info@JohnSnowLabs.com © John Snow Labs, Inc. 2022 (302) 768-5227

Statement Work (SOW)

1. Background

The Food and Drug Administration (FDA) is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that emit radiation. The FDA also has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors. Additionally, the FDA is responsible for advancing the public health by helping to speed innovations that make medical products more effective, safer, and more affordable and by helping the public get the accurate, science-based information they need to use medical products and foods to maintain and improve their health.

The organization sponsoring and supporting this requirement is the Office of Computational Science (OCS) in the (super) Office of Translational Sciences (OTS) under the Center for Drug Evaluation and Research

(CDER).

The Center for Drug Evaluation and Research (CDER) performs an essential public health task by making sure that safe and effective drugs are available to improve the health of people in the United States. As part of the U.S. Food and Drug Administration (FDA), CDER regulates over the counter and prescription drugs, including biological therapeutics and generic drugs.

The Office of Translational Sciences empowers a collaborative and high performing workforce to champion innovation and advance global human drug development. The vision of this super office is to drive advancements in human health through scientific and regulatory innovation. A summary of current work being done includes:

• Promoting scientific collaboration and innovation in drug regulatory review across CDER

• Assuring the validity of clinical trial design and analysis in regulatory decision making

• Developing and applying quantitative and statistical approaches to decision making in regulatory review process

• Ensuring alignment with CDER goals

• Serving the CDER scientific community in establishing technology transfer agreements that are vital to collaboration with the broader scientific community

• Maintaining knowledge management databases that can be the basis of improvements in the regulatory review process

• Overseeing bioequivalence inspections to ensure the availability of safe and effective generic equivalents of investigational drugs

The mission of the Office of Scientific Computing is to provide CDER reviewers innovative and reliable solutions that improve and strengthen the scientific review process by integrating data, tools, and training.

The focus of OCS’s current efforts include:

• Building solutions that drive New Drug Modernization, promote access to quality data, and optimize data analysis capabilities

• Processing Study Data for rapid use

• Delivering effective tools, technologies, services, and training to meet CDER’s mission

• Delivering solutions that streamline Bioresearch Monitoring (BIMO) workflow for reviewers and inspectors

• Spearheading the CDER Innovation Board to harness subject matter expertise across FDA

• Offering cloud-enabled innovation space for tools, technologies, and data exploration

• Connecting CDER staff to the scientific computing resources and technology needed to drive efficient analysis and cost-effective solutions mailto:info@JohnSnowLabs.com

• Collaborating with industry, academia, and other external partners through our work with PHUSE, CDISC and BioCelerate

Currently, the CDER process to identify submissions containing standard data is labor intensive: the Office of Business Informatics reviews all new submissions and performs an assessment on a few relevant files to determine if the submission appears to be SDTM (Study Data Tabulation Model) compliant. The DataFit system automatically and systematically checks submission and validates conformance of study data to CDISC Standards (e.g. SDTM, ADaM [Analysis Data Model], SEND [Standard for Exchange of Nonclinical Data]). This automated systematic approach will allow CDER to successfully transition to a more advanced regulatory process which takes full advantage of the benefits of high-quality standardized data improving the ability for Food and Drug Administration (FDA) reviewers to make science based regulatory decisions faster.

2. Project Scope

The objective is to install, update, support, and develop enhancements and to maintain DataFit, the CDER’s data standards validation platform. DataFit supports multiple FDA needs for analyses of clinical trial data and non-clinical data and it integrates with existing systems to provide data standards validation.

The scope includes all the activities necessary to support regulatory review operations, to maintain and provide enhancements to DataFit, which include necessary management functions such as Project Management, and Release Management. The majority of the DataFit capabilities are delivered through Pinnacle21 Enterprise, which is based on the open source CDISC clinical trial data standards compliance software and is licensed for use by FDA employees. DataFit extends the P21 Enterprise capability to functions unique to the FDA, such as implementing FDA business rules, FDA tools specific rules and interfacing with existing FDA systems.

There is a need to have a platform that is flexible and can integrate and coordinate a variety of checking methods/procedures/programs in connection with a database.

The scope includes:

• Install/support/maintain DataFit by providing Steady State Activities described in SOW including software, interface, and configuration installation and updates in development, test and production environments.

• Provide Pinnacle 21 enterprise license, or equal to solution to FDA.

• Provide technical and customer support.

• Participate in Change Control process and document lessons learned.

• Develop iterative release schedule using agile methodology for minor and major releases informed by CoreDF assessment for current baselined codebase and DataFit platform upgrades and identified bugs.

• Conduct project management tasks including CPIC required activities.

• Provide technical support to troubleshoot and help resolve user, tool interface, system integration, or system operational problems.

• Generate metrics reporting on validation results as needed

• Create and maintain accurate documentation in accordance with DHHS’s / FDA’s Enterprise

Performance Life Cycle (EPLC) for IT systems for O&M releases, O&M and DME change requests, and other development activities documents identified in future DME orders issued against this contract.

3. Requirement Description

The FDA requires software licenses, configuration management, training, and professional support services to fulfill this requirement:

3.1. DataFit Enterprise / FDA Specific Version, or equal to

Pinnacle 21 and DataFit provide unique/salient solutions by providing:

• Exclusive FDA-integrated functionality that extends beyond standard Enterprise capabilities to include:

o Deep regulatory alignment, backed by years of partnership and direct influence on CDISC and industry standards.

o End-to-end validation and submission readiness support grounded in FDA-specific workflows, specifically supporting

Clinical CoreDF Reports already in operation Nonclinical CoreDF Reports already in operation BIMO CoreDF Reports already in operation Modified reports tailored to existing OOD requirements already in operation Modified reports tailored to existing OCP requirements already in operation o Advanced automation and integration, reducing submission review timelines and improving data quality.

o A proven, validated platform operating at scale within FDA’s critical drug review operations.

Pinnacle 21 has been a long-time partner to FDA/CDER/OTS, providing the DataFit platform and expert services that ensure standardized, high-quality clinical and nonclinical data are ready to support timely, science-based regulatory decision-making. P21 is a Certara company, and supports CDISC standards compliance, clinical data quality, and regulatory submission readiness. Their mission also directly aligns with FDA’s public health priorities and include improving the quality of clinical data and advance patient safety.

FDA-Specific Technical Requirements - Integration with FDA Systems

- Existing integrations with EDR, CTR, Data Central, and iPortal must continue without modification and without disruption to current daily operations

- Automated submission intake workflows must remain operational for:

o Clinical CoreDF Reports o Nonclinical CoreDF Reports o BIMO CoreDF Reports o Modified reports tailored to existing OOD requirements already in operation o Modified reports tailored to existing OCP requirements already in operation

- Reviewer-facing reporting systems must maintain current functionality

Any proposed "equal" solution must demonstrate:

a. Existing implementation of FDA's complete 3-tier validation rule architecture (TRC + Business Rules + Validator Rules) without requiring re-engineering

b. Proven ability to process ts.xpt-based study classification logic as documented in FDA's Study

Data Technical Conformance Guide

c. Existing publicly available sponsor-side validation tool that mirrors FDA's internal validation engine (equivalent to Pinnacle 21 Community's "FDA engine")

d. Current integration with FDA's EDR, CTR, Data Central, and iPortal systems without requiring system modifications

e. Ability to import and execute existing FDA Business Rules (v1.5) and Validator Rules (v1.6) without translation or re-engineering

Offerors proposing an "equal" solution must provide:

a) Detailed technical documentation demonstrating each capability

b) Transition plan with timeline and cost estimate

c) Risk mitigation strategy for industry-facing validation ecosystem disruption

d) References from other regulatory agencies using equivalent FDA-specific configurations

History with FDA/CDER Pinnacle 21 has collaborated with FDA since 2011 and has successfully delivered DataFit Support Services, including full implementation, operational support, and enhancements to CDER’s data validation ecosystem.

This work has established DataFit as a core capability for modernized regulatory review. Past performance highlights include:

• Deployment of Pinnacle 21 Enterprise and DataFit across development, test, pilot, and production environments.

• Seamless integration with FDA systems including EDR, CTR, Data Central, and OCP’s iPortal.

• Delivery of complete validation documentation (User/Functional Requirements, Validation Plan, IQ/OQ/PQ testing, User Manuals, and Release Notes).

• Development and maintenance of FDA-specific clinical and nonclinical business rules and automation of daily Core DataFitness (CoreDF) assessments.

• Support for standardized data flow into critical reviewer systems, enabling faster, more consistent evaluation of submissions.

Salient Capabilities Tailored for CDER’s Mission Pinnacle 21 provides comprehensive support across the full lifecycle of CDISC standardized data submissions:

• DataFit Operations & Maintenance: system updates, performance tuning, production support, user access integration, and real-time data validation.

• CDISC Submission Processing: tracking, data-fitness checks, conformance assessments, and CTR loading verification.

• Standards Integration & Enhancements: incorporation of evolving CDISC and FDA rule sets, SEND Explorer-based rules, and ADaM FDA business rules.

• Reviewer-Focused Reporting: CoreDF reports for BIMO, OCP, OOD, clinical and nonclinical disciplines; KickStart/JumpStart early-assessment reporting; Data Quality Report enhancements for OCS tools.

• Future-Ready Technical Support: Dataset-JSON 1.1, eCTD validation, expanded API capabilities, and integration with additional reviewer tools.

Pinnacle 21 provides FDA-exclusive and unique capabilities that define DataFit’s value:

• FDA-embedded business rules for both clinical and nonclinical data.

• Daily automated CoreDF assessments of all original submissions.

• Deep integration with existing CDER review systems and workflows.

• A global community of 50,000+ users, ensuring unmatched maturity, stability, and standards expertise.

4. Requirements – Tasks and Deliverables The Contractor shall perform project management activities to ensure control, management, monitoring, and notification mechanisms to meet the requirements of this procurement.

4.1. TASK AREA 1: Project Management (Firm-Fixed Price)

4.1.1 Kick-Off Meeting

The Contractor shall conduct and provide an agenda and Kick-off Presentation for a Kick-off Meeting at the FDA facilities in Silver Spring, MD to introduce the Contractor team to additional stakeholders, present the COR approved kick-off presentation, review the scope of work and technical approach, and delivery schedule and facilitate questions and discussions. The Kick-off Meeting shall be scheduled within ten (10) business days of award.

The Contractor shall coordinate with the COR to determine date, time, location and attendees for the Kick-off Meeting.

The Contractor shall submit meeting minutes for the Kick-off Meeting within two (2) business days of the meeting and upload them to the FDA’s project repository (e.g., SharePoint), along with other meeting materials (e.g., slide deck used for the kick-off presentation).

MEETINGS

Meeting/Activity Description Location Estimated Frequency

Kick-Off Meeting

Stakeholder meeting for staff introductions and contract review of content within 10 business days of award

FDA White Oak/Online 1

DELIVERABLES

4.1.2 Project Management (Firm-Fixed Price)

The Contractor shall establish control, management, monitoring, and notification mechanisms to ensure that tasks stay on track to meet the important milestones and performance measures within the awarded order.

The Contractor shall perform the following task management and project management (PM) activities:

A. Provide a final Management Plan to the Contracting Officer Representative (COR) within 45 business days of award describing the technical approach, organizational resources, risk management and other management controls to be employed to meet the cost, performance and schedule requirements.

B. Prepare project artifacts, EPLC documentation, and other PM materials for and participate in meetings related to project reviews, stage gate reviews, team meetings, management briefings, stakeholder presentations, cross‐agency information exchanges and other similar meetings. The COR or COR designee will provide the dates, time, and location of the meetings at a minimum of three (3) business days prior to the meeting.

C. Ensure completion and submission of information required for the on-boarding of contractor employees who will be working on this order immediately following award as well as compliance with security clearance requirements for management of PIV cards provided to contractor staff.

Deliverable Frequency/Due Date Delivered To Kick-off Presentation. DRAFT: Within 5 business days of award.

FINAL: Within 1 business day of Kick-off Meeting.

COR

Kick-off Meeting Agenda and Minutes.

Agenda – 1 business day prior to meetings; Minutes – 2 business days post meeting.

COR and Attendees

D. Provide ad‐hoc COR‐requested documentation needed for data calls, management decisions and requests, conferences, and reporting. The COR will provide direction, details and timelines to the Contractor. The Contractor shall consult with the COR or COR designee for clarification of the documentation requirements. Examples of documentation shall include:

1. Release Notes

2. Requests for Change

3. Help Desk Ticket Summaries

4. Posters for FDA Scientific Computing Days Conference

E. Submit Government Furnished Equipment (GFE) Inventory Report. The Contractor shall prepare and provide the COR or their designee an inventory of government furnished equipment (GFE) and FDA‐provided software licenses in MS‐Excel format. The Contractor shall ensure that the Contractor GFE Inventory is updated when resources are added or removed from the project. At a minimum, the Inventory Report shall include the following:

1. Serial Numbers

2. FDA Property Codes

3. Model Numbers

4. Licensed Software Name and License Number

5. Item Description

6. Person Assigned To

7. Location

F. Provide Monthly Status Report to the COR and COR designee for all tasks awarded under the statement of work. This Status Report shall include:

1. Status Updates

2. Earned Value Management (EVM) reporting to include cost and schedule progress and variances against the Project Schedule.

3. Significant risks to scheduled deliverables and plans to mitigate them

4. Issues and recommendations for escalation

5. Status of tickets and metrics

6. Recommendations for changes or additional activities

G. Maintain required EPLC documents in accordance with the EPLC. The project team has a full set of EPLC documentation. The Contractor shall use the Project Process Agreement (PPA) (EPLC document) to determine what documentation should be updated with each release.

H. Identify, create, submit and track through completion approximately 15‐20 requests for change and/or provision requests for maintenance, releases, integration, and enhancements. Change and provisions requests use the RQST‐IT system. RQST‐IT is an FDA system that supports the business process for evaluating and tracking all new projects, provisioning and software and hardware configuration changes, requests, assessments of new software and software versions.

The Change processes are managed by FDA’s ServiceNow application.

I. Attend Change Control Boards (CCBs) such as infrastructure, desktop, firewall and application

CCBs when changes requests have been submitted that impact the application or hardware. The Contractor shall complete all required forms and present changes to the board in accordance with the FDA CCB Charter. This charter is located at:

https://fda.sharepoint.com/sites/DelMgmtSupport/CCM/Shared%20Documents/Forms/AllItem s.aspx?id=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommuni cations%2FOIMT%5FCCB%5FCharter%2Ev3%2E0%2Epdf&parent=%2Fsites%2FDelMgmt Support%2FCCM%2FShared%20Documents%2FCommunications https://fda.sharepoint.com/sites/DelMgmtSupport/CCM/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications%2FOIMT%5FCCB%5FCharter%2Ev3%2E0%2Epdf&parent=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications https://fda.sharepoint.com/sites/DelMgmtSupport/CCM/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications%2FOIMT%5FCCB%5FCharter%2Ev3%2E0%2Epdf&parent=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications https://fda.sharepoint.com/sites/DelMgmtSupport/CCM/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications%2FOIMT%5FCCB%5FCharter%2Ev3%2E0%2Epdf&parent=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications https://fda.sharepoint.com/sites/DelMgmtSupport/CCM/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications%2FOIMT%5FCCB%5FCharter%2Ev3%2E0%2Epdf&parent=%2Fsites%2FDelMgmtSupport%2FCCM%2FShared%20Documents%2FCommunications

It is anticipated that the Contractor shall participate in 4‐6 CCB meetings per year.

J. Create and maintain required support documents that include User Guides and Customer Support Operations to ensure accurate information after each release.

K. Conform to FDA specific guidance, applicable laws, regulations, policies and standards included in the underlying statement of work, including those included in this requirement under Technical Standards and Conformance Guidelines.

MEETINGS

Meeting/ Activity Description Location(s) Estimated

Frequency

Project Team Meetings Project Status Meeting Remote and at FDA

Weekly until directed by COR to move to bi-monthly

Ad-Hoc meetings (briefings, presentations, information exchanges

Additional meetings as necessary to communicate status, technologies, analyses, capabilities

Remote and at FDA

Maximum of 6 times per year

ATO Annual Review

Meetings with Information System Security Officer (ISSO) and assessors to review the technical security features of the system and identify security bugs and vulnerabilities

Remote and at FDA

3-5 meetings July/August

IT Change Control Board

Board that approves changes to any production system Remote 4-6 times a year

Deliverable Frequency/Due Date Deliver To

Management Plan Draft due 30 business days after award. Final due 45 days after award

COR or COR Designee

GFE Inventory Report Within 30 days after award and updated when inventory or staff change COR

Monthly Status Report Due the 10th of each month for prior month COR or COR Designee

CPIC Reporting/Earned Value Reporting Due the 10th of each month for prior month COR or COR

Designee

4.2 Development and Enhancements (Labor Hour)

The Contractor shall continue to work with business product owners and COR to develop FDA specific functionalities. The areas of enhancement include:

CoreDF Clinical Report and business rules o Maintain and enhance (per direction from FDA Reviewer stakeholders) the clinical FDA business rules published by FDA into the Enterprise Validation Rule Engine o Maintain and enhance CoreDF reports and requirements based on direction from the FDA Reviewer stakeholders.

o Develop new CoreDF reports identified by reviewers within CDER offices o Participate in monthly Clinical Reviewer Focus group to gather the requirements

CoreDF Non-Clinical Report and business rules o Maintain and enhance (per direction from FDA Reviewer stakeholders) the non-clinical

FDA business rules published by FDA into the Enterprise Validation Rule Engine o Implement Non-clinical Service required reports including conformance and validation report o Develop CoreDF reports for non-clinical reviewers o Maintain and enhance (per direction from FDA Reviewer stakeholders) the new validation rules from SEND Explorer reviewer tool ADaM and business rules o Maintain and enhance (per direction from FDA Reviewer stakeholders) the ADaM business rules into the Enterprise Validation Rule Engine o Collect ADaM CoreDF reporting requirements and develop CoreDF reports for ADaM and Traceability reports

System Integration o Develop, maintain and enhance (per direction from FDA Reviewer stakeholders) integration with downstream systems such as BIMO or any other FDA tools Office of New Drug’s Oncology (OOD) CoreDF reports o Develop new features based on requirements from Office of Oncology Office of clinical Pharmacology (OCP) CoreDF reports o Develop new features based on requirements from Office of clinical Pharmacology BIMO CoreDF reports o Develop new features based on requirements from BIMO and TCG (Technical Conformance Guidance)

Develop and implement requirements for Data Quality Report for OCS tools and tools from other divisions and offices

Assist and conduct pilot for new CDISC standards or extension of existing CDISC standards

Deliverable Frequency/Due

Deliver To Business and technical requirements documentation As needed for software updates COR or COR

Designee.

EPLC Documentation and Updates Ongoing COR.

Update User/Reference Guides and documents with each release

Ongoing COR or COR Designee.

Deliverable Frequency/Due

Deliver To Upgrade DataFit with new versions of Pinnacle21 Enterprise

Approximately Twice per year COR or COR Designee

Updated EPLC documents for major releases following FDA’s release management process

Approximately Twice per year COR or COR

4.3 Operations and Maintenance (Firm-Fixed-Price)

The Contractor shall perform all the functions necessary to further support and implement DataFit and its underlying components in all environments. The Contractor shall perform the administrative functions for this tool throughout the period of performance. DataFit Systems Operations and Maintenance Support activities focus on routine operations and maintenance of the application. The production environment uptime rates do not include an allowance of 10 hr./month for planned maintenance performed by ODT if a longer period of application downtime is required, these would be scheduled over a weekend time. The maintenance tasks shall be targeted between 6 PM and 4 AM Eastern Standard Time (EST) during the weekend; any exceptions shall require written approval by the COR. The downtime for maintenance will not be considered in determining compliance with the targeted system uptime. The Contractor shall ensure that the COR or COR's explicit designee and appropriate OIM points of contact are informed, and that approval is obtained prior to execution of the associated maintenance tasks.

The Contractor shall provide the DataFit Maintenance and Support activities, which include the following subtasks:

DataFit Application Problem Resolution DataFit Reporting and Other Documentation System Performance Support Technical Refresh Migration Release Management Configuration and Change Management System Documentation Automated updating to allow for ease of incorporation of updates for newly published DataFit rules (e.g., new versions of CDISC, MedDRA, FDA Business rules) Maintenance of enterprise-level integration with CDISC data conformance reference checking software

4.3.1 DataFit Application Operation and Maintenance Support

DataFit application operation and maintenance support activities focus on routine maintenance activities to ensure that the application is up and running, functioning as expected and problems are addressed in a proactive manner. It also includes routine updates to software versions, interfaces to other systems, and configurations. The Contractor shall provide maintenance and support for the following:

• Installations and Updates to software versions to keep the system current.

• Contractor shall provide updates to interfaces with other systems. Known interfaces to other

FDA systems include Data Central The contractor shall provide yearly updates coinciding with major changes to external systems.

• Installations and Updates to software and hardware configurations.

• Patching, installation, re-installation, and upgrades of 3rd party software, web page updates and general troubleshooting.

• Support Clinical, Non-clinical Services (formally known as JumpStart and KickStart) and Core Data Fitness programs by supporting the loading, validating, reporting of data quality metrics, and addressing submission data issues.

• For Patch Releases, the contractor shall perform application patching impact analyses and modifications prior to implementing into production. Activities shall include, but are not limited, to the following:

o Test patches and upgrades to DataFit service and supporting applications in the Development and Test environments.

o Document and communicate proposed changes to user community at time of patching.

o Update User Manuals and Reference Guides with each release o Promote all accepted changes to the Production environment.

• Provide administrative user support for approximately 15 business users. Support can be on-site or off-site and is required only during usual business hours (Monday-Friday 8:30am- 5pm).

• Provide Deployment Documentation, which includes:

o Version Description Document (VDD) via EPLC template o Implementation Plan via EPLC template o Operations and Maintenance Plan via EPLC template o Target State Diagrams (TSD)

The Contractor shall provide Operational support for the following:

• Provide administrative user support and knowledge transfer for business users. Support can be on-site or off-site and is required only during usual business hours.

• Maintain and update manuals and guides by incorporating new instruction for new modifications

• Organize and publish business rule updates to the industry with every change.

The Contractor shall provide support for the following areas:

• Issues related to interpretation of data.

• Extract submission and study metadata from EDR or other CDER developed system, Define.xml, and TS domain.

• Automatically generate submission and study objects in DataFit.

• Automatically determine which profiles to execute based on standard version, therapeutic area.

• Evaluation of potential impact of identified data issues on review process.

• Additional research on data issues in submission data.

• Maintenance and improvement of existing profiles and rules.

• Troubleshoot issues and fix existing profiles and rules.

• Remove false positives.

• Improve profile Pass/Fail criteria.

• Improve weighting system.

• Update current profiles to align with CDISC standard.

• Provide updates to accommodate for SDTM 3.2 or latest.

• Provide updates to accommodate for SEND 3.1 or latest

• Provide updates to accommodate for ADaM 1.0 or latest

4.3.2 Upgrade DataFit with New Versions of Pinnacle 21 Enterprise, or equal to solution

The contractor shall provide Pinnacle21 Enterprise license, or equal to solution to FDA. The Contractor shall upgrade Pinnacle21 Enterprise with each 6-month release. Pinnacle21 Enterprise is currently on a 6-month release schedule delivering 1 major and minor release upgrade annually.

These releases will bring new features that are critical to improving submission data quality and modern review process. The contractor shall provide 2 upgrades (1 major and one minor during the performance of this contract, which shall require:

• Testing each release before installing in production.

• Deploying each release into test, pre-production, and production environments.

• Support UAT process shall include writing test scripts, summarizing results and updating systems to fix issues identified.

4.3.3 Support Change Control Board Activities

The Contractor shall participate in and support Change Control and Configuration Management (CM) for major / minor releases upgrades, patches, enhancement activities, and in accordance with FDA standards and processes as defined by EPLC project artifacts.

The purpose of the CCB is to oversee change control activities. The CCB process enables a dialog between the stakeholders and the project team. Stakeholder engagement ensures that issues and risks are identified and resolved, the progress of the project is discussed, and approval to proceed with required changes is obtained in a timely manner. The Contractor shall:

Support the CCB processes to ensure that change requests are managed and documented.

Change requests include product defects and enhancements, as well as alterations to project schedule, cost, and scope.

Provide Change Request Report with proposed change requests with technical information (e.g., technical feasibility, technical alternatives, level of effort (LOE) required to complete the change, impact on application).

Use configuration management to manage the changes of configuration items as changes are approved and implemented.

Attend Change Control Board (CCB) meetings (not to exceed more than twice per month).

Analyze and report on the level of effort and impact on the application.

Support CoreDF Assessment activities by generating CoreDF reports on not only all original submissions to FDA but also resubmissions and all other types identified by the users

The Contractor shall support system release deployment activities to ensure that the correct code is identified for release into the proper environments. The Contractor shall work with the FDA Change Control and Configuration Management (CM) tools to manage DataFit artifacts & configuration items (e.g., software code, system documentation, and project documentation) and processes. Listed below are some examples of the Management Tools that are currently being used:

Service Now

JIRA

RequisitePro

4.3.4 Release Management

The Contractor shall deploy new software releases after coordinating with the DataFit Project Manager and other FDA Integrated Project Team members. The Contractor shall follow FDA Release Management guidance. The Contractor shall update EPLC documentation, as identified in the Project Process Agreement (PPA) document, for each software release. The contactor shall perform activities include, Conduct release implementations, planning, scheduling, and communications.

Conduct resource planning and scheduling.

Update required lifecycle documentation.

Update Version Description Document (VDD) with each release Plan for and implement unscheduled releases due to software defects and other emergency changes.

Execute production releases.

Plan for Communications and Training for implemented changes.

Update required EPLC documentation to include required WODC and ADC documentation.

4.3.5 Processes and Documentation (Metrics Report)

The Contractor shall store and track documentation using FDA established tools that are accessible to the DataFit Project Manager as provided by the COR upon award. SharePoint is the primary repository used to store documentation for team access. Version control shall be used for all artifacts and configuration items. The Contractor shall store and retrieve all DataFit-related user documents in one central repository for access by DataFit users as provided by the COR upon award.

The list of metrics to be tracked may evolve over time at the direction of the COR/COR designee.

The contractor shall provide a quarterly Metrics Report to the COR and the contractor shall ensure that the Metrics Report includes the following:

Defects Metrics o List of defects resolved in each release and cumulative number resolved for the year o Planned and actual resolution date for each defect resolved in the month o Average duration of open defects o List of any new defects identified in the month, including system, source (existing legacy or release in which introduced), and priority System Availability Metrics o System Downtime percentages o System Issue response times o System Issue resolution times

Performance Metrics System Use Metrics CPIC Metrics

Contractor shall participate in annual security assessment and audits required by the Information Systems Security Officer.

Deliverable Frequency/Due Date Deliver

Release Notes Approximately every Quarter COR or COR

JIRA reports Ongoing COR or COR Designee.

Change Request Report Ongoing COR or COR Designee.

Create and Update Version Description Document (VDD) Ongoing based on releases COR or COR

Designee

Supporting documents of the DataFit platform Quarterly COR or COR

Deliverable Frequency/Due Date Deliver

Software Release to production 4-8 per year; or agreed by COR and contractor

COR or COR

4.4 Release Management (Firm-Fixed-Price)

The Contractor shall work with the DataFit Project Manager/COR and other FDA Integrated Project Team members to perform the deployment each integration point. Contractor shall follow FDA Release Management guidance. The Contractor shall provide EPLC documentation, as identified in the Project Process Agreement (PPA) document, for each software release. PPA is the template used for Software Development projects. The Contractor shall develop the specific EPLC documentation listed in the tailored PPA for each production release. These activities include:

Support release implementations, planning, scheduling, and communications Support resource planning and scheduling Support the creation of required lifecycle documentation Plan for and implement unscheduled releases due to software defects and other emergency changes Support production releases Plan for Communications and Training for implemented changes Update required EPLC documentation

4.5 Software License (Firm-Fixed-Price)

The contractor shall provide FDA wide Pinnacle21 Enterprise version, or equal to solution, which is the base version of DataFit for this requirement.

5. Inspection and Acceptance

In accordance with the inspection and acceptance clauses of the contract, all work under this order is subject to inspection and final acceptance by the Contracting Officer or duly authorized representative of the Government. The Government’s Contracting Officer’s Representative (COR) is a duly authorized representative of the Government and is responsible for inspection and acceptance of all items to be delivered under this order. The general quality measures, as set forth below, will be applied to each work product received from the Contractor for requirement.

• Accuracy: Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style with minimum number of bugs and issues.

• Clarity: Work products shall be clear and concise. Diagrams shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements: All work products must satisfy the requirements of this statement of objective.

• Timeliness: Work products shall be submitted by the due date specified in the Statement of Work or submitted in accordance with a later scheduled date determined by the Government.

• File Editing: All text and diagrammatic files shall be editable by the Government.

• Format: Work products shall be submitted in hard copy (where applicable) and in media as approved by the COR prior to submission.

Non‐conforming products or services will be rejected. Deficiencies will be corrected, by the Contractor, within ten (10) business days. If the deficiencies cannot be corrected within the specified time period, the Contractor will immediately notify the FDA COR and CO of the reason for the delay and provide a proposed corrective action plan within ten (10) business days.

The Contractor shall provide a copy of each deliverable under this order in draft format to the COR and other program personnel as instructed by the COR. Within ten (10) business days of receipt, the COR or designee will review the deliverable and suggest any changes and/or accept or reject the deliverable.

In the event the Government rejects any deliverable, the COR shall notify the Contractor in writing explaining the specific reason(s) for the rejection. If the Government suggests changes, or rejects, the Contractor shall resubmit the revised deliverable within ten (10) business days after receiving the Government’s input.

If the Contractor does not receive suggestions or comments within ten (10) business days of submitting a deliverable, the Government has accepted the deliverable unless stated otherwise by the COR.

The Contractor shall make all documentation available in a designated area that is accessible to the COR or their designee.

Deliverables are scalable relative to the risk, size and complexity of the project. The Contractor shall work with the Government to determine the appropriate level of deliverables and milestones to ensure a successful outcome.

All deliverables and other contract work products shall be considered to be solely owned by the Government and shall not be labeled ‘copyright’, ‘proprietary’ or anything similar that might preempt the desired environment of fluid sharing and partnership. The Contractor shall provide to the Government access to all work products including but not limited to: research, designs, code, constructs, databases, and documentation.

Inspection and acceptance shall be performed at 10903 New Hampshire Avenue, Silver Spring, Maryland 20993, any other FDA facility, or remotely.

6. Order Administration Information

Period of Performance This contract has a base year plus two additional option years. The periods of performance are as follows:

Base year period of performance (POP) is 9/28/2026-9/27/2027 Option year #1 period POP is 9/28/2027-9/27/2028 Option year #2 period POP is 9/28/2028-9/27/2029

This may get revised based on the emergency situations need.

Contract Type This is a combination of Firm-Fixed Price and Labor Hour contract type.

Place of Performance The Contractor shall have its own facility to perform the work. The Contractor shall attend meetings at FDA locations in the Washington DC area, as directed. Local travel is not reimbursable. Meetings, briefings, interviews and work sessions shall be conducted at the FDA’s Washington D.C. Metro-area offices as specified by FDA’s appointed representative (COR) managing the contract.

Contract Administration

Contract Specialist (CS):

Tiffany Gates Tiffany.Gates@fda.hhs.gov mailto:Tiffany.Gates@fda.hhs.gov

Contract Officer (CO):

(To be entered at time of award)

Contracting Officer’s Representative (COR):

(To be entered at time of award)

Contracting Officers’ Authority The Contracting Officer (CO) is responsible for ensuring the performance of all necessary actions for effective contracting, ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this contract and is the only person authorized to approve changes to any of the requirements under this contract, and notwithstanding any provision contained elsewhere in this contract, this authority remains solely with the CO.

No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this award. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the contract. The Government will not reimburse the Contractor for any work not authorized by the CO, including work outside the scope of the contract.

All work shall be accomplished in accordance with the FDA, Department of Health and Human Services

(HHS), and Office of Management and Budget (OMB) standards described below. In the event the Contractor is unable to meet the standards, they shall immediately notify the COR. The Contractor shall comply with applicable federal information technology and information management laws, regulations, policies, and standards at the government‐wide, HHS, and FDA levels, pursuant to guidance and instruction from the COR and as provided in this statement of work. At the government‐wide level, these include OMB, National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: https://www.cio.gov. See the underlying statement of work for all technical and conformance guidelines. The below standards and guidelines have been included for quick reference.

6.1 Software Development Lifecycle Standards

The Contractor shall follow the standard development lifecycle for FDA IT systems and modules. Currently, the FDA follows the HHS Enterprise Performance Life Cycle (EPLC) management process, which includes both waterfall and agile methodologies. FDA expects the use of agile methodologies. This process‐driven IT lifecycle management approach emphasizes enterprise integration based on development of sound business and technical requirements. The framework will evolve over time in response to changes in technology and business needs and, therefore, the Contractor is expected to adapt accordingly to comply with the most current framework methodology in performance of work under this statement of work. The Contractor shall consult with the COR and/or COR designee to clarify the EPLC artifacts required for an individual project or system. The required artifacts depend on the release type and are tailored through the Project Process Agreement (PPA). Furthermore, the Contractor shall ensure that updated artifacts are maintained in the appropriate repositories.

Additional requirements for IT application design, development, or support include the following:

A. The Contractor (and/or any subcontractor) shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

B. The Contractor (and/or any subcontractor) shall follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system https://www.cio.gov./ software vulnerability exploits.

C. The Contractor (and/or any subcontractor) shall ensure that computer software developed on behalf of HHS/FDA or tailored from an open-source product, is fully functional and operates correctly on systems configured in accordance with government policy and federal configuration standards. The contractor shall test applicable products and versions with all relevant and current updates and patches updated prior to installing in the HHS/FDA environment. No sensitive data shall be used during software testing.

D. The Contractor (and/or any subcontractor) shall protect information that is deemed sensitive from unauthorized disclosure to persons, organizations, or subcontractors who do not have a need to know the information. Information which, either alone or when compared with other reasonably-available information, is deemed sensitive or proprietary by HHS/FDA shall be protected as instructed in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. This language also applies to all subcontractors that are performing under this contract.

6.2 Release Management

The Contractor shall work within the FDA guidelines for Release Management and Coordination. This process provides application and service teams a shared solution for planning releases. The Release Management and Coordination meeting will complement the Change Control and Configuration Management process by:

• Forecasting and communicating upcoming releases,

• Assisting with the resource confirmation process, and

• Expediting the Change Control Board meetings.

The Release Management activities occur before requests for change are submitted to the Change Control Board.

6.3 Change Control and Configuration Management

The FDA has a Change Control, Configuration and Release Management Team who is responsible for managing the process of formally changing the FDA IT Infrastructure by facilitating the Change Control Board and Configuration Items database. Documentation and procedures will be provided by COR at award.

The team performs the following key functions:

• Facilitate the Change Control Board (CCB).

• Is Process Champion for Configuration and Change Management, including EPLC artifacts.

• Administers the automated Configuration Management Tools.

The FDA’s Configuration Management process is used to control changes within the functional and physical aspects of FDA systems, thus ensuring the proper maintenance of integrity and traceability throughout the system development life cycle.

6.4 Request Quality Services and Technology from IT (RQST-IT Tracker) The FDA has instituted the RQST‐IT process to track projects, provisioning, technologies and configuration changes across the agency. The introduction of a new technology or IT project, version change of an already approved technology or change to the configuration of the system requires the submission and approval of an RQST‐IT request. The Contractor shall be responsible for supporting the RQST‐IT process including writing and submitting requests and tracking them from inception through completion.

The FDA Center IT Investment Review Boards (ITIRBs) may need to be included in a coordinated review process. The RQST‐IT process is also used to request the provisioning of new servers in both data centers.

6.5 Data Quality Standards

FDA has approved data standards for e‐submissions and their regulatory review process. For example, CDER data standards references and resources can be found at the following site:

https://www.fda.gov/forindustry/datastandards/studydatastandards

The CDER Data Standards Program does the following:

• Identifies data standard needs.

• Determines priorities for these needs.

• Works with organizations that develop standards, industry, and other stakeholders to find or develop the necessary standards.

Where current standard specifications are unavailable or inadequate, CDER plans to engage appropriate Standards Development Organizations (SDOs), as well as industry and other stakeholders, to develop new standards through SDO processes.

7. FDA Security and Privacy Requirements

7.1 Information Security and/or Physical Access Security Requirements

Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information

Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a) Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure,…