Attachment 1_SOW_NIAID eCTD_RFQ2076690.pdf

NIAID eCTD Statement of Work

National Institutes of Health (NIH) National Institute of Allergy and Infectious Diseases (NIAID)

Electronic Common Technical Document (eCTD) Publishing and Reviewing Software for National Institute of Allergy and

Infectious Disease (NIAID)

Statement of Work v1.0 June 17, 2021

TABLE OF CONTENTS

1 INTRODUCTION AND OBJECTIVES

2 BACKGROUND

2.1 MISSION

2.2 CURRENT STATE

3 SCOPE

4 SOFTWARE REQUIREMENTS

4.1 COMMON REQUIREMENTS

4.2 ECTD SPECIFIC REQUIREMENTS

5 TECHNICAL SERVICES REQUIREMENTS

5.1 INITIAL TASKS

5.2 ONGOING TASKS

5.3 OPTIONAL TASKS

5.4 KEY PERSONNEL

6 PLACE OF PERFORMANCE

7 DELIVERABLES/DELIVERY SCHEDULE

1 INTRODUCTION AND OBJECTIVES

This Statement of Work (SOW) is for Software and Services to support the implementation of an Electronic Common Technical Document (eCTD) and Electronic Document Management System (EDMS) software system for the National Institutes of Health (NIH), National Institute of Allergy and Infectious Diseases (NIAID) to ensure compliance with current clinical research regulations and requirements.

The purpose of this initiative is to:

• Meet the US Food and Drug Administration (FDA) mandate on eCTD submission of Commercial Investigational New Drug (IND) applications

• Accommodate the need of NIAID’s Divisions and Clinical Research Organizations (CROs) to publish submissions to the FDA and other regulatory agencies by acquiring:

• A Commercial-off-the-shelf (COTS) eCTD compilation, publishing, validation, and review system that can scale to support multiple divisions within NIAID with appropriate security and access controls to prevent access to submissions and information between divisions

• A COTS EDMS system that integrates with the eCTD system, can scale to support multiple divisions within NIAID, and employs appropriate security and access controls to prevent access to documents and information between divisions

• Technical services to configure, deploy, train and support NIAID’s use and adoption of the new eCTD and EDMS systems

• A Computer Systems Validation (CSV) package that provides documented evidence of compliance with regulatory requirements including 21 CFR part 11 and GAMP 5 (or similar risk-based framework)

• Technical support services to support the migration of existing eCTD submissions and their full lifecycles from the existing eCTD publishing system

• Ongoing system support including maintaining compliance with changing regulatory requirements, software upgrades, computer systems validation, and mitigation of security

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities not otherwise provided by the Government, as needed to perform this Statement of Work.

2 BACKGROUND

To prepare for a US FDA mandate on eCTD submission of Commercial Investigational New Drug (IND) applications, NIAID constructed and deployed a validated COTS eCTD system and validated EDMS system which became operational in September 2016, with the first submission to FDA transmitted on May 12, 2017. The system is in-use today by NIAID divisions and external partners (i.e., CROs) that support them. NIAID currently produces approximately 500 sequences per year and expects that number to continue growing.

NIAID is seeking to increase efficiencies related to hosting models (e.g., cloud), system access methods, multiple users performing concurrent compilation and publishing, system software upgrades, and computer systems validation by engaging software publishers providing COTS eCTD and EDMS tools and the related referenced services.

2.1 MISSION

NIAID conducts and supports basic and applied research to better understand, treat, and ultimately prevent infectious, immunologic, and allergic diseases. For more than 60 years, NIAID’s research has led to new therapies, vaccines, diagnostic tests, and other technologies that have improved the health of millions of people in the United States and around the world. The scope of the NIAID research portfolio has expanded considerably in recent years in response to new challenges such as bioterrorism, emerging and re-emerging infectious diseases, and the increase in asthma prevalence among children in the United States. The growth of NIAID programs has also been driven by unprecedented scientific opportunities in the core NIAID scientific disciplines of microbiology, immunology, and infectious diseases. Decades of NIAID-funded research has helped further the understanding, diagnosis, and treatment of many of the world's most intractable and widespread conditions in the areas of allergy, immunology, and infectious diseases. NIAID conducts or supports research in numerous countries worldwide, requiring interaction with multiple regulatory frameworks.

2.2 CURRENT STATE

The current system is used for the storage of final documents for submissions in the EDMS, compilation and publishing of eCTD INDs and Drug Master Files (DMFs), eCTD validation of submissions, archive of transmitted submissions packages in the EDMS, and the review of eCTD applications. The current EDMS in use for the eCTD is OpenText Content Server 10.5.

3 SCOPE

The scope of this procurement is to acquire, configure, deploy, validate, and support an eCTD System for use by NIAID and its partners in accordance with regulated clinical research requirements as set forth by applicable health authorities.

4 SOFTWARE REQUIREMENTS

4.1 COMMON REQUIREMENTS

The requirements specified in this section must be satisfied by the eCTD software. The Contractor shall provide a configurable COTS System. A custom developed system or systems requiring significant customization will not be considered.

4.1.1 Licenses

The Contractor shall provide:

1. Licenses must be provided for an enterprise solution capable of supporting all NIAID divisions within the Institute as well as external NIAID partners, CROs, and other collaborators.

2. A System with no dependencies, restrictions, or limitations on the number of submissions managed by the System.

3. Licenses for 55 eCTD Publisher user accounts and up to 50 eCTD Reviewer user accounts.

4. Licenses must not be required for:

a. NIAID System Administrators and helpdesk support staff

b. Non-Production environments

5. Licenses and support periods of performance will become effective and payment will be due upon NIAID’s acceptance of the System Release Memo.

4.1.2 General

The Contractor shall provide a System that must:

1. Be offered as Software-as-a-Service and/or cloud-hosted solutions. Systems designed to be installed on premise at NIAID’s computing facility will not be considered.

2. Be an enterprise solution capable of supporting all Divisions within the Institute as well as external NIAID partners, CROs, and other collaborators.

3. Be accessible from within and external to the NIAID network by employees and partners for a variety of tasks and user types.

4. Support integration with NIAID specified Security Assertion Markup Language (SAML)-based identity providers to permit single-sign-on for NIAID staff. The System must also support native authentication for users without records in a SAML identity management provider.

5. Support role-based access and permission management.

6. Support role-based access to all functions and workflows.

7. Include security features to restrict and report unauthorized access attempts.

8. Maintain audit logs of all system activity and document changes.

9. Support configurable metadata and naming conventions.

10. Fully support current and new versions of Windows and Macintosh operating systems.

11. Fully support current and new versions of Google Chrome on Windows and Macintosh, and Apple Safari, Microsoft Edge, and Microsoft Internet Explorer on their respective operating systems.

12. Be Section 508 compliant, in a way that is efficient to develop, implement, test, and use by all members of the NIAID user community.

13. Be Federal Information Security Management Act (FISMA) Moderate compliant. FISMA certification will be required prior to placing the system in production use. Federal Risk and Authorization Management Program (FedRAMP) certification is highly desirable but is not necessary.

14. Include fully functional test environment that is configured identically to the production environment.

4.1.3 Document Management System

The Contractor must provide a System which utilizes a common document management platform that supports:

1. Preparation and life cycle maintenance of electronic regulatory submissions from NIAID.

2. Automatic versioning.

3. Generation of certified copies.

4. Full text search with stemming, wildcarding, and Boolean options.

5. Document searches based on keyword, NIAID defined metadata, user roles, document status, process, and workflow activity.

6. Various file formats (Word, SAS, Excel, JPEG, PDF, etc.).

7. Automatic maintenance of relationships between different renditions of the same document (e.g. MS Word and PDF).

4.1.4 Administration

The Contractor shall provide a System which must be configurable such that NIAID administrators can:

1. Onboard additional Divisions without the need to execute new agreements, purchase orders, or otherwise engage the Contractor except that additional licenses may be required.

2. Create, manage, and modify workflows.

3. Create, manage, and modify metadata and naming conventions.

4. Create, manage, and modify user roles and access permissions.

5. Generate and export detailed audit and usage reports.

4.1.5 Computer Systems Validation (CSV) Support

The Contractor shall provide a System which must be delivered with a Computer Systems Validation (CSV) package that provides documented evidence of compliance with regulatory requirements including 21 CFR part 11, ICH E6 (R2), and GAMP 5 (or similar risk-based framework). CSV packages must be provided for the initial deployment and for any subsequent upgrades. At a minimum, the CSV package must include:

1. Documentation of System features supporting 21 CFR part 11, particularly electronic signatures.

2. Installation Qualification (IQ) and Operational Qualification (OQ) artifacts such as IQ Plan, OQ Plan, executed test scripts, and summary reports.

3. Exemplar Performance Qualification (PQ) Plan and PQ test scripts that NIAID can adapt to meet its specific requirements.

4. Any Standard Operating Procedures (SOPS) referenced by the qualification plans.

4.1.6 Other Inspections

The Contractor provided System will be subject to government initiated Federal Information Security Management Act (FISMA) audits and Independent Verification and Validation (IV&V). The reports and findings of any similar inspections done on behalf of the Contractor must be provided to NIAID.

4.2 ECTD SPECIFIC REQUIREMENTS

The Contractor must provide eCTD software that accommodates the requirements listed below:

1. The system shall allow the compilation, publishing, validation, and review of US INDs and Drug Master Files.

2. The system shall allow the compilation, publishing, validation, and review of Canadian and European eCTDs.

3. The system shall support multi-user concurrent compilation and publishing.

a) The system shall support concurrent compilation within the same application.

b) The system shall support concurrent compilation and publishing of different applications.

c) The system shall support up to 30 concurrent user sessions for compilation and publishing.

4. The system shall contain reusable submission structure templates that can be used to create a submission instance.

5. The system shall provide the ability to render documents to PDF.

6. The system shall have the ability to assign individual user permissions, group user permissions, and to customize user groups to prevent access to information between NIAID divisions in the EDMS or eCTD system.

7. The system shall provide the capability to validate submissions against regulatory authority eCTD validation criteria and produce a validation report.

8. The system shall provide the capability to store final versions of documents for submissions in the EDMS.

9. The EDMS system shall integrate with the eCTD compilation and publishing tool to assign documents to submissions from the EDMS.

10. The system shall provide the capability to archive finalized eCTD sequences in the

EDMS.

11. The system shall provide the capability to review eCTD applications.

12. The system shall comply with FDA regulatory requirements as codified in the Code of Federal Regulations at 21 C.F.R. Part 11.

13. The system shall comply with all relevant Federal Information Processing Standards

(FIPS).

14. The system may operate in a FedRAMP Infrastructure as a Service (IaaS) environment.

5 TECHNICAL SERVICES REQUIREMENTS

The second objective of this procurement is to obtain services to ensure the successful configuration, integration, validation, adoption, and operation of the System.

The Contractor must provide these tasks through the professional services arm of the Contractor’s company, a third-party systems integrator, or both.

Technical services deliverables are grouped into two broad categories:

Initial Tasks – These include all the activities needed to configure and deploy the System.

Ongoing Tasks – These include all the activities needed to support a fully operational System.

5.1 INITIAL TASKS

The Contractor shall work on the following tasks upon contract award. The primary objectives of these tasks are to:

1. Train key NIAID project team members and initial users in the capabilities and use of the System.

2. Determine and document NIAID requirements (e.g. permissions model, business processes, naming conventions, etc.).

3. Migrate existing eCTD submissions from the legacy system while maintaining the lifecycle of the submissions.

4. Finalize and deploy the production System.

5.1.1 Project Planning Teleconference

Within one week of contract award, the Contractor must participate in a conference call prior to the kickoff meeting to exchange sufficient information to develop an agenda, organize, and prepare questions and discussion topics for the project kickoff meeting, project planning, project team training, System Setup Workshop, and technical planning sessions.

5.1.2 Project Kickoff Meeting

Within two weeks of contract award key Contractor personnel must participate in an onsite project kickoff meeting with key NIAID project team members. The objectives of the meeting are to confirm project objectives, scope, schedule, roles, and responsibilities and to review a preliminary project plan.

5.1.3 Project Team Training

The Contractor must provide training to the NIAID project team members so they have the knowledge needed to participate in and make decisions during the implementation. NIAID intends to manage and deliver training to new users after the System is in production use using documentation and materials provided by the Contractor.

1. Within two weeks of contract award, unless otherwise mutually agreed upon, the Contractor must provide train-the-trainer training for up to 10 NIAID staff on the configuration and use of the System. The purpose of the training is to give the NIAID team sufficient understanding and experience of the System so they can participate in other project activities.

2. Within two weeks of contract award, unless otherwise mutually agreed upon, the Contractor must provide System Administrator training for up to 10 NIAID staff on the technical aspects of the System’s configuration, maintenance, and operation. The purpose of the training is to give NIAID System Administrators sufficient understanding and experience with the System so they can participate in other project activities and provide support and guidance to NIAID’s user community.

3. The Contractor must provide electronic copies of training materials for all System roles.

4. NIAID staff may adapt and incorporate Contractor training materials into NIAID training materials for use by any and all licensed users of the System.

5. The Contractor may offer computer-based-training (CBT) options provided it is available to all licensed users and is updated coincident with updates to the System.

5.1.4 System Setup Workshop

Following project team training, the Contractor must lead one interactive System Setup Workshop (SSW) with approximately 20 NIAID team members. The Contractor shall:

1. Ensure that NIAID stakeholders have a full understanding of the System’s capabilities and how they relate to NIAID’s needs.

2. Identify and document the specific options, configuration, and functionality that will be made available to NIAID users. This includes but is not limited the following:

a. User groups, system roles, and logical partitions for Divisions.

b. Process mapping and workflows.

c. Metadata and naming conventions.

d. eCTD reference models.

e. Document templates.

f. System notifications (emails) and alerts.

g. Reports, dashboards, and Key Performance Indicators (KPIs).

5.1.5 Final Project Plan

Using information collected during the kickoff meeting and SSW, the Contractor must create and deliver the Project Plan with two weeks after the kickoff meeting. The project plan must identify schedules, deliverables, and responsible parties for all project tasks and activities.

5.1.6 Technical Planning Sessions

Within two weeks of contract award and on an as-needed basis, the Contractor must participate in technical planning sessions with NIAID staff. The primary objectives of these meetings will be to ensure that NIAID technical and information security has sufficient information needed to ensure that the technical and operational aspects of the System satisfy requirements. Areas of particular interest are user access management, SAML configuration, backups, restores, disaster recovery, performance monitoring, vulnerability scans, and mitigations.

5.1.7 Quality Assurance

The Contractor must provide and review with NIAID staff all relevant IQ and OQ Plans, test scripts, and summary reports.

The Contractor must provide an exemplar PQ Plan and PQ Test Scripts and assist NIAID staff in revising and tailoring the PQ Plan and PQ Test Scripts to satisfy NIAID requirements.

5.1.8 Initial Production Deployment

The Contractor must configure the eCTD software and provide guidance and assistance needed to deploy and make available a non-Production environment for NIAID to conduct PQ. Upon successful completion of PQ, the Contractor must deploy the Production environment and issue the System Release Memo.

The Contractor must provide technical support to complete the Certification and Accreditation (C&A) of the System, as well as ongoing support to obtain the System’s Authorization to Operate (ATO). This will include:

1. Completing FISMA requirements and documentation conforming to National Institute of Standards and Technology (NIST) guidelines such as, but limited to, security controls (NIST SP 800-53), configuration management, business continuity, and incident response.

2. Identification of monitoring, vulnerability scanning and assessment tools.

3. Documentation describing risk identification, management, and mitigation procedures and policies.

5.2 ONGOING TASKS

The following tasks and deliverables primarily apply to the operation and support of the production use of the System throughout the period of performance.

5.2.1 Administrative

The Contractor’s Project Manager (PM) must participate in regular teleconference status meetings (no less frequently than once a month) to review System activity, utilization, billings, issues, and future plans. Onsite meetings will be scheduled on an ad hoc basis as needed.

5.2.2 Training & Documentation

The Contractor must provide updated end-user training and documentation whenever there are new or significant changes to System functionality.

5.2.3 Operations

The Contractor must be responsible for all backups, restores, disaster planning and recovery, patching, and server monitoring and provisioning.

The Contractor’s SOPs, procedures, and other relevant documentation for these activities must be provided during the initiation phase of the project and whenever significantly changed. Regular reports and logs demonstrating compliance with these requirements must be provided no less than monthly.

The Contractor must provide technical support to maintain the C&A of the System, as well as ongoing support to maintain the System’s ATO. Tasks will include:

1. Updating security controls (NIST SP 800-53) as necessary.

2. Conducting periodic System security scans and submitting the results to NIAID.

3. Proactive monitoring, identification, and mitigation of security vulnerabilities – including any vulnerabilities reported by NIAID.

4. Notify the Government of System breaches, compromises, or data losses within 4 hours of detection.

5. Remedial action must be taken to address security vulnerabilities within the following timeframes:

a. Critical – 2 days

b. Severe – 4 days

c. Serious – 7 days

5.2.4 Inspection Support

The Contractor must provide timely and qualified assistance in support of an assessment or audit by a regulatory agency or a NIAID partner or contractor. This includes responding to corrective actions and recommendations.

5.2.5 Support, Service Level Agreement (SLA) and Communication

1. The Contractor must provide service level agreement that provides a definition for grading the severity of issues and timing expectation for the Contractor’s response based on the severity level of the issue. NIAID expects the following issue response times:

Issue Level

Impact Examples Maximum Response Time to Confirm Issue with

NIH

Maximum Time to Resolve the Issue

Critical The issue is a major application problem making it impossible to use the System.

Service is not available;

application does not save critical data correctly

4 business hours 1 business day

High The issue impacts a large number of users and no work around exists.

Slow application response time, session timeouts, some application functionality is broken

1 business day 2 business days

Issue Level

Impact Examples Maximum Response Time to Confirm Issue with

NIH

Maximum Time to Resolve the Issue

Medium The issue impacts a small number of users of a particular user role, or large number of broad users.

However, a workaround does exist.

Users running a supported browser are impacted but can use an alternate browser.

Minor function is broken, but workflow can still proceed.

2 business days 4 business days

Low The issue does not impact the users.

A new feature request, or the issue is minor and does not impact workflow.

5 business days N/A

2. The Contractor must provide first level support via email and a 24/5 toll-free helpdesk for routine end-user issues such as:

a. The authorization, addition, removal, and modification of user access using criteria and within a timeframe specified by NIAID.

b. Access problems.

c. System functionality and usage.

d. Enhancement requests.

3. The Contractor must notify users and NIAID administrators at least 24 hours in advance of any planned outage and its expected duration.

4. Within one hour of the occurrence of an unplanned outage, the Contractor must notify users and NIAID administrators of the issue and an anticipated resolution time. Thereafter, updates must be provided no less frequently than every four hours until the issue is resolved.

5. The Contractor must provide NIAID administrators with direct access to qualified technical experts via email and a 24/5 toll-free helpdesk.

6. On an as-needed basis the Contractor must make qualified technical staff available on status calls to review and discuss identified issues.

7. The Contractor must provide monthly operational reports summarizing updates, usage, outages, issues, and response times.

8. The Contractor must provide contact information for the corporate executives responsible for all technical services and operations. These executives will be contacted to escalate critical issues in the event normal processes are not working.

5.2.6 Updates

The Contractor shall provide:

1. System and software updates and patches required to address regulatory changes must be implemented at least one month in advance of the regulatory effective date.

2. Updated training material and user documentation must be delivered at least one month in advance of any implemented change.

3. An updated CSV package must be delivered at least one month in advance of any implemented change.

4. Provide Installation Qualification and Operational Qualification (IQ/OQ) testing and supporting documentation for all System upgrades.

5.2.7 Transition or Termination

No later than 45 days prior to end of the contract period of performance (POP) or within 5 days notification that NIAID intends to terminate the contract, the Contractor must prepare and deliver a detailed transition plan. During the transition period, the incumbent Contractor must provide all resources required to ensure a smooth transition to the successor Contractor. This includes a validated transfer of all documents and data. NIAID requires the maintenance of all customer support during this period. All performance requirements of the contract will remain in effect until contract term as defined expires.

At no time and under no circumstances will the Contractor withhold or render inaccessible any NIAID documents or data.

5.3 OPTIONAL TASKS

The following optional tasks may be exercised at NIAID’s discretion during the period of performance in accordance with FAR 52.217-7 Option for Increased Quantity – Separately Priced Line Item.

5.3.1 Data Migration (Optional)

Upon exercise of this option, the Contractor must provide a sub-task to support the migration of existing eCTD submissions and their full lifecycles from the existing eCTD publishing system. This includes but is not limited to all quality assurance and control processes needed to ensure that all migrated documents and data maintain compliance with regulatory requirements. The existing eCTD data required to be migrated is approximately 120 GB in size. The current EDMS is OpenText Content Server 10.5 EDMS.

5.4 KEY PERSONNEL

The Contractor must assign a technical single point of contact, also known as the PM, to be the Contractor’s authorized point of contact with the Government’s Contracting Officer (CO) and Contracting Officer’s Representative (COR). The Contractor PM must ultimately be responsible for ensuring that the Contractor’s performance meets all Government contracting requirements within price and schedule. The PM must be responsible for formulating and enforcing work standards, assigning schedules, reviewing work discrepancies, and communicating policies, purposes, and goals of the organization to subordinates. In support of open communication, the Contractor PM must initiate regular meetings with the COR.

Skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” and are those persons whose resumes were submitted and marked by the Contractor as “Key Personnel”. Key personnel must be identified by name and title/job classification. The must be identified as key personnel.

The key personnel specified in this contract are essential to work performance. At least 30 days prior to the Contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor must notify the Contracting Officer and must submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. If the employee of the Contractor is terminated for cause or separates from the Contractor voluntarily with less than thirty days’ notice, the Contractor must provide the maximum notice practicable under the circumstances. The Contractor must not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

Substitutions of key personnel must only be accepted if in compliance with the provision identified below. Key personnel must be designated at time of award and must not be removed from the contract effort or replaced without a compelling reason. The Government will not approve substitutions for the sole convenience of the Contractor.

All requests for approval of changes hereunder must be in writing, via email, and provide a detailed explanation of the circumstances necessitating the proposed change. Request for changes should be made when the need is identified. In addition to the resume, the request must also include:

1. A comparison of skills and qualifications of the proposed personnel substitution with those of the incumbent.

2. Number of hours the Contractor will provide at his/her own expense to train the proposed replacement.

3. Any other information requested by the Contracting Officer to reach a decision.

6 PLACE OF PERFORMANCE

Any onsite activities requested in this SOW must be performed at:

5601 Fishers Lane, Rockville, MD 20851.

7 DELIVERABLES/DELIVERY SCHEDULE

Key deliverables to NIAID are summarized in the following table.

Deliverable Description Due By

5.1.1 Project Planning

Teleconference

Initial planning session between the Contractor and NIAID stakeholders.

1 week after award

5.1.2 Kick Off Meeting Confirm project objectives, scope, schedule, roles, and responsibilities and to review a preliminary project plan.

2 weeks after award

5.1.3 Project Team Training Training for NIAID staff on the configuration and use of the System.

2 weeks after award, unless otherwise mutually agreed upon

5.1.3 Training Materials, User and Administrator Documentation

Electronic copies of all relevant materials and documentation.

2 weeks after award, unless otherwise mutually agreed upon

5.1.4 System Setup

Workshop

Ensure that NIAID stakeholders have a full understanding of the System’s capabilities and how they relate to NIAID’s needs.

Identify and document the specific options, configuration, and functionality that will be made available to NIAID users.

3 weeks after award, unless otherwise mutually agreed upon

5.1.5 Final Project Plan The Contractor must provide a written plan which details the Contractor’s processes and plan for meeting the execution (go-live) timeline established below. The government will have five (5) business days to review and approve the plan.

1 week after SSW

5.1.6 Technical Planning

Sessions

Detailed technical discussions between Contractor staff and NIAID administrators.

As-needed.

5.1.7 Quality

Documentation and Consultation

IQ Plans, OQ Plans, executed IQ Test Script, executed OQ Test Scripts, IQ Summary Report, OQ Summary Report, exemplar PQ Plan and PQ Test Scripts.

Review with NIAID staff as required.

TBD

Deliverable Description Due By

5.1.8 System Release

Memo

Certification that the system operates as expected according to the requirements and design specifications and performs reproducibly and consistently throughout all specified operating ranges.

TBD

5.1.8 Authorization to

Operation (ATO)

Culmination of the FISMA required security authorization process required to operate an information technology system in the US federal government. Based on a risk-based assessment documented in a security plan.

Coincident with the System Release Memo

4.1.1 Software Licenses Initial set of licenses Initial Production Deployment

5.2.5 Support contact

information

Helpdesk telephone number and email addresses.

Technical contact telephone number and email addresses.

1 week prior to initial production deployment.

5.2.7 Transition Plan Deliver transition Plan 45 days prior to contract end or within 5 days upon notification

5.2.7 Final Handoff Deliver all software, documentation, datafiles, database and reports to the Government or to new Contractor.

Last day of the contract.