Attachment 1 - TTIMS-DDCC Statement of Work (SOW).pdf

Transfusion-Transmissible Infections Monitoring System (TTIMS)

Donation Database Coordinating Center

(DDCC)

Solicitation Number: FDA-RFP-1223854

Statement of Work (SOW) June 18, 2020

1.0 INTRODUCTION

1.1 BACKGROUND

The U.S. Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biological products, medical devices, tobacco products, our nation’s food supply, cosmetics and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make medicines, devices, products, and foods more effective, safer, and more affordable; and helping the public get the accurate, science-based information they need to use medicines and foods to improve their health.

Extensive epidemiologic research on many targeted aspects of transfusion safety has been conducted over the past several decades in the United States. In particular, the (NIH) National Heart Lung, and Blood Institute (NHLBI) Retrovirus Epidemiology Donor Study-II (REDS-II) made a seminal contribution to blood safety monitoring through refinement of procedures for the centralization of proprietary blood center operational data, successful coordination of standardized data definitions, and collection, analysis, and reporting of baseline epidemiologic and risk factor data for a large segment of the United States (US) donor base. The progress by REDS-II led to a recommendation from DHHS for establishment of “an ongoing, integrated, coordinated, and nationally representative U.S. transfusion transmissible infections monitoring system.” In response, the US Transfusion- Transmissible Infections Monitoring System (TTIMS) began data collection on September 1, 2015 under the sponsorship of the Food and Drug Administration (FDA), the NHLBI, and the Department of Health and Human Services, Office of the Assistant Secretary of Health (DHHS/OASH). TTIMS was established for the specific purpose of monitoring the safety of the US blood supply for threats from the major transfusion-transmissible infections: Human Immunodeficiency Virus (HIV), Hepatitis C (HCV), and Hepatitis B (HBV) during times of changes in the epidemiology of these agents in the US general population, as well as changes in blood collection and manufacturing policies and procedures that invariably occur over time. If and when new scientific data regarding blood safety emerge from any source, TTIMS will also maintain the capability to investigate additional emerging or re-emerging infectious threats to blood safety as well as donor attributes that may be associated with increased or decreased levels of risk.

TTIMS is conducted by two separate complimentary contracts consisting of an integrated, comprehensive Donor Donation Coordinating Center (DDCC) system, the subject of this statement of work, and a Laboratory and Risk Factor Coordinating Center (LRCC) which provides in-depth laboratory and risk interview assessments of donors who have confirmed markers for the TTIs of interest.

Since September 1, 2015, TTIMS monitored approximately 60% of the US blood supply and has collected, quality-controlled, and analyzed data from 21,355,268 blood donations by 8,011,20 individual donors appearing at four major blood centers. Relevant HIV, HCV, and HBV test data for all donated blood specimens have been harmonized, and donor blood samples with key serological results have been shared with the LRCC to establish a large TTIMS repository that has proven to be invaluable for studies of HIV LAg avidity “recency” testing; use of anti-retroviral therapy (ARV) by HIV+ donors; use of pre-exposure prophylaxis (PReP) by HIV seronegative donors presumed to be at high risk of infection, and HIV molecular epidemiology among blood donors.

The continued TTIMS effort requires close coordination between the DDCC and LRCC to ensure timely confidential data transfers between the organizations and ensure integration of activities to achieve the aims of the TTIMS project. Blood collection organizations interested in participating in TTIMS shall agree to participate in both the LRCC and DDCC data collection efforts. In particular, blood collection organizations must share relevant donor data compiled by their organization as well as blood specimens with both contractors for compilation and evaluation of TTI risks and identify, survey, characterize, and provide risk factor and other data on HIV and incident HCV and HBV blood donors, as well as other TTIs identified as important to blood safety.

The FDA requires the establishment of a Transfusion-Transmissible Infections Monitoring System (TTIMS) TTIMS DDCC Governance Framework.

1.2 TTIMS DDCC GOVERNANCE FRAMEWORK

Oversight and governance of TTIMS will be provided by the US FDA Contracting Officer’s Representative (COR) within the CBER Office of Biostatistics and Epidemiology. The Contractor shall establish the TTIMS Steering/Monitoring Committee (“Committee”) within 30 calendar days of contract award, to work with FDA and CDC representatives (including statisticians) to study historical trends. Data analyses and reports provided by the contractor will be reviewed by the COR and Committee members comprised of the Principal Investigators (PI), and Co-PI representing participating blood center organizations, DDCC and LRCC personnel, and experts from stakeholder Department of Health and Human Services (DHHS) Agencies, including, FDA, NIH, and CDC.

The Committee shall meet no less than every month by teleconference and in person at least twice a year. Unforeseen circumstances may arise requiring additional communication which would likely be by teleconference.

If necessary, the COR will form smaller subcommittees and executive subcommittees to address issue specific priorities. The Contractor shall report back with findings and recommendations for discussion and any necessary action by the Committee/subcommittees. The Government officials on the Committee (NHLBI, FDA and CDC) will provide necessary information to the appropriate internal Federal Agencies. The contractor shall receive feedback on the reports they generate, as well as any weaknesses and make recommended changes.

2.0 OBJECTIVES

The TTIMS project purpose is to continue an integrated, comprehensive US Blood Donor surveillance system to monitor TTIs such as HIV, HBV, and HCV including characterization of TTI marker risks in the US blood supply with monitoring of temporal, geographic, and demographic trends and provide a framework for evaluating the effect of a new intervention (such as implementation of new blood donor deferral policies) on TTI risks and blood donor risk factors. TTIMs is expected to fill a significant gap in current public health blood donor surveillance efforts and to serve as a resource for additional investigations. Specifically, the primary objective of this contract is to build upon existing foundations established for TTIMS to:

Maintain and expand as needed, a Diagnostic Donor Coordinating Center (DDCC) in the United States to monitor HIV, HBV, HCV and other TTIs identified as important to blood safety.

The DDCC will function to:

a. Monitor and characterize infections (HIV, HBV, HCV, and other selected TTIs) identified at participating blood collection organizations and assess prevalence and incidence rates, overall and by demographic and geographic subgroups;

b. Evaluate temporal, demographic, and geographic trends in incidence and prevalence rates for these TTIs over the period of the project;

c. Evaluate and monitor risk factor characteristics of donors whose donations are confirmed positive for HIV, recently acquired HBV or HCV, or other markers determined to be of interest;

d. Integrate risk factor data and disease marker surveillance information across different blood collection organizations;

e. Collect and compile bio-specimens and donation datasets from TTI-positive donors in repositories to enable additional researchers to compile donation datasets;

f. Serve as a resource to the scientific community by enabling collaborations and investigations into additional research questions.

The contractor shall be required to interface with FDA staff in multiple locations throughout the Washington, DC metropolitan area. All CBER business staff are located at FDA’s White Oak Campus in Silver Spring, MD. Travel outside the DC area may be needed for the site visits discussed below in paragraph 3.4.2.

3.0 TASK DESCRIPTION(S)

The following tasks constitute the performance work expectations for DDCC support.

3.1 MAINTAIN A DIAGNOSTIC DONOR COORDINATING CENTER (DDCC)

The Contractor shall identify, recruit, and manage TTIMS blood center participants in sufficient volume to establish an allogeneic blood donation test result and demographic database representing 50% or more of the U.S. mainland allogeneic volunteer blood collections within 30 calendar days of contract award. The Contractor shall provide a Blood Donor Center Enrollee Report and de-identified data to the FDA COR. Furthermore, the Contractor shall lead the donation database effort including the identification and evaluation of HIV and incident hepatitis-infected blood donors.

a. The Contractor shall collect blood donor datasets and corresponding donor demographic data including age, gender, and race as required to achieve overall program objectives (i.e.

50% or more of US blood donors). Additionally, the Contractor shall provide screening and supplemental/confirmatory test results for all allogeneic blood donations collected.

b. The Contractor shall work collaboratively with the Committee to develop and finalize both the overall TTIMS project protocol within two months of contract award and a Manual of Operations (MOP) within three months of contract award by providing technical expertise in the areas of blood banking and transfusion medicine, infectious disease, databases/datasets management, study design and analytical/bio-statistical approaches including incidence and prevalence estimation.

i. The MOP shall describe in detail procedures, timeframes, and frequencies of performance for the TTIMS project and shall be approved by the COR prior to implementation. At a minimum, the overall MOP shall address governance;

coordination; communication; identification of TTI-positive donors and recall procedures; survey development and administration; all laboratory procedures; bio-specimen collection, shipping, and storage; data collection, management/tracking, consensus definitions, security, transfer and sharing considerations; TTI risk and risk factor monitoring and associated trigger thresholds and resulting investigation procedures; training and site visit procedures; statistical and analytical plans for all data reports, and analyses; presentations, reports, and publications policy; human subject considerations; and processes to obtain all necessary administrative/regulatory clearances including applicable Institutional Review Boards (IRBs), and Office of Management and Budget (OMB).

c. The Contractor shall assign a unique Identification (ID) number to accompany the data files transmitted to the LRCC, and other stakeholders for each test positive donor, allowing the donor to be longitudinally followed and individual donations and components identified in the databases to be maintained by both the DDCC and LRCC.

i. The Contractor shall securely handle, store and maintain the link between the unique study donor ID and the donor identification information to allow the LRCC to contact the donor for appropriate follow-up.

Table 1 Task 3.1 Deliverables

3.2 PERFORM DATA COLLECTION AND DATA MANAGEMENT

The Contractor shall develop and implement secure and robust data collection, tracking, management, and storage for TTI test results, demographic, first-time/repeat status, and other blood donor/donation data from participating blood collection centers.

The Contractor shall provide evidence of availability of electronic medical record data capture system(s) that can be accessed for study purposes. Additionally, the Contractor shall provide all necessary and relevant data management, tracking procedures, and tools to the participating blood collection organizations.

The Contractor shall provide datasets (in formats and according to timeframes delineated in the MOP) and bio-specimens to the LRCC that include at a minimum:

a. Screening and supplemental/confirmatory test results for all allogeneic blood donations collected, as well as corresponding donor demographic data that includes age, gender, and race. Donor/donation data shall be as comprehensive as possible to achieve overall program objectives;

Task Deliverable/Work Product Title Due Date Quantity / Frequency

Delivered To

3.1 1. Blood Donor Center Enrollee Report

Monthly Ongoing COR

3.1 2. DDCC TTIMS Protocol 2 months after Contract Award Ongoing COR

3.1 3. DDCC Sections of Manual of Procedures (MOP)

3 months after Contract Award Once COR

b. Managing data relevant to evaluation of risk factors in TTI-positive donors per specified format, as coordinating follow-up evaluations;

c. Assigning and securely storing and handling a unique Identification (ID) number to accompany data files transmitted to the LRCC, the COR, and Committee members, for each test positive donor, allowing donors to be longitudinally followed and individual donations and components identified in the databases maintained by the DDCC and LRCC;

d. Collaborate/coordinate with the LRCC to ensure appropriate data transfers and cross-talk between datasets;

e. Collect and ship bio-specimens to the LRCC and coordinate with the LRCC to manage all data relevant to the evaluation of risk factors in TTI-positive donors as well as follow-up evaluations.

Table 2 Task 3.2 Deliverables

3.3 PERFORM DATA ANALYSIS AND REPORTING

The Contractor shall complete all TTI analyses and reporting relevant to the overall Scope of Work of the DDCC, to include:

a. Calculate blood donor marker prevalence and incidence with 95% Confidence Interval (CI) for HIV, HBV, HCV and other markers of interest for TTIMS sites. HIV incidence estimates shall be determined based on both a window period (inter-donation interval model for seroconverting repeat donors, on validated HIV Nucleic Acid Test (NAT) only observations and upon validation for HIV "recency" testing (provided by the LRCC) as appropriate;

b. Provide TTI prevalence and incidence estimates (when available) with 95% CI; stratified by demographic, first-time/repeat status, geographic, and temporal variables;

c. Provide estimates of residual risk (and 95% CI) for HIV, HBV, HCV, and other markers of interest for the US blood supply on an annual basis;

d. Provide well-characterized TTI donor/donation data to the LRCC to permit analysis of TTI donor data stratified by donor risk factors;

e. Contribute independent hypotheses for analysis of study data;

f. Provide a monthly list of all HIV, HBV, HCV, and other marker positive donations, together with information on the date of the donation (day/month/year), the type of donation (if other than allogeneic), the procedure (apheresis platelet, whole blood, Double Red Blood Cell (RBC) apheresis, etc.), screening and supplemental/confirmatory tests results (including

Task Deliverable/Work Product Title Due Date Quantity / Frequency

Delivered To

3.2 1. Infected Blood Donor Datasets In accordance with

MOP

Ongoing LRCC

3.2 2. Data transfers to LRCC In accordance with

MOP

Ongoing LRCC

3.2 3. Bio-specimen shipments In accordance with

MOP

Ongoing LRCC follow-up testing and HIV recency testing), final TTI confirmatory status interpretation, incidence vs. prevalence status, age, gender, race, and geographic indicator;

g. Provide corresponding donation denominator data including total number of donations collected per month by each blood collection organization broken down by the type of donation (if other than allogeneic donation data are collected), the procedure (apheresis platelet, whole blood, RBC apheresis, etc.), age, gender, race and geographic indicator:

i. Number of incident HIV infections per month

ii. Number of incident HCV infections per month

iii. Number of incident HBV infections per month

iv. Number of prevalent HIV infections per month

v. Number of prevalent HCV infections per month

vi. Number of prevalent HBV infections per month

vii. Incidence rates and 95% CI for HIV-1/HIV-2, HCV, HBV, and prevalence and incidence data for other markers of interest

viii. Per month, overall and stratified by gender

ix. Per year, overall and stratified by type of donation (if other than allogeneic donation data are collected), the procedure (apheresis platelet, whole blood, 2RBC apheresis, etc.), age, gender, race, and geographic indicator.

h. Prepare and submit recurring technical progress reports containing descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The submission frequency is expected to be on a quarterly basis, but is subject to change as trends develop;

i. Prepare and submit semiannual (every six (6) months) Progress Reports summarizing all work results for the period covered in sufficient detail to comprehensively explain the results achieved. The report shall be in letter form (minimum 2-3 pages) and include progress for the six-month period, problems encountered during the six-month period, goals met or missed, a summary of activities planned for the next six months, and reports / abstracts / presentations / manuscripts in progress, submitted or published;

j. Prepare an Annual Technical Report summarizing all work results performed. Specifically, the report shall include:

i. Cover page to include contract number, title, period of performance being reported, Contractor's name and address, telephone and facsimile numbers, and date of submission;

ii. An executive summary, to include:

• A statement of intended work for the reporting period;

• A brief overview of the work that was completed for the reporting period; any problems (technical or financial) that occurred and their resolution or status;

• Advancements made in relation to any of the technical tasks set forth in the

Statement of Work (SOW);

• A full description of data pertaining to, work performed during the reporting period, materials and methods pertaining to the work, relationship between the accomplishments made relative to goals and tasks of the Statement of Work, problems encountered and resolution. If applicable, full disclosure of any efforts to transfer the technology or receipt of support from outside entities interested in future access, partnering, or license to the developing technologies.

Prepare a Final Technical Report consisting of a description of work performed and results obtained for the entire contract period of performance in sufficient detail to describe comprehensively the results achieved;

k. Prepare published or unpublished abstracts, presentations, reports, and manuscripts derived from analyses under the contract.

Table 3 Task 3.3 Deliverables

Task Deliverable/Work Product Title Due Date Quantity / Frequency

Delivered To

3.3 1. TTI data reports and analysis results (prevalence and incidence estimates, independent hypotheses, residual risk, etc.)

In accordance with the MOP Quarterly (minimum)

COR

3.3 2. List of all HIV, HBV, HCV, and other marker positive donations

5th calendar day of the month (for prior month’s report)

Monthly (include in Status Report)

COR

3.3 3. Donation Denominator Data 5th calendar day of the month (for prior month’s report)

Monthly (include in Status Report)

COR

3.3 4. Technical Progress Reports At intervals, as specified by the COR and/or MOP

Minimum Quarterly

COR

3.3 5. Semiannual Technical Reports Within 15 calendar days before the end of the reporting period.

Two per year COR

3.3 6. Draft Annual Technical Reports Draft due 30 calendar days before the end of the reporting period.

Annually COR

3.3 7. Final Annual Technical Reports Final due at the end of reporting period

Annually COR

3.3 8. Draft Final Technical Report Draft due 30 calendar days before the last day of the contract’s period of performance

One COR

3.3 9. Final Technical Report Final due at the end of contract’s period of performance

One COR

3.3 10. Manuscripts for publication 30 calendar days prior to the agreed date

Anticipate one per year

COR

3.4 COMMUNICATION AND OUTREACH

3.4.1. Provide Scientific Leadership and participate in TTIMs Committees and Subcommittees

As a major participant of the TTIMS national blood safety surveillance effort, the Contractor shall provide scientific leadership to the program through the conceptualization and sharing of new study initiatives and analyses, as well as through the planning and implementation of TTIMS initiatives that are reviewed and approved by the TTIMS Executive Committee. For all aspects of blood safety research and surveillance anticipated or conducted by the contractor during the period of TTIMS funding, the proprietary interests of the TTIMS program shall be respected and any new data, hypotheses, study initiatives and analysis plans relevant to blood safety in the US shall be reviewed by the TTIMS Executive Committee for possible inclusion in the overall TTIMS program. This requirement shall also apply to TTIMS-funded sub-contractors.

The Contractor shall act as a member of the TTIMS Committee and any assigned subcommittees.

Moreover, the contractor shall provide regular updates on the work being accomplished to the Committee and other identified stakeholders. The Contractor shall establish and serve on a TTIMS Steering/Monitoring Committee (Committee) within 30 calendar days of contract award. The Contractor shall meet with FDA, NIH, and CDC representatives (including statisticians), donor organizations and the LRCC Principal Investigator (PI) monthly. The Contractor shall be responsible for leading discussions, participating in discussions, contributing questions and answers; raising and addressing issues, risks and concerns; developing and giving presentations, and other active oral and written communications. The Contractor shall prepare meeting agendas, minutes, and action items and circulate to the Committee in a timely manner.

The Contractor’s Principal Investigator (PI) shall attend face-to-face semi-annual Committee meetings located at Silver Spring, Maryland (1-day duration each) with the first meeting conducted within two months of contract award. Moreover, the Contractor’s Principal Investigator (PI) shall attend all Committee and subcommittee conference calls, at least once per month for the duration of the contract period of performance. The Contractor shall coordinate, schedule, and provide logistical support for Committee/Subcommittee meetings / conference calls.

3.4.2. Quality Control and Site Visits

The Contractor shall work collaboratively with the COR to assess, recommend, and document the practices, training needs, provide training as applicable, and conduct a minimum of two (2) site visits to address and remedy issues encountered with each participating blood collection organizations relevant to the database component of the TTIMS project. The Contractor shall develop a donor site visit schedule and training materials that will ensure quality and consistency of the collective data and reports.

3.4.3. External Collaborations

The Contractor shall collaborate with other Government Agencies and/or other individual blood organizations. All external collaborations and investigations will be approved by the CBER COR and/or TTIMS Executive Committee. The purpose of these collaborations will be to use existing TTIMS data or resources to address additional research questions.

Table 4 Task 3.4 Meetings

Table 5 Task 3.4 Deliverables

3.5 PROJECT/CONTRACT MANAGEMENT

3.5.1. Facilities

The Contractor shall provide facilities and equipment necessary to work with infectious materials in order to accomplish the requirements as specified in the task areas 3.1-3.4. Specifically, the Contractor shall provide facilities and equipment. Additionally, the Contractor shall provide the capacities to store biological/infectious materials and specimens at -70° C. Lastly, the Contractor shall ensure that electronic data is captured, retained and protected for future study purposes.

3.5.2. Project Meetings and Status Reporting

The Contractor shall provide project/contract management to ensure that contracted tasks stay on track and milestones, performance measures, deliverables and work products are met.

The Contractor shall participate in a kickoff meeting within 10 calendar days of contract award. The purpose of the kickoff meeting is to introduce the contractor staff to the Government and discuss the contractor’s approach to meeting the requirements of the SOW.

The Contractor shall deliver a Monthly Status Report (MSR) to the COR on the 10th business day of each month following the end of the previous calendar month. At a minimum the MSR shall contain the following information:

a. An overview of work completed, in progress, and planned for each task;

b. Identification of problem areas with recommended remedial actions;

c. Challenges, issues, and risks.

Meeting / Activity Title Location(s) Estimated Occurrences

Receiving Organization

Steering Committee Monthly meeting FDA White Oak Campus, Bldg 71 or teleconference

One per Month

Committee

Semiannual On-Site Meeting (to include PIs and some Committee Members)

FDA White Oak Campus, Bldg 71 (in-person meeting only)

Two per year Committee

Steering Committee Conference Call Teleconference Minimum Monthly

Committee

Steering Sub-Committee Conference Call Teleconference Minimum Monthly

Committee

Task Deliverable/Work Product Title Due Date Quantity / Frequency

Delivered To

3.4 1. Committee/Subcommittee Conference Calls Meeting Minutes

Prior to the 15th of each month

Monthly COR, Committee

3.4 2. Blood Donor Center Site Visit Schedule

30 calendar days after contract award

2 per year for 1st year enrollment

COR

3.5.3. Quality Control

The Contractor shall deliver high-quality data and information obtained following FDA Statute, Guidance and Good Manufacturing Processes (GMPs), required of all licensed blood collection organizations operating within the United States and high-quality written materials (technical documents, analyses, reports, etc.). See Appendix A, Quality Assurance Surveillance Plan (QASP) for performance standard matrix.

Comprehensive, clear analysis of trends and their effects in order to provide strategic profiles and advice to senior management on suitable policies and the effects of policy decisions and new regulations.

a. Information shall reflect state-of-the-industry practices and current applicable regulatory requirements;

b. The Contractor shall take the lead in developing documents and shall incorporate a high level of quality assurance and responsiveness;

c. The Contractor shall not receive more than two customer complaints regarding documents prepared within any twelve-month period of performance;

d. Reports and technical documents shall be delivered within the timeframe specified with minimal errors and need for corrections;

e. The Contract shall ensure the following:

• That its staff have the requisite subject matter expertise and skillsets;

• 100% of Key Personnel shall be on boarded within 30-calendar days of award.

In addition, the Contractor shall be proactive in informing the designated CBER COR of any issues, problems and recommendations that shall be addressed in order for the overall effective accomplishment of contract goals and deliverables. Recommendations for actions that need to be taken by FDA staff, or other Contractors shall be clearly defined and communicated to the responsible party and the FDA and have identified dates for completion.

3.5.4. Transition Out

A smooth and orderly transition-out between the incumbent Contractor and the successor Contractor or Government is necessary to ensure minimum disruption to vital FDA business. The Contractor shall submit and execute a Transition-Out plan to ensure business continuity for the FDA in the event that a new Contractor is selected. At a minimum, this Transition-Out plan will include the following:

a. Transition-Out Plan and Schedule;

b. Inventory of documentation to be turned over;

c. Submission of knowledge transfer documentation to include current and up-to-date Standard Operating Procedures (SOPs);

d. Participate in all Transition-In activities with successor Contractor;

e. Provide “shadowing” and participate in knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor;

f. Identify, track and discuss with the Government any known problems, risks or issues associated with the transition – Deliverables, Inspection and Acceptance.

Table 6 Task 3.5 Meetings

Table 7 Task 3.5 Deliverables

4.0 CONTRACT CONSTRAINTS

The following constraints are applicable to this contract:

a. The Contractor shall ensure that all appropriate administrative and regulatory approvals are obtained as described in the MOP by any participating blood collection organizations before TTIMS data collection begins. These include but are not limited to those that address human subject considerations and clearances including applicable Institutional Review Boards (IRBs), and Office of Management and Budget (OMB).

b. The identity of the blood donor shall not be provided to the Committee.

c. Interim data used in technical progress reports and other reports developed for the purpose of study monitoring, or internal collaborations shall not be released publicly. Premature release of such data could result in interpretations that prove to be unreliable or invalid once the study is completed and the full context for the data is known and lead the public and medical practitioners to pursue inappropriate measures.

d. Legend for Technical Progress Reports Containing Interim Study Data:

• The Contractor shall incorporate the following legend on the cover page of technical progress reports and reports containing interim study data that are prepared for internal and confidential use by the Committee or other Committees such as the Blood Product Advisory Committee or the Advisory Committee on Blood & Tissue Safety & Availability:

"The data, if any, contained in this report/deliverable are preliminary and may contain un-validated findings. These data are not intended for public use. Public use of these data could create erroneous conclusions which, if acted upon, could threaten public health or safety."

Meeting / Activity Title Location(s) Estimated Occurrences

Receiving Organization

Contract Kick-Off Meeting FDA White Oak Campus, Bldg 71 One COR

Task Deliverable/Work Product Title Due Date Quantity / Frequency

Delivered To

3.5 1. Kick Off Meeting Minutes Within 10 calendar days after contract award

One COR, Committee

3.5 2. Monthly Status Report 5th calendar day of the month (for the prior month report)

Monthly COR, Committee

3.5 3. Transition Out Plan 30 calendar days prior to the end of the contract

One COR

e. Manuscripts/reports in progress and proposed for publication shall follow TTIMS procedures outlined in the Presentation/Publication MOP and are to be provided to the COR for review and comment at least 30 calendar days prior to submission for publication.

f. Abstracts and presentations shall follow TTIMS procedures outlined in the Presentation/ Publication MOP and are to be provided to the FDA COR for review and comment at least 5 calendar days before submission or presentation, respectively.

g. The computer programs, data management systems, databases, and other resources developed through this contract shall comply with data standards and procedures established by DHHS and FDA (per http://www.fda.gov/ForIndustry/DataStandards/default.htm).

h. The Contractor shall coordinate with the LRCC, as tasked in section 3.0.

Security and Privacy

Information Security:

A. Baseline Security Requirements

1. Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

http://www.fda.gov/ForIndustry/DataStandards/default.htm http://www.fda.gov/ForIndustry/DataStandards/default.htm

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location.

In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/ detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3. Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [x] Low [ ] Moderate [ ] High Integrity: [x] Low [ ] Moderate [ ] High Availability: [x] Low [ ] Moderate [ ] High Overall Risk Level: [x] Low [ ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[x] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [x] Low [ ] Moderate [ ] High

4. Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

“handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T:

Sanitization of Computer-Related Storage Media.

5. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8. Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9. Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract.

Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee under this contract shall complete the FDA non-disclosure agreement (3398 Form, RFP Attachment D), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M- 03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send FDA approved notifications to affected individuals as directed by FDA’s SOP.

3. Report all suspected and confirmed information security and privacy incidents and breaches to the FDA Systems Management Center, COR, CO, and other stakeholders, (Recommend adding the FDA Senior Official for Privacy with contact information and either defining or deleting “other stakeholders.”) including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour of discovery/detection, and consistent with the applicable FDA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines.