Attachment 10 - FDA Standard Language for IT Procurements.pdf

FDA Standard Language for IT Acquisition Packages Updated 4/1/2024

The following language will be incorporated into the Orders under this BPA as applicable.

A. Standard Language

This language will be applicable to all Orders under this BPA.

Kick-Off Meeting and Report

The Contractor shall conduct a kickoff meeting at the FDA facilities in Rockville, MD or Silver Spring, MD, or virtually as directed by the COR. The kickoff meeting shall introduce the Contractor team, discuss roles, responsibilities, review the task order details, and other relevant artifacts and issues. With COR approval, the Contractor PM shall setup and schedule the Kickoff Meeting to occur within ten (10) business days after the contract award. The Contractor shall coordinate with the COR to determine date, time, location, and attendees for the kickoff meeting. The attendees of this meeting shall include all key personnel working on this contract, and the FDA COR, PM, and technical monitors. Minutes for the Kickoff meeting shall be submitted within three (3) business days after the meeting and uploaded to the FDA’s project repository (e.g., SharePoint), along with the kickoff meeting PowerPoint presentation.

The Contractor shall submit contract data in a format provided by the COR.

Weekly Status Reports

The Contractor shall submit weekly status reports in the Enterprise Status Tracking and Reporting System (eSTARS). The project names used for the project intake process shall be used as project names in eSTARS. The COR will provide the project intake details, such as project names and project intake numbers, if applicable. eSTARS is a web application that makes it easier for Contractors to submit their weekly status reports and for supervisors, leads, PMs, and CORs to review the report submissions in a centralized system. Each Contractor staff member must first be granted access before they can use eSTARS. eSTARS is only accessible from within the FDA internal network. The eSTARS URL will be provided by the COR upon contract award.

Weekly Status Reports are due each Tuesday by the close of business (COB) for the work performed the previous week. If Tuesday is a non-working day the report shall be due by COB, the following business day. The Contractor shall provide the information for each task that was performed during the weekly reporting period.

This information includes the following, but not limited to:

• Project Area/Name

• Planned Start and End Date

• Accomplishments

• Description/Comments

• Issues/Risks/Mitigation Plans

• Deliverables

• Role

• Action Items

Monthly Status Report

The Contractor shall submit a Monthly Status Report (MSR) to the COR on the 10th of each month for the prior month’s work. If the 10th falls on a non-working day the MSR shall be due the next business day after the 10th. The Contractor shall obtain approval from the COR before using the MSR format. The MSR shall cover all work completed during the preceding month and shall describe the work to be accomplished during the subsequent month. This report shall also identify any issues/problems identified and a statement explaining how the issue/problem was resolved. The Contractor shall not wait until the Weekly Status Meeting, MFR, or MSR to notify the COR of any identified or anticipated issues/problems. The MSR shall include the following information on tasks within this SOW:

• Work completed during each billing period

• Changes or updates to the Project Management Plan to include changes to project schedules for each activity (if applicable)

• Problems or issues that may impact successful contract performance and risk mitigation strategies taken

• List of change requests submitted during the billing period and issue resolution process

• List of Data Calls for the month and actions taken

• Action Items - which includes personnel to whom the Actions Items are assigned, date assigned, due date, and status (i.e., open, closed) by task

• Planned Activities for the next (month) reporting period by task

• Running total of sprints completed, along with the sprint #, month of the sprint, and the velocity for each sprint. For example, and for the purposes of this Task Order, the velocity should be constant as it represents the workload capacity of the Contractor.

• Organization chart that lists the task order team members, their roles, and their management, noting Key Personnel with an asterisk

Monthly Financial Report

The Contractor shall submit Monthly Financial Report (MFR) in eSTARS and inform the COR before the 5th of each month for the prior month’s work. If the 5th falls on a non-working day, the MFR shall be due to next business day after the 5th. The Contractor shall obtain approval from the COR before using the MFR format and enter data in eSTARS. The MFR shall include the following information on tasks within this SOW:

• For T&M and Labor Hour Service tasks - Resources (contractors’ names and their labor categories) assigned to each project/task, level of effort expended per resource on activities for the billing period, and amount billed per resource against the obligated amount.

• For Firm Fixed Price (FFP) tasks – Amount billed for the billing period.

Staffing

The contractor shall provide experienced and qualified personnel to meet the needs of the FDA. The Government reserves the right to review the technical qualifications and experience of any individual proposed by the Contractor prior to assignment to the contract. The Contractor shall notify the COR prior to changing allocation hours between tasks and labor categories compared to their proposal in a time and materials or labor hour service contract.

The Government requires the Contractor to identify key personnel for the total period of the project. The execution of project tasks will be subject to the precise assignment of specific individuals identified as key personnel. The Contractor shall ensure the continued assignment of personnel from project start to project finish. In the event an individual become incapacitated or leaves the company, it is the responsibility of the Contractor to have qualified and/or cleared (if required) individuals on staff to accomplish the task with a minimal learning curve. For temporary and/or permanent replacement personnel, the Contractor shall provide a resume for each individual prior to that individual’s reporting for work on this effort.

The Contractor shall not start charging a new staff member against the order unless the new contractor has been badged and has FDA network access and the necessary equipment to perform the work. The Contractor shall always use government-furnished equipment and/or the Virtual Private Network (VPN) account to access HHS/FDA systems and to conduct HHS/FDA business. The Contractor shall use only FDA email accounts to perform the work under this SOW and shall not send any documents or official communications to their personal email or their company email address.

The Contractor shall ensure that their personnel complete all required annual agency training (i.e. security awareness training, records management training, and other required trainings) by the due dates specified by the COR.

Place of Performance

Work shall be performed on a hybrid basis at the FDA facilities in the Washington, DC Metropolitan and surrounding areas, specifically Rockville, MD and/or Silver Spring, MD and/or telework/remotely as directed by the COR. The Contractor shall use the onsite rates for all contractors working from telework/remotely within the DC Metro area or outside the DC Metro area. Additionally, if a contractor staff needs to go to the Contractor Site daily to work full-time because work cannot be performed through telework/remotely, the Contractor shall provide justification and get approval from the COR before starting it and in that situation, the Contractor shall charge the Contractor Site rate for that specific resource.

Remote meeting attendance and work performance are normal business practices for FDA, providing that all FDA security policies and protocols are enforced. The Contractor shall attend meetings held at various FDA locations within the Metro DC commuting area. Local travel within the Washington, D.C. and surrounding area and any associated fees is not reimbursable.

Government Furnished Equipment (GFE)

The Contractor shall track Government Furnished Equipment (GFE), including FDA Property Number, Laptop type, contractor name, dates of onboard, offboard, and other fields identified by the COR. The Contractor shall submit a GFE report monthly or in an FDA system as directed by the BPA COR. When a Contractor leaves FDA and turns in the laptop, the GFE receipt should be provided to the Order level COR. The Contractor shall maintain the shipping boxes of their GFE to use upon returning back to the FDA when required.

For Contractors that are offboarded, the Contractor shall pay for shipping the returned laptop or other equipment back to the FDA. If the Contractor employee returning the GFE is within a 45-mile radius of an FDA physical location, the Contractor shall make arrangements to drop off the GFE. The DC Metro area drop-off locations are provided below. If the Contractor employee is outside of the 45-miles radius, the Contractor shall pay for the cost of returning the GFE to the FDA Property Management Team at the Wilkins Ave. address below or other address provided by the COR.

FDA Property Management Team 12231 Wilkins Ave.

Rockville, MD 20852 Staff Hours: M-F, 8am-4pm

-or-

FDA Property Management Team 10903 New Hampshire Ave.

Silver Spring, MD 20993 Staff Hours: M-F, 8am-4pm

# SOW Ref # Event/Deliverable Frequency Due Date Deliver To

1 Submit weekly status report into eSTARS 52 Weekly COR 2 Develop monthly status report 12 10th of each month COR 3 Submit monthly financial report in eSTARS 12 5th of each month COR 4 Submit monthly GFE Report 12 5th of each month COR

B. Orders with DME and O&M Task Areas

This language will be applicable to all Orders under this BPA with DME or O&M requirements.

To meet the FDA’s goal of annual contract cost savings, the Contractor shall optimize, consolidate, and automate processes through adoption of improved cost control processes, adoption of a modular approach that consolidates duplication of functionalities across the contract tasks, adoption of emerging and innovative technologies to reduce costs and achieve efficiencies, and look for continual improvement opportunities whenever feasible to reduce O&M costs by 5% each year of performance.

• Reduce the overall Operations and Maintenance (O&M) expenditures by an average of 5% via improved efficiency and innovation each year during the life of the contract.

O&M Optimization Cost Reduction Plan: The Contractor shall develop an annual O&M Optimization Cost Reduction Plan within 30 days of award. This plan shall be reviewed and approved by the COR annually and reviewed as part of contract performance management quarterly unless otherwise directed by the COR/COR Designee.

The plan at a minimum shall include:

• Task monitoring and cost savings measures

• Specific initiatives, activities, and milestones leading to the O&M cost savings of 5% per year

• Anticipated cost savings by task area and by suggested optimization

• Implementation timeline

• Provide comparative data to verify annual actual cost reductions

• Quarterly tracking and reports of achievement of actual reduction in work that would lead to the reduction in labor hours

1 O&M Optimization Cost Reduction

Plan 4 Within 30 days of the award. Reviewed and updated quarterly.

COR

C. Orders with Transition Task Areas

This language will be applicable to all Orders under this BPA with Transition.

Transition In (Add as applicable to the SOW)

The Contractor shall provide Transition-In support to provide an orderly transition from the incumbent Contractor to the Contractor. The Contractor shall ensure minimal disruption to the current system and operational activities. The purpose of the transition is to transfer expert knowledge, data, and artifacts that are used to support applications from the incumbent contractor to the successor contractor efficiently and orderly. While individual order will provide the specific tasks, representative tasks may include but are not limited to the following:

• Develop a Transition-In Plan

• Participate in Transition-In meetings.

• Participate in knowledge transfer activities such as “shadowing”

• Conduct and coordinate all knowledge transfer activities such obtain secure badging for team personnel

• Ensure complete understanding of the documented requirements

• Ensure complete understanding of the OIMT technical environment

• Ensure complete understanding of the current implementations and activities

• Ensure staff identified as key personnel are available to work with Subject Matter

Experts (SME) from the Government and the incumbent Contractor immediately after Order award.

Transition Out (Add as applicable to the SOW)

The Contractor shall provide a Transition-Out Plan for COR review and approval no later than prior to the end of the period of performance as determined by the project schedule.

The contractor shall provide support services to the orderly transition of functions from this contract to the FDA and/or successor contractor. The contractor shall be the lead on the transition activities during the transition period, leading Technical Exchange Meetings (TEMs) with the successor to impart complete and full knowledge transfer of OIMT projects, systems, applications, and databases, as well as sustainment activities that are in progress to include the technology used for all projects initiated under this contract.

During this period, the contractor shall ensure no degradation in support to the Government. At the COR designated turnover date, the successor contractor shall assume full responsibility of the contract, while the outgoing contractor focuses on contract closeout activities and providing sustainment support to complete the transition.

While individual orders will detail specific requirements, representative tasks may include but are not limited to the following:

• Providing the FDA with current versions of all system and user documentation, to include the native format for diagrams (e.g., Visio), even those embedded in documents

• Providing FDA all licensing and renewal information, asset management records, software documentation, and training materials

• Providing FDA with a current inventory of all Government-owned assets used by the Contractor along with full support in the reconciliation of this inventory

• Providing FDA with current versions of all CONOPS, operational procedures, standard operating procedures, guidelines, performance reports, specifications for hardware and software, and other pertinent information needed to continue the services being performed by the Contractor, i.e., any documentation developed under this contract Within 30 days of contract award, the COR will identify the repository will all documentation is to be stored; however, it will be the contractor’s responsibility to update/maintain the repository for all orders

• Providing “shadowing” and other knowledge transfer plans, meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

• Providing full source code sets (not COTS source code) with configuration management information; and,

• Providing up to date EPLC and program/project management documents

• Providing COR with a current inventory of all Government-owned assets used by the

Contractor along with full support in the reconciliation of this inventory

1 Transition-In Plan 1 Within 10 days of the award COR 2 Transition-Out Plan 1 Within 30 days before the POP ends COR

D. Orders with Hardware Supply

This language will be applicable to all Orders under this BPA with Hardware supply included.

802.1x Requirements

Any system requiring wired or wireless connectivity to the FDA Enterprise network shall support the Institute of Electrical and Electronics Engineers (IEEE) 802.1X protocol and shall provide 802.1x authentication “supplicant” software. All systems shall support X.509 Public Key Infrastructure (PKI) and accept FDA issued device certificates as a method of authentication. If the system does not support the 802.1X protocol, a waiver will be required to document and justify the exemption with the Information System Security Officer (ISSO), and the FDA system owner shall provide a device MAC (Media Access Control) address identifying the end point network device and its associated role the device will perform when connected to the FDA network. (e.g. Printer, Scientific Instrument, Telephone)

This language below applies if the requirement needs to meet the PKI authentication methods of wired and wireless.

The following Extensible Authentication Protocols (EAP) Methods are supported under 802.1x for wired access, EAP-TLS, EAP-PEAP, and EAP-TTLS. All Government Systems connected via wireless shall use EAP-TLS as defined by National Institute of Standards and Technology (NIST) Special Publication 800-53 - AC-18(1) - Wireless Access – (Authentication and Encryption).

E. Section 508 Language

This language will be applicable to all Orders under this BPA.

Accessibility and Section 508 Terms and Conditions

The Section 508 accessibility standards applicable to this SOW are identified below. The Contractor must provide any necessary updates to the submitted HHS Product Assessment Template(s) at the end of each contract or order exceeding the simplified acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense. These standards address access to information and communication technology (ICT) under Section 508 of the Rehabilitation Act and Section 255 of the Communications Act

The Section 508 accessibility standards applicable to this contract are:

• Must meet WCAG 2.0 A and AA

• E101.2 Equivalent Facilitation

• E203 Access to Functionality

• E204 Functional Performance Criteria

• E205 Electronic Content

• E206 Hardware

• E207 Software

• E208 Support Documentation and Services

• Chapter 4 Hardware

• Chapter 5 Software

• Chapter 6 Support Documentation and Services

• 302 Functional Performance Criteria

• Electronic content must be accessible to HHS acceptance criteria.

• Accessibility checklists for various formats are available at the HHS site.

• Materials that are final items must be compliant with Section 508 at time of delivery, except upon approval of the Contracting Officer or COR

Per 339.203-70 Contract Clauses for Electronic and Information Technology (EIT) Acquisitions

(a) 352.239-73, Electronic and Information Technology Accessibility Notice

(b) 353.239-74, Electronic and Information Technology Accessibility https://www.levelaccess.com/wcag-a-and-wcag-aa-conformance/ https://www.access-board.gov/ict/#E101.2 https://www.access-board.gov/ict/#E203-functionality https://www.access-board.gov/ict/#E204-functional-performance-criteria https://www.access-board.gov/ict/#E205-content https://www.access-board.gov/ict/#E206-hardware https://www.access-board.gov/ict/#E207-software https://www.access-board.gov/ict/#E208-documentation-Services https://www.access-board.gov/ict/#chapter-4-hardware https://www.access-board.gov/ict/#chapter-5-software https://www.access-board.gov/ict/#chapter-6-support-documentation-and-services https://www.access-board.gov/ict/#302-functional-performance-criteria https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-352-solicitation-provisions-contract-clauses/index.html#352.239-73 https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-352-solicitation-provisions-contract-clauses/index.html#352.239-74

Per 339.203-70 Contract Clauses for Electronic and Information Technology (EIT)