Attachment 1-SOW_Updated.pdf

STATEMENT OF WORK

for

Grammarly Business Enterprise

I. INTRODUCTION

The Indian Health Service (IHS) is responsible for providing federal health services to American Indians and Alaska Natives. The provision of health services to members of federally recognized tribes grew out of the special government-to-government relationship between the federal government and Indian tribes. This relationship, established in 1787, is based on Article I, Section 8 of the Constitution, and has been given form and substance by numerous treaties, laws, Supreme Court decisions, and Executive Orders. The IHS is the principal federal health care provider and health advocate for Indian people, and its goal is to raise their health status to the highest possible level. The IHS provides a comprehensive health service.

II. SCOPE & PURPOSE

The Indian Health Service (IHS) Division of Program Management and Budget wishes to purchase Grammarly Business Enterprise for approximately 600 IHS employees. Grammarly Business Enterprise will provide improvements to articulate in a clear, high-quality, and efficient manner. This tool's features allow paragraph rewrites and proofreading to alleviate grammatical errors, typos, and incorrect punctuation. An integrated workflow allows us to connect all applications and websites on desktops and laptops to assist with narration, improve team communication and collaboration with custom styles, support knowledge sharing, and define team acronyms. Software also provides security protection for data and information when using the tool.

III. TASK OBJECTIVE STATEMENT

The Indian Health Service (IHS) seeks to procure an online Grammarly Business Enterprise to enhance the professional writing capabilities of approximately 600 IHS employees. The primary objective of this software is to enable users to produce clear, concise, accurate, and high-quality written communications. Specifically, the software must include advanced functionalities such as paragraph rewriting to improve readability and coherence; comprehensive proofreading to identify and correct grammatical errors, typographical mistakes, and punctuation inaccuracies; and seamless integration across multiple desktop and laptop applications and websites utilized by IHS employees.

Additionally, the software must support enhanced team collaboration and communication by enabling customization of writing styles, facilitating consistent organizational language, and allowing for knowledge sharing, including the ability to define and manage team-specific acronyms and terminology. Given the sensitive nature of the information managed by the IHS, the software solution must provide robust security features designed to protect user data and maintain confidentiality during use.

IV. REQUIREMENTS

Requirement Description: Brand Name Specific: Grammarly: GRMLYENT-600 Grammarly Business Enterprise. The Potential Contractor is required to be an authorized reseller of the proposed brand name, specifically GRMLYENT-600 Grammarly Business Enterprise.

The proposed software tool shall provide comprehensive online English language writing assistance, inclusive of but not limited to:

• Real-time grammar checking and proofreading to identify grammatical errors, spelling mistakes, punctuation inaccuracies, and stylistic inconsistencies.

• Functionality to rewrite paragraphs or sentences to enhance readability, clarity, and overall quality of written communication.

• Seamless integration capability with various desktop and laptop-based applications (e.g., Microsoft Office Suite, web browsers, email clients) utilized by IHS employees.

• Customized style guide functionality that enables defining, sharing, and enforcing writing styles, standards, and team-specific terminology, including acronyms unique to IHS.

• Advanced collaboration features to facilitate efficient team communication and consistency in documentation across teams.

• Robust data security and privacy protections compliant with federal standards to secure sensitive IHS information at rest and in transit.

• Security features:

o Cloud Security Authorization: The solution may be hosted on-premises or provided as

Software as a Service (SaaS). For a SaaS solution, FedRAMP Moderate authorization is the Government's preferred cloud-security posture. If the proposed SaaS solution does not possess a current FedRAMP Moderate authorization, the absence of such authorization shall be disclosed to IHS, and the solution shall be subject to IHS security review, Assessment and Authorization (A&A), and Authority to Operate (ATO) requirements before Government authorization for operational use.

The Contractor shall provide security documentation and evidence sufficient for IHS to evaluate the proposed service against applicable federal and HHS/IHS security requirements, including applicable NIST SP 800-53 controls and other documentation required by the Government's authorization process.

Submission of such documentation, or implementation of controls comparable to a FedRAMP Moderate baseline, does not constitute FedRAMP authorization and does not guarantee that IHS will issue an ATO or otherwise accept the security risk associated with the proposed service.

o SCIM and SAML 2.0: Support automated user provisioning and deprovisioning through SCIM and authentication through SAML 2.0 Single Sign-On (SSO), including Active Directory (or equivalent identity provider) group-based role assignment.

o Managed Mode: Ensure users sign in only from their organizations’ email addresses.

o User Groups: Create separate groups within one subscription to easily customize features and manage users.

o Custom Roles: Manage admin permissions based on the level of access needed with flexibility o Client Control: Provide administrative capability to enable or disable Grammarly functionality by application and/or web domain to prevent use within designated systems, including electronic health record (EHR) applications or other sensitive environments.

o Confidential Mode: Prevent processing content labeled with “Confidential.”

o Data Loss Prevention: The solution shall provide configurable Data Loss Prevention capabilities to detect and prevent the transmission of sensitive information, including but not limited to Social Security Numbers (SSNs), payment card information, email addresses, URLs, and other administrator-defined sensitive data types.

o Artificial Intelligence Architecture, Data Processing, and Administrative Controls: The solution shall provide administrative controls to enable or disable AI-assisted functionality at the organizational and user-group level. The Contractor shall disclose and document the artificial intelligence architecture used to provide the service, including the use of Contractor-owned models and third-party foundation models, the functions performed by each, the locations in which Government prompts, outputs, contextual information, connector results, and agent state are processed, and all subprocessors that may receive or process Government information.

The Contractor shall identify all third-party AI service providers used to process IHS-generated content. At the time of proposal, the solution utilizes Contractor-owned/fine-tuned models for functions including AI detection, rewriting, and grammar/writing correction, and utilizes third-party foundation model services, including OpenAI, Anthropic, and Azure OpenAI, for generative functions such as chat, drafting, and summarization. The Contractor shall notify IHS of material changes to the AI model providers, subprocessors, or processing architecture in accordance with the contract's subprocessor and change-notification requirements.

Government prompts, screen context, connector results, agent state, and related content shall be processed within U.S.-based infrastructure except where expressly authorized by IHS. When a third-party foundation model is invoked, only the minimum information necessary to perform the requested function shall be transmitted using encrypted communications. The Contractor shall apply available data-minimization and PII-reduction controls prior to transmission to third-party AI providers.

Third-party foundation model providers receiving IHS content shall be contractually prohibited from using Government prompts, outputs, or other Government content to train or improve their foundation models and shall process such information under zero-data-retention or equivalent contractual requirements that prevent retention following completion of processing.

For the IHS Enterprise environment, controls permitting the use of organization content for Contractor model training, fine-tuning, reinforcement learning, evaluation, cross-customer product improvement, or similar purposes shall remain disabled unless expressly authorized in writing by IHS. The Contractor shall disclose any use of Government information, including content, outputs, metadata, aggregated or de-identified information, for model training, fine-tuning, reinforcement learning, evaluation, product improvement, analytics, telemetry, or similar purposes. Non-content aggregated or de-identified telemetry used for operational analytics shall be documented, including the categories of information collected and their purposes.

Where retrieval, connector, search, embedding, or indexing functionality is provided, the Contractor shall identify whether the functionality operates through live/pass-through processing or through persistent ingestion. Any feature that ingests, indexes, vectorizes, embeds, or otherwise persistently stores Government content shall be identified to IHS prior to enablement. The Contractor shall document the storage location, purpose, retention period, access controls, and deletion procedures applicable to such content and derived embeddings or indexes. Ingested Government content and associated embeddings or indexes shall not be used to train third-party foundation models and shall be deleted when the applicable connector or functionality is removed, or earlier when required by the Government.

The Contractor shall maintain and make available to IHS a current list of subprocessors involved in infrastructure, storage, AI processing, analytics/telemetry, retrieval, vector indexing/search, or other processing of Government information. The solution shall support configuration of AI-assisted features and associated administrative controls without requiring changes to the underlying Government deployment architecture.

o Generative AI/ML Feature Governance and Change Control: The Contractor shall provide administrative controls sufficient for IHS to govern the availability and use of customer-facing generative artificial intelligence and machine-learning capabilities within the IHS enterprise environment. Such controls shall, as supported by the solution, permit authorized IHS administrators to enable or disable generative AI functionality at the organization level; control the availability of individual AI agents and connectors for specified users or groups; require administrator approval before users may install or enable new agents or connectors; disable web search and agent-sharing functionality; and restrict the creation of custom agents.

Customer-facing generative AI functionality, agents, connectors, or other optional AI capabilities that are not approved for IHS use shall remain disabled or otherwise unavailable to IHS users where technically supported. The Contractor shall not activate, enable, or make available within the IHS enterprise environment any new or materially changed customer-facing generative AI functionality, AI agent, connector, or associated AI capability that materially changes the processing, use, disclosure, storage, security of Government information without prior Government approval.

The Contractor shall provide IHS advance notice of new or materially changed customer-facing AI functionality when the change materially affects data use, security commitments, subprocessors, processing activities, or user rights. The Contractor shall provide sufficient technical and security information for IHS to assess the proposed functionality before Government approval, including any changes to data flows, model providers, subprocessors, retention, training or product-improvement practices, retrieval or indexing, external connectivity, and applicable administrative controls.

New or replacement AI subprocessors that may process Government information shall be subject to the notification, review, and approval requirements established elsewhere in this SOW and applicable contract documentation. Contractor internal AI risk assessment or certification processes, including assessments performed under an ISO/IEC 42001-certified AI management system, may be provided as supporting evidence but shall not replace any IHS-required security, privacy, A&A, or authorization review.

The Government acknowledges that foundational, non-generative machine-learning capabilities integral to core writing functionality, including grammar and writing suggestions, may not be separately configurable or disabled from the underlying service. The Contractor shall identify such integral capabilities and disclose any material change to their data processing, model architecture, security characteristics, or use of Government information that could affect the Government's security or privacy risk determination.

o AI Hosting, Model Provider, Subprocessor, and Architecture Disclosure: The Contractor shall document the hosting and processing architecture supporting AI functionality provided to IHS, including the applicable hosting provider, geographic processing locations, third-party foundation model provider families, subprocessors that process Government information, and the security protections applicable to such processing.

At the time of proposal, the solution utilizes U.S.-based Amazon Web Services

(AWS) infrastructure within a Contractor-managed virtual private cloud (VPC) for customer data hosting and utilizes third-party foundation model services from OpenAI, Microsoft Azure OpenAI, and Anthropic for applicable generative AI functionality. Government information shall be encrypted in transit and at rest in accordance with the security requirements of this SOW and shall be logically segregated from other customers' information.

Third-party AI providers processing Government information shall process such information within U.S.-based facilities unless otherwise expressly authorized by IHS. Such providers shall be subject to contractual requirements prohibiting use of Government content for model training and requiring zero data retention or equivalent controls preventing retention following completion of processing.

The Contractor shall maintain a current authoritative list of subprocessors that may receive, maintain, transmit, or otherwise process Government information and shall provide IHS advance notice of new or replacement subprocessors in accordance with the applicable Data Processing Addendum and the subprocessor requirements of this SOW. The Contractor shall provide sufficient information concerning a proposed subprocessor change to permit IHS to conduct applicable security, privacy, and authorization review.

The Contractor shall disclose the foundation-model provider families used to provide AI functionality to IHS. The Government acknowledges that individual model selection may be dynamically routed or experiment-gated within the Contractor's AI platform and therefore may not correspond to a fixed model-to-feature mapping. The Contractor is not required to provide advance notice of routine model revisions, model routing changes, or internal architectural improvements that do not materially affect the Government's security or privacy risk posture.

The Contractor shall notify IHS of material changes to the AI processing architecture when such changes materially affect the processing location of Government information; introduce a new category of external AI provider or subprocessor processing Government information; materially change data retention or use; materially change whether Government information is used for training, fine-tuning, evaluation, product improvement, retrieval, embeddings, or indexing; materially alter security or privacy controls relied upon by IHS; or otherwise affect an IHS security, privacy, A&A, or authorization determination. Upon request, the Contractor shall provide sufficient technical documentation concerning such material changes to support Government assessment and continued authorization of the service.

o AI Change Management and Notification: The Contractor shall maintain change-management processes sufficient to inform IHS of material changes to the artificial intelligence services, subprocessors, data practices, retention practices, or customer-facing generative AI capabilities applicable to the IHS enterprise environment.

The Contractor shall provide advance written notice of any new or replacement subprocessor that will process Government information, including changes to third-party AI model providers or AI infrastructure providers, in accordance with the applicable Data Processing Addendum and the requirements of this SOW. The Contractor shall maintain a current subprocessor list and make available a mechanism through which designated IHS personnel may receive notifications of applicable subprocessor changes.

The Contractor shall provide advance notice of material changes to contractual data-use practices, privacy practices, or retention policies applicable to Government information. Where the Contractor's standard contractual notification period provides at least 30 days' advance notice of such material changes, that notice mechanism may be used to satisfy this requirement.

Routine internal changes that do not materially alter the collection, processing, disclosure, storage, retention, deletion, or authorized use of Government information do not require separate Government notification.

The Contractor shall notify IHS of material changes to AI models or AI architecture when such changes materially affect Government data processing, introduce a new external AI provider or processing location, change applicable retention or data-use practices, materially alter security or privacy controls relied upon by IHS, or otherwise affect an IHS security, privacy, A&A, or authorization determination. Routine model updates, model-routing changes, experiments, or internal AI architecture improvements that do not materially affect the Government's security or privacy risk posture do not require separate advance notification.

Newly introduced customer-facing generative AI capabilities that require Government approval under this SOW shall not be activated or enabled within the IHS enterprise environment until such approval has been provided. The Contractor shall provide sufficient information concerning the proposed capability to permit applicable IHS security, privacy, and authorization review prior to enablement.

The Contractor shall disclose when AI-assisted functionality transmits Government prompts, text, contextual information, metadata, outputs, or other Government information outside the Contractor-hosted service boundary to a third-party AI model provider or cloud service. At the time of proposal, applicable generative AI functionality transmits prompts, on-screen context, and related information from the Contractor's U.S.-based AWS environment to third-party LLM providers, including OpenAI, Microsoft Azure OpenAI, and Anthropic, acting as subprocessors for transient processing. Such providers shall remain subject to contractual zero-retention and no-training requirements applicable to Government content.

Durable storage of Government content authorized for retention under this SOW, including applicable chat history, authorized connector content, indexes, and embeddings, shall remain within Contractor-operated infrastructure hosted in the United States unless otherwise expressly authorized by IHS. Such information shall be protected in transit and at rest in accordance with the security requirements of this SOW.

o Enterprise Key Management (BYOK): Exercise control over encryption key access, rotation, and revocation, and view access logs.

o Administrative Test Environment: Upon Government request, the contractor shall provide an administrative test environment (sandbox) to validate Single Sign-On (SSO), user provisioning, security configuration, administrative controls, and deployment settings prior to production implementation.

o Audit Logging: Administrative security logs shall be exportable through supported interfaces or APIs to enable retention within Government systems of record.

o Backup and Recovery: Configuration data, user administration data, security logs, and other operational information may be retained as necessary for disaster recovery, security, and service operation in accordance with applicable retention requirements.

Government content submitted solely for transient writing-assistance processing shall not be retained following completion of processing except as expressly authorized by IHS. Where IHS expressly authorizes functionality that requires persistent storage, including chat history, connector ingestion, indexes, embeddings, or similar derived data, such information shall be subject to the data-use, retention, access-control, security, and deletion requirements of this SOW.

• Cost center visibility: Gain visibility into license usage across all cost centers.

• Style guide: create style guides to help write consistently and on brand in real-time

• Brand tones: use of brand voice in a tone profile that is adopted or avoid specific tones in corresponding

• Knowledge Share: keep aligned internal information like acronyms, project names, term descriptions, and key contracts.

• Snippets: create and insert reusable phrases, sentences or paragraphs to help save time.

• Analytics dashboard: measures and drives progress with actionable insights.

• Customer Support: Priority Support: expedited response times from the support team

Critical Requirement: For cloud services, the Federal Risk and Authorization Management Program (FedRAMP) is a mandatory government-wide program for Federal Agency cloud deployments. The FedRAMP program provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products & services.

• If the potential contractor is not FedRAMP authorized, NIST SP 800-53 controls may be considered, but they do not guarantee approval of the proposed approach. The Indian Health Service (IHS) is required to maintain a secure public health infrastructure, and it is crucial that all applications and services comply with federal cybersecurity policies and regulations.

• Offeror shall acknowledge each bullet below. IHS reserves the right to address additional concerns during the review of proposals.

• The offeror shall demonstrate the services of an “agency-hosted private government cloud,” a cloud computing infrastructure dedicated to the Indian Health Service. Within this contract, the term “private cloud computing infrastructure” refers to computing infrastructure that is provisioned for exclusive use by the Indian Health Service and does not have interconnectivity to other cloud computing infrastructure.

• Limit Sensitive Data Input – No Sensitive Data: IHS users shall not enter non-public or sensitive data into the online writing tool.

• Transient Data Processing: Government content submitted for ordinary writing-assistance functionality shall be processed transiently and shall not be retained following completion of processing except as expressly authorized by IHS. No Government data, including Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), or Protected Health Information (PHI), shall be persistently stored within the Contractor's platform except where the applicable use and functionality have been expressly authorized by the Government and are consistent with applicable security, privacy, A&A/ATO, and contractual requirements.

• Functionality involving persistent storage or generation of persistent derived data—including chat history, connector ingestion, retrieval indexes, vector stores, or embeddings—shall not be enabled for IHS unless authorized by the Government. Before such functionality is enabled, the Contractor shall disclose the categories of information retained, the purpose of retention, the storage location, the retention period, the access controls, the deletion procedures, the applicable subprocessors, and any use of the retained information or derived data for AI/ML purposes.

• Authorized persistent Government content and associated indexes or embeddings shall remain within Contractor-operated U.S.-based infrastructure unless otherwise expressly authorized by IHS and shall be deleted in accordance with Government-approved retention requirements, including upon removal of the applicable connector or functionality where required.

• Data Retrieval and Monitoring: If an IHS user inputs sensitive data by mistake, the offeror shall make demonstrative efforts to help IHS retrieve or expunge sensitive data from the systems.

• Privacy Addendum (DPA) and Acceptable Use Policy: How the policy aligns with IHS Federal Privacy requirements. Note: Public privacy policies evolve; they cannot reduce protections for IHS data.

• Data Ownership and Liability: IHS retains sole ownership of its content and data; the offeror bears no liability for the content itself. IHS shall remain the owner of all text or data entered, and the offeror may not use IHS data for any purpose except to provide the service (no secondary use, such as marketing or AI model training, unless expressly permitted in writing).

No ownership rights are conferred to the offeror over any patient information or clinical content processed, and such content must be treated as IHS confidential data.

• No Unilateral Changes to Terms: The offeror shall not change the terms and conditions without written authorization from a warranted contracting officer. Inquiries regarding the terms and conditions of the contract shall be written and sent electronically via email to the contracting officer representative. In the subject line, list the award number and the name of the inquiry.

• Execution of a Health Insurance Portability and Accountability Act (HIPAA) and Business Associate Agreement (BAA) between the contractor and IHS: IHS is a covered entity; any vendor handling Protected Health Information (PHI) on IHS's behalf should sign a BAA. A BAA contractually obligates the vendor to safeguard PHI in accordance with HIPAA's Security Rule.

• Prohibit PHI Input Without Authorization: IHS users are forbidden from inputting PHI unless explicitly allowed. IHS users shall not submit any individually identifiable health information into the online writing database unless such use is explicitly authorized in writing by IHS's Privacy Office and covered by HIPAA BAA. Furthermore, IHS data should not be used as a repository of medical records or sensitive patient details in the normal course of work. If there are specific use cases where IHS wants to analyze clinical text with the contractor, those should be reviewed on a case-by-case basis and covered by the BAA and a proper risk assessment.

• Protecting PII and Privacy: IHS handles various Personally Identifiable Information (PII). The contractor shall demonstrate the privacy protection for any PII that might be processed.

• Data Use and Purpose Limitation: IHS data is only to provide writing assistance services and for no other purpose. IHS explicitly forbids the offeror from using IHS content for product development or marketing without consent, ensuring compliance with the Privacy Act and other federal privacy laws.

• Data Minimization and Retention: Offeror shall store IHS data only transiently and delete IHS-specific data after a defined retention period (e.g., after the text analysis is returned or within X days). Any logs or stored text containing IHS user content must be purged regularly to reduce the risk of long-term exposure. If the offeror maintains some user text for audit or troubleshooting, the contract should define limits and require secure storage. IHS could negotiate the right to request deletion of its content from the offeror's systems at any time.

• Subprocessor Transparency and Change Notification: The Contractor shall maintain and make available to IHS a current list of subprocessors that may receive, maintain, transmit, or otherwise process Government information, including cloud hosting providers, AI/LLM providers, analytics providers, and retrieval or indexing service providers.

• The Contractor shall provide IHS at least 30 calendar days' advance written notice before adding or replacing a subprocessor that will process Government information, unless a shorter period is required because of an emergency or circumstances outside the Contractor's reasonable control. The notice shall provide sufficient information for IHS to evaluate the applicable security, privacy, data processing, and authorization impacts.

• IHS reserves the right to review and object to a proposed subprocessor where the Government determines that its use would create an unacceptable security, privacy, legal, contractual, or authorization risk. The Contractor shall cooperate with IHS in addressing such objections and identifying appropriate mitigation or alternative arrangements where reasonably available.

• No subprocessor change shall diminish the Contractor's obligations to protect Government information or comply with the security, privacy, data use, retention, incident-response, and other requirements of the contract.

• Compliance with Privacy Standards: IHS requires the offeror to maintain certifications, ISO 27018, and comply with NIST privacy controls as outlined in NIST SP 800-53 Rev. 5's Appendix J for privacy. The contractor may identify additional privacy standards within their organization that safeguard sensitive data and provide strong privacy controls that would benefit IHS data.

• FISMA Moderate Controls and FedRamp Alignment: As a federal healthcare provider, IHS must comply with FISMA, meaning any system or service it uses should implement security controls commensurate with the sensitivity of the data (often Moderate impact level for

PII/PHI).

• Security Control Baseline: The offeror shall enumerate specific controls or families of controls that the offeror will maintain. For example, access controls (NIST AC family) to ensure only authorized personnel can access IHS data; encryption of data in transit and at rest (NIST SC controls) for any stored content; audit logging (AU controls) of administrative access to IHS data; incident response processes (IR controls) that align with IHS's requirements for reporting and mitigation, etc. Rather than listing all 300+ controls, IHS can require that the internal security program meet the general NIST SP 800-53 Moderate baseline. The DHS clause on additional security measures for FISMA is a starting point – IHS should formalize it by requiring annual attestation that the offeror meets NIST 800-53 controls for moderate systems. If the offeror has a security assessment report mapping its SOC 2 or ISO controls to NIST controls, it should be shared with IHS. This ties the vendor's obligations directly to federal cybersecurity standards.

• FedRAMP or Equivalent Assessment: IHS requires the contractor to submit an annual SOC 2 Type II report and/or an ISO 27001 certificate to verify controls, as well as the summary results of any penetration tests or vulnerability assessments conducted by the contractor. In the interim, IHS requires the contractor to submit an annual SOC 2 Type II report and/or an ISO 27001 certificate to verify controls, as well as the summary results of any penetration tests or vulnerability assessments conducted by the contractor. Regular security check-ins or audits can be written into the oversight plan.

• Data Breach Notification and Incident Handling: Per OMB and FISMA guidelines for federal agencies, IHS must be promptly informed of breaches in cloud services. The contractor shall notify the contracting officer representative by voice call and via email within 24 hours of discovering any Security Incident involving IHS data. A security Incident is any breach of security that leads to accidental or unlawful access to or loss of customer data. The contractor shall include in that notification written details of the incident, the affected data, and the mitigation steps. Furthermore, IHS requires the contractor to cooperate with incident response efforts – e.g., allowing IHS to perform an investigation or audit after a significant incident, notifying IHS of any law enforcement or individual inquiries related to IHS data, and cooperating with Government incident response activities as reasonably requested.

• Ongoing Oversight and Compliance Monitoring: The contractor shall provide a report on September 30 of each year of the contract. The report shall demonstrate monitoring to ensure compliance with NIST security controls at levels necessary to safeguard IHS data throughout this contract.

• Reporting and Audit Rights: IHS can reserve the right to audit the offeror's compliance with the contract terms and applicable controls. IHS requires quarterly compliance reports from the contractor’s CISO to IHS's CISO, covering uptime, security incidents (if any), and any changes to procedures.

• IHS Points of Contact: Contracting Officer, Javier Medina Velazquez, Javier.Medina- Velazquez@ihs.gov; Contracting Officer Representative, Kevin Fulbright, Kevin.Fulbright@ihs.gov, mobile (301) 526-9652; Security team, ihsdisfedissoteam@ihs.gov;

Data Privacy Officer, Tammy Crazy Bull, tammy.crazybull@ihs.gov.

• Training and Rules of Behavior: The contractor shall present a list of training and rules of behavior for their services. IHS shall review it and may adopt it to align with IHS training and Rules of Behavior.

• Contractual Remedies and Penalties: Failure or non-compliance with the terms and conditions outlined in the contract could result in termination of the contract and/or penalties for the total cost of the contract.

• Periodic Review of Terms: If new NIST guidelines and/or HHS regulations (Or FedRAMP when applicable) become available. IHS reserves the right to amend the contract terms and conditions to comply with new guidance and/or regulations.

Security Assessment and Authorization (A&A) / ATO Support:

The Contractor shall fully cooperate with IHS in support of the security Assessment and Authorization (A&A) process and any activities required to obtain and maintain an Authority to Operate (ATO) for the proposed solution.

The Contractor shall provide, within Government-established timelines, all security documentation, technical information, control implementation evidence, architecture and data-flow information, assessment evidence, policies, procedures, test results, and other artifacts reasonably required by IHS to conduct cybersecurity and privacy risk assessments and make an authorization determination.

The Contractor shall provide supporting documentation and evidence for all security and privacy controls for which the Contractor has full or shared implementation responsibility. The Contractor shall support IHS in documenting control inheritance and shared-responsibility determinations and shall respond to requests for clarification or additional evidence resulting from Government security assessments.

The Contractor shall cooperate with IHS, its assessors, and other authorized Government personnel in addressing security assessment findings, including deficiencies identified during security control assessments, vulnerability assessments, penetration testing, privacy assessments, or other authorization activities. Where deficiencies are identified within the Contractor's responsibility, the Contractor shall provide remediation plans, milestones, status updates, and supporting evidence of corrective actions sufficient to support Government risk acceptance and POA&M management.

Contractor support shall continue throughout the initial authorization, reauthorization, significant-change reviews, and continuous monitoring activities for the duration of the contract.

The software must provide flexibility for user account management, including the ability for IHS administrators to easily add or remove users throughout the duration of the contract without penalty or significant administrative burden.

Quantity

The quantity for the base year is expected to be 600. It is anticipated, but not guaranteed, that the program will add 80 licenses per option year based on license request trends over the past year. Base Year: Quantity 600; Option Year 1: 680, Option Year 2: 760.

V. SHIPPING

Licenses are provisioned at the start of the subscription.

VI. INSPECTION/ACCEPTANCE

IHS shall verify that the received goods match the order quantities and specifications, and the acceptance officer signs off to confirm the delivery is complete or partial.

VII. PLACE OF PERFORMANCE

An online tool that will be distributed within the Indian Health Service.

VIII. TRAINING

The contractor shall provide video training that shall be accessible to all users 24/7.

IX. GOVERNMENT FURNISHED PROPERTY/INFORMATION

N/A

X. SECURITY REQUIREMENT

The Contractor shall adhere to Privacy and Patient Confidentiality laws that are consistent with the Privacy Act and JCAHO Regulations.

The Contractor shall ensure compliance with cybersecurity with federal mandates and legislation, including the Federal Information Security Management Act and the President’s Management Agenda

XI. SECTION 508 DIGITAL ACCESSIBILITY

Standards The included standards that must be met for this contract are taken from the following two resources. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

• Section 508 Standards and Guidelines: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines guidelines

• Web Content Accessibility Guidelines (WCAG) 2.1: https://www.w3.org/TR/WCAG21

Electronic Content Accessibility - Web Based

• 602 Support Documentation

• 603 Support Services

• All WCAG A & AA Success Criteria

Software Accessibility - Web Based

• All WCAG A & AA Success Criteria

• 502 Interoperability with Assistive Technology

• 503 Application

• 602 Support Documentation

• 603 Support Services

• 302 All Functional Performance Criteria - Note: Applies when Chapter 5 does not address one or more functions of ICT (E204), or when an agency invokes "equivalent facilitation" (E101.2)

XII. KEY PERSONNEL

Technical Point of Contact Kevin Fulbright kevin.fulbright@ihs.gov 301.526.9652

XIII. Deliverables for Contractor

Once the contract has been awarded, a report showing all 600 licenses has been distributed to each user. A report showing the distribution of any new licenses for a new user. An introduction meeting shall be scheduled between IHS and the awardee. At IHS's discretion, a meeting may be requested during the term of the contract.

Reports to be submitted during the contract.

• Ongoing Oversight and Compliance Monitoring: The contractor shall provide a report on

September 30 of each year of the contract. The report shall demonstrate monitoring to ensure compliance with NIST security controls at levels necessary to safeguard IHS data throughout this contract.

• Security Controls and Audits: Offeror shall maintain robust security controls, including annual SOC 2 Type II audits and industry-standard practices. A SOC 2 Type II report evaluates the vendor's controls over security, availability, confidentiality, and privacy. Offeror shall list any additional security controls IHS needs for compliance with FISMA for this proposal. Security controls that may not be available at the time of award but may be available during the contract term shall be offered to IHS for consideration. The offeror may continue to offer additional security controls once the award has been made. IHS recommends that the offeror pursue FedRAMP Moderate authorization within 18 months of the award.

• Reporting and Audit Rights: IHS can reserve the right to audit the offeror's compliance with the contract terms and applicable controls. IHS requires quarterly compliance reports from the contractor’s CISO to IHS's CISO, covering uptime, security incidents (if any), and any changes to procedures.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.w3.org/TR/WCAG21 mailto:kevin.fulbright@ihs.gov

XV. Applicable Documents and Public Information

1. Health Insurance Portability and Accountability Act (HIPAA) of 1996

a. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

2. Privacy Act of 1974

a. https://www.justice.gov/opcl/privacy-act-1974

3. Joint Commission on Accreditation of Healthcare Organizations (JCAHO)

a. https://www.jointcommission.org/

4. HHS OCIO Policies, standards, and Charters-IT Security and Privacy

a. https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html

5. OMB Circular 1-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources (Computer Security Act of 1987)

a. https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html https://www.justice.gov/opcl/privacy-act-1974 https://www.jointcommission.org/ https://www.cio.gov/policies-and-priorities/circular-a-130/