Att_7-STO2a_SOW_01_2024.pdf

75N91024R00009

Attachment 7 -Sample Task Order 2a: Statement of Work October 1, 2024

STATEMENT OF WORK

Sample Task Order 2a, Development and Management of In-Browser Web Applications For Cancer Epidemiology

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government as needed to perform the statement of work (SOW).

I. PERIOD OF PERFORMANCE

The period of performance for this task order will be for a base period of twelve (12) months with one (1) option period of twelve (12) months.

II. TASK AREA(S)

B: Biomedical Data Modeling, Data Acquisition and Management and Task Area C: Data Analytics, Statistical and Bioinformatic Analysis and Tool Development

III. BACKGROUND

The Division of Cancer Epidemiology and Genetics (DCEG), National Cancer Institute (NCI) conducts broad-based, high quality, high impact research to uncover the causes of cancer and the means of its prevention. DCEG maintains a national and international perspective, giving priority to emergent issues identified through epidemiologic, clinical, and laboratory observations, as well as to public health concerns identified by the NCI, Congress, regulatory agencies, and other appropriate bodies.

The Division develops research resources and strategic partnerships in cancer epidemiology and genetics across NCI, National Institutes of Health (NH), and the global research community.

DCEG programs include domestic and international studies with diverse study designs in epidemiology and genetics research including prospective cohort studies, case-control studies, family studies, and randomized clinical trials. These studies span several geographic areas (potentially in any continent), are of varying size and complexity, and include dense, high-dimensional data on exposures, endpoints, clinical information, and biomarkers from molecular technologies.

IV. SCOPE

The primary goal of this task order is to provide development support for public-facing interactive in-browser web applications and notebooks for descriptive cancer epidemiology that support FAIR (Findable, Accessible, Interoperable and Reusable) principles. The software package will be composed of two parts: a set of in-browser applications (i.e., applications downloaded and run in the browser) which will support data wrangling, portable real-time analysis, and visualization through user-friendly interfaces (dashboards) and tools, and Application Programming Interfaces (APIs) backed by functions-as-a-service (FaaS). Preliminary exploration of this model can be found at https://episphere.github.io/mortalitytracker and https://episphere.github.io/forecast. The secondary goal is to implement public-facing interactive in-browser web applications and notebooks for descriptive cancer epidemiology using the APIs developed in the primary goal and data provided by Division of Cancer Epidemiology and Genetics (DCEG). Examples of the public-facing epidemiology applications include personal risk calculators such as PRScalc, https://episphere.github.io/prs, see reference at https://pubmed.ncbi.nlm.nih.gov/37868335.

https://episphere.github.io/mortalitytracker https://episphere.github.io/forecast https://episphere.github.io/prs https://pubmed.ncbi.nlm.nih.gov/37868335

V. TECHNICAL REQUIREMENTS

1. The Contractor shall configure its computers that contain HHS data with the latest applicable

United States Government Configuration Baseline (USGCB) and/or approved HHS IT Security Configuration (see: Http://usgcb.nist.gov/)

2. The Contractor shall, based on the scope provided above, perform all activities necessary to facilitate access to data stored in DCEG maintained cloud resources or publicly available data needed by DCEG investigators. DCEG shall maintain complete control of data governance and ownership.

The contractor shall create a software package that interacts with data platforms for DCEG studies and call APIs to retrieve data from various data sources (e.g., CDC, Socrata, Box). The contractor shall develop APIs which provides the collected data to the user. Depending on the level of data wrangling required, the contractor may have to collect and store the wrangled results on Cloud Storage environments, and/or Cloud middle-layers such as Box.com. An unattended mechanism to refresh the stored data may be required to refresh user-facing dashboards. In addition, the contractor shall provide a client-side library that creates graphical elements for data visualization for placement within an HTML document. An example of such interactive analytics implementation includes https://episphere.github.io/epitracker. A major criterion of success is reusability of the library for the different DCEG projects. The contractor shall create and support a suite of modular data analysis and visualization components used in the different study platforms (collectively referred to as “DCEG Data Platforms Suite)”.

The contractor shall develop, as part of the DCEG Data Platforms Suite the following:

Epitracker – Cancer: This a web-based data visualization tool shall integrate cancer mortality data and individual-level demographics (e.g., race/ethnicity, sex, age) with county-level measures of factors such as socioeconomic status, exposure to cancer risk factors, availability of healthcare, and rurality. This tool shall be customizable and allow users to directly visualize health disparities between groups to directly address scientific questions related to disparities in cancer mortality and to inform research priorities. https://episphere.github.io/epitracker

Polish Breast, Ovarian and Endometrial Cancer Study: This data platform shall share and analyze data/biospecimens from a multi-disciplinary case-control study of breast cancer to study breast cancer etiology and progression in two cities in Poland: Warsaw and Lodz.

The contractor shall also maintain two previously developed data platforms within the DCEG Data Platforms Suite: Confluence and Breast Cancer Risk Prediction Project (BCRPP).

3. AI: The contract will develop in-browser applications that leverage large language models to visualize, harmonize, interrogate and discover patterns in data and published resources such as IARC monographs.

4. PRS tooling: The contractor will develop in-browser, privacy-preserving risk calculators, such as a

Polygenic Risk Score calculator, that allows a user to securely enter their data and calculate a risk without the data leaving the user's computer.

http://usgcb.nist.gov/ https://episphere.github.io/epitracker/ https://episphere.github.io/epitracker/

5. The contractor will operationalize vetted NIH data generic backends (https://www.nlm.nih.gov/NIHbmic/generalist_repositories.html), as well as Data Commons.

In addition, the Contractor shall:

For all the previous activities in 1-5, provide APIs that facilitate access to DCEG data and specific publicly available data as directed by the Contracting Officer Representative (COR). DCEG data may be present in NCI-governed cloud resources such as Box, MSTeams, Sharepoint, OneDrive or NIH Cloud-based databases. APIs shall use serverless technologies or client-side technology (major client-side environments used by DCEG include JavaScript, R, and Python) with particular attention to integrative solution within RStudio such as Quarto, including Observable.

a. Develop software that accesses the data via the APIs and wrangle the data into a format that the user can consume and may be extended to include generation of missing elements.

The software shall be developed with flexibility as a design criterion to provide maximal re-use for additional DCEG data platforms.

b. Securely access the data using industry-standard authentication protocols like OAuth2. Data shall be accessible via mobile technologies and shall be stored in browser-based storage (e.g., indexedDB).

c. Applications design and development specification shall comply with FISMA moderate rating security controls found in NIST 800-53 Security and privacy controls for information systems.

d. Provide documentation for APIs and the software package(s).

e. Store all software code in a GitHub repository governed by DCEG.

f. Hold regular virtual meetings (e.g., every 2 weeks) with the COR and other DCEG Points of Contact (POCs) for feedback to improve usability of data platform.

g. Hold a meeting between the Contractor, COR and DCEG POCs to review the final software and documentation. This meeting shall occur no later than 10 working days prior to the end of the task order.

h. The software will be considered complete upon review of the final software and API documentation and acceptance by the COR.

Additional Technical Process Requirements

a. The Contractor shall regularly (e.g., every 2 weeks) utilize Gitter to track and respond to user group testing and feedback; and when appropriate modify design to fix or improve usability of the software package and APIs.

b. The Contractor shall rely upon a Lean Development approach for all design projects.

http://www.nlm.nih.gov/NIHbmic/generalist_repositories.html)

c. Development of all software and websites must follow all DHHS, NIH and NCI policies, guidelines, and regulations. The contractor shall agree never to check secrets (e.g., passwords, tokens, and keys) into the GitHub repository.

Close out - The Contractor shall affect a smooth, seamless transition of the management, operations, data, tools, resources, and other products generated through use of this contract to DCEG without prolonged interruption of the normal day-to-day operations.

VI. REPORTING REQUIREMENTS / DELIVERABLES

The Contractor shall prepare and submit the following during the period of performance of this Task Order in accordance with ARTICLE C.2 REPORTING REQUIREMENTS of the base contract:

a. Technical Progress Reports

1. Monthly Task Order Progress Report

2. Annual Task Order Report

3. Final Task Order Report Summary of the monthly progress reports. Ensuring that all documentation is current and available, the contractor shall also provide information in the report concerning the status of: API documentation (e.g., Swagger); Documentation that the code is publicly accessible, i.e., NCI must have complete rights to the code, preferably open-source code; Ensuring that all software code, deployment scripts, hardware and software hosting requirements, dependencies on third-party applications, documentation, and any other material necessary to maintain DCEG operations are current and available in a DCEG-owned GitHub repository.

b. Other Reports/Deliverables

4. Software Management Closeout Meeting Meeting between the Contractor and DCEG POCs to review the final software and documentation.

5. Final Software and API Documentation Deposit

The Contractor will have completed the deposition of all software and API documentation in the DCEG-owned GitHub repository. The software will be considered complete upon review of the final software and API documentation and acceptance by the COR.

c. Information and Physical Security Deliverables

The Contractor shall submit the following reports as required by the base contract. Additional information can be found at https://wiki.nci.nih.gov/display/NSCI/ATO+Package+Artifact+Checklist

6. Security Assessment & Authorization (SA&A)

SA&A Package Deliverables including a FISMA starter kit (FIPS-199, E-Auth, PIA, BIA), System Security Plan, Security Assessment Report, POA&M, Authorization Letter, Contingency Plan and Contingency Plan Test Report, Interconnection/Data Use Agreements (if applicable), https://wiki.nci.nih.gov/display/NSCI/ATO%2BPackage%2BArtifact%2BChecklist

Configuration Management Plan (if applicable), and Configuration Baseline. Package submission is required for assessment and issuance of an Authority to Operate (ATO).

7. Roster

As described in Article H. of the base contract

8. Contractor Non-Disclosure Agreement (NDA)

9. Vulnerability Scanning Reports

10. IT Security Training All contractor (and/or subcontractors) assigned to work on this contract shall complete the applicable HHS/NIH contractor information security awareness, privacy, and Records Management training at http://irtsectraining.nih.gov/.

Item Description Delivery Schedule Technical Progress Reports 1 Monthly Task Order Progress Reports 15 calendar days following each reporting period 2 Annual Task Order Progress Reports 15 calendar days following each reporting period 3 Final Task Order Report On or before Task Order expiration date Other Reports/Deliverables 4 Software Management Closeout Meeting No later than 10 working days prior to the end of the task order.

5 Final Software and API Documentation Deposit Due no later than 5 working days prior to the end of the task order Information and/ or Physical Security 6 Security Assessment & Authorization (SA&A) Due within 30 calendar days of IT system initiation 7 Roster 14 calendar days after Task Order award.

Revisions to Roster due within 7 calendar days of any change

8 Contractor Non-Disclosure Agreement (NDA) Prior to performing any work under the Task Order

9 Vulnerability Scanning Reports Within 10 days following each reporting period 10 IT Security Training http://irtsectraining.nih.gov/ Prior to any activity and annually after Task Order award

11 Section 508 Annual Certification: Accessibility Conformance Report (ACR), based on current version of the ITIC Voluntary Product Accessibility Template (VPAT)

Due upon submission of the Final Progress Report, no later than ten (10) calendar days prior to the end of the task order.

http://irtsectraining.nih.gov/ http://irtsectraining.nih.gov/ https://www.itic.org/policy/accessibility/vpat https://www.itic.org/policy/accessibility/vpat