for Records Management; records shall not be disposed of unless authorized by HHS/FDA.