Attachment 2-Draft SOW.pdf

PDF 324 KB Posted May 1, 2026

Attached to: ISBEE/IEE: Grammarly Business Enterprise (Base + 4)
Solicitation number: 75H70426Q00025
Issued by: Department of Health and Human Services Indian Health Service

About this file

Written by GovTribe AI · May 1, 2026

This is a Statement of Work (SOW) for an online English writing assistance tool to be procured by the Indian Health Service (IHS) for approximately 600 employees, with anticipated expansion to 920 users across four option years.

The IHS seeks to purchase Grammarly Business Enterprise (GRMLYENT-200) as an authorized reseller to enhance professional writing capabilities across the organization. The software must provide real-time grammar checking and proofreading, paragraph rewriting functionality, seamless integration with Microsoft Office Suite and web browsers, customized style guide capabilities for IHS-specific terminology and acronyms, advanced collaboration features, and robust data security protections. The solution must be hosted either on-premises or as a SaaS offering compliant with FedRAMP at the moderate level. Critical security requirements include SCIM provisioning, managed mode authentication, user groups, custom roles, client control, confidential mode to prevent processing marked content, data loss prevention, enterprise key management (BYOK), cost center visibility, analytics dashboards, and priority customer support. The contractor must execute a HIPAA Business Associate Agreement, maintain annual SOC 2 Type II audits or ISO 27001 certification, comply with NIST SP 800-53 controls at the Moderate baseline, prohibit PHI and sensitive data input by users, notify IHS of security incidents within 24 hours, provide quarterly compliance reports to IHS's CISO, and pursue FedRAMP Moderate authorization within 18 months of award.

The contract is structured as a Firm Fixed Price agreement with a base year of 600 licenses (anticipated start June 15, 2026) and four option years with increasing quantities: Option Year 1 (680 licenses), Option Year 2 (760 licenses), Option Year 3 (840 licenses), and Option Year 4 (920 licenses), each for 12-month periods. Licenses are provisioned at subscription start, and the contractor must provide 24/7 accessible video training, distribute initial license reports, schedule introductory meetings with IHS, and submit annual compliance monitoring reports by September 30 of each contract year. Key IHS points of contact include Contracting Officer Javier Medina Velazquez, Contracting Officer Representative Kevin Fulbright, Data Privacy Officer Tammy Crazy Bull, and the security team at ihsdisfedissoteam@ihs.gov.

View the file

Other files

File	Type	Posted
Attachment 1-IEE Representation Form.pdf	PDF	May 1, 2026
75H70426Q00025_Sources Sought-Grammarly.pdf	PDF	May 1, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

STATEMENT OF WORK

for

Online Writing Tool

I. INTRODUCTION

The Indian Health Service (IHS) is responsible for providing federal health services to American Indians and Alaska Natives. The provision of health services to members of federally recognized tribes grew out of the special government-to-government relationship between the federal government and Indian tribes. This relationship, established in 1787, is based on Article I, Section 8 of the Constitution, and has been given form and substance by numerous treaties, laws, Supreme Court decisions, and Executive Orders. The IHS is the principal federal health care provider and health advocate for Indian people, and its goal is to raise their health status to the highest possible level. The IHS provides a comprehensive health service

II. SCOPE & PURPOSE

The Indian Health Service (IHS) Division of Program Management and Budget wishes to purchase an online English writing assistance tool for approximately 600 IHS employees. An online writing assistance software tool will provide improvements to articulate in a clear, high-quality, and efficient manner. This tool's features allow paragraph rewrites and proofreading to alleviate grammatical errors, typos, and incorrect punctuation. An integrated workflow allows us to connect all applications and websites on desktops and laptops to assist with narration, improve team communication and collaboration with custom styles, support knowledge sharing, and define team acronyms. Software also provides security protection for data and information when using the tool.

III. TASK OBJECTIVE STATEMENT

The Indian Health Service (IHS) seeks to procure an online English writing assistance software tool to enhance the professional writing capabilities of approximately 600 IHS employees. The primary objective of this software is to enable users to produce clear, concise, accurate, and high-quality written communications. Specifically, the software must include advanced functionalities such as paragraph rewriting to improve readability and coherence; comprehensive proofreading to identify and correct grammatical errors, typographical mistakes, and punctuation inaccuracies; and seamless integration across multiple desktop and laptop applications and websites utilized by IHS employees.

Additionally, the software must support enhanced team collaboration and communication by enabling customization of writing styles, facilitating consistent organizational language, and allowing for knowledge sharing, including the ability to define and manage team-specific acronyms and terminology. Given the sensitive nature of the information managed by the IHS, the software solution must provide robust security features designed to protect user data and maintain confidentiality during use.

IV. REQUIREMENTS

Requirement Description: Brand Name Specific: Grammarly: GRMLYENT-200 Grammarly Business Enterprise. The Potential Contractor is required to be an authorized reseller of the proposed brand name, specifically GRMLYENT-200 Grammarly Business Enterprise.

The proposed software tool shall provide comprehensive online English language writing assistance, inclusive of but not limited to:

• Real-time grammar checking and proofreading to identify grammatical errors, spelling mistakes, punctuation inaccuracies, and stylistic inconsistencies.

• Functionality to rewrite paragraphs or sentences to enhance readability, clarity, and overall quality of written communication.

• Seamless integration capability with various desktop and laptop-based applications (e.g., Microsoft Office Suite, web browsers, email clients) utilized by IHS employees.

• Customized style guide functionality that enables defining, sharing, and enforcing writing styles, standards, and team-specific terminology, including acronyms unique to IHS.

• Advanced collaboration features to facilitate efficient team communication and consistency in documentation across teams.

• Robust data security and privacy protections compliant with federal standards to secure sensitive IHS information at rest and in transit.

• The solution must be either hosted on-premises or provided as SaaS. If the solution is SaaS, it is essential that it complies with FedRAMP at the moderate level.

• Security features:

o SCIM: Automate the provisioning process o Managed Mode: Ensure users sign in only from their organizations’ email addresses.

o User Groups: Create separate groups within one subscription to easily customize features and manage users.

o Custom Roles: Manage admin permissions based on the level of access needed with flexibility o Client Control: Control which apps (e.g., Extension, Desktop app, etc) can be used.

o Confidential Mode: Prevent processing content labeled with

“Confidential.”

o Data Loss Prevention: Prevent the intake and transmission of sensitive data types.

o Enterprise Key Management (BYOK): Exercise control over encryption key access, rotation, and revocation, and view access logs.

• Cost center visibility: Gain visibility into license usage across all cost centers.

• Style guide: create style guides to help write consistently and on brand in real-time

• Brand tones: use of brand voice in a tone profile that is adopted or avoid specific tones in corresponding

• Knowledge Share: keep aligned internal information like acronyms, project names, term descriptions, and key contracts.

• Snippets: create and insert reusable phrases, sentences or paragraphs to help save time.

• Analytics dashboard: measures and drives progress with actionable insights.

• Customer Support: Priority Support: expedited response times from the support team

Critical Requirement: For cloud services, the Federal Risk and Authorization Management Program (FedRAMP) is a mandatory government-wide program for Federal Agency cloud deployments. The FedRAMP program provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products & services.

• If the potential contractor is not FedRAMP authorized, NIST SP 800-53 controls may be considered, but they do not guarantee approval of the proposed approach. The Indian Health Service (IHS) is required to maintain a secure public health infrastructure, and it is crucial that all applications and services comply with federal cybersecurity policies and regulations.

• Offeror shall acknowledge each bullet below. IHS reserves the right to address additional concerns during the review of proposals.

• The offeror shall demonstrate the services of an “agency-hosted private government cloud,” a cloud computing infrastructure dedicated to the Indian Health Service. Within this contract, the term “private cloud computing infrastructure” refers to computing infrastructure that is provisioned for exclusive use by the Indian Health Service and does not have interconnectivity to other cloud computing infrastructure.

• Limit Sensitive Data Input – No Sensitive Data: IHS users shall not enter non-public or sensitive data into the online writing tool.

• Data Retrieval and Monitoring: If an IHS user inputs sensitive data by mistake, the offeror shall make demonstrative efforts to help IHS retrieve or expunge sensitive data from the systems.

• Privacy Addendum (DPA) and Acceptable Use Policy: How the policy aligns with IHS Federal Privacy requirements. Note: Public privacy policies evolve;

they cannot reduce protections for IHS data.

• Security Controls and Audits: Offeror shall maintain robust security controls, including annual SOC 2 Type II audits and industry-standard practices. A SOC 2 Type II report evaluates the vendor's controls over security, availability, confidentiality, and privacy. Offeror shall list any additional security controls IHS needs for compliance with FISMA for this proposal. Security control that may not be available at the time of the award but may be available during the duration of the contract shall be offered to IHS for consideration. The offeror may continue to offer additional security controls once the award has been made. IHS recommends that the offeror pursue FedRAMP Moderate authorization within 18 months of the award.

• Data Ownership and Liability: IHS retains sole ownership of its content and data; the offeror bears no liability for the content itself. IHS shall remain the owner of all text or data entered, and the offeror may not use IHS data for any purpose except to provide the service (no secondary use, such as marketing or AI model training, unless expressly permitted in writing). No ownership rights are conferred to the offeror over any patient information or clinical content processed, and such content must be treated as IHS confidential data.

• No Unilateral Changes to Terms: The offeror shall not change the terms and conditions without written authorization from a warranted contracting officer.

Inquiries regarding the terms and conditions of the contract shall be written and sent electronically via email to the contracting officer representative. In the subject line, list the award number and the name of the inquiry.

• Execution of a Health Insurance Portability and Accountability Act (HIPAA) and Business Associate Agreement (BAA) between the contractor and IHS:

IHS is a covered entity; any vendor handling Protected Health Information (PHI) on IHS's behalf should sign a BAA. A BAA contractually obligates the vendor to safeguard PHI in accordance with HIPAA's Security Rule.

• Prohibit PHI Input Without Authorization: IHS users are forbidden from inputting PHI unless explicitly allowed. IHS users shall not submit any individually identifiable health information into the online writing database unless such use is explicitly authorized in writing by IHS's Privacy Office and covered by HIPAA BAA. Furthermore, IHS data should not be used as a repository of medical records or sensitive patient details in the normal course of work. If there are specific use cases where IHS wants to analyze clinical text with the contractor, those should be reviewed on a case-by-case basis and covered by the BAA and a proper risk assessment.

• Protecting PII and Privacy: IHS handles various Personally Identifiable

Information (PII). The contractor shall demonstrate the privacy protection for any PII that might be processed.

• Data Use and Purpose Limitation: IHS data is only to provide writing assistance services and for no other purpose. IHS explicitly forbids the offeror from using IHS content for product development or marketing without consent, ensuring compliance with the Privacy Act and other federal privacy laws.

• Data Minimization and Retention: Offeror shall store IHS data only transiently and delete IHS-specific data after a defined retention period (e.g., after the text analysis is returned or within X days). Any logs or stored text containing IHS user content must be purged regularly to reduce the risk of long-term exposure.

If the offeror maintains some user text for audit or troubleshooting, the contract should define limits and require secure storage. IHS could negotiate the right to request deletion of its content from the offeror's systems at any time.

• Sub-processor Transparency: The offeror shall notify IHS within five days of any sub-processors (third-party services) that might handle IHS data (cloud hosting providers) and obtain IHS approval for any new sub-processor.

• Compliance with Privacy Standards: IHS requires the offeror to maintain certifications, ISO 27018, and comply with NIST privacy controls as outlined in NIST SP 800-53 Rev. 5's Appendix J for privacy. The contractor may identify additional privacy standards within their organization that safeguard sensitive data and provide strong privacy controls that would benefit IHS data.

• FISMA Moderate Controls and FedRamp Alignment: As a federal healthcare provider, IHS must comply with FISMA, meaning any system or service it uses should implement security controls commensurate with the sensitivity of the data (often Moderate impact level for PII/PHI).

• Security Control Baseline: The offeror shall enumerate specific controls or families of controls that the offeror will maintain. For example, access controls (NIST AC family) to ensure only authorized personnel can access IHS data;

encryption of data in transit and at rest (NIST SC controls) for any stored content; audit logging (AU controls) of administrative access to IHS data;

incident response processes (IR controls) that align with IHS's requirements for reporting and mitigation, etc. Rather than listing all 300+ controls, IHS can require that the internal security program meet the general NIST SP 800-53 Moderate baseline. The DHS clause on additional security measures for FISMA is a starting point – IHS should formalize it by requiring annual attestation that the offeror meets NIST 800-53 controls for moderate systems.

If the offeror has a security assessment report mapping its SOC 2 or ISO controls to NIST controls, it should be shared with IHS. This ties the vendor's obligations directly to federal cybersecurity standards.

• FedRAMP or Equivalent Assessment: Vendor shall, within 18 months, provide the necessary documentation (e.g., security package) to IHS to assess the service against FedRAMP Moderate requirements, and shall work in good faith toward obtaining a FedRAMP Moderate authorization." IHS requires the contractor to submit an annual SOC 2 Type II report and/or an ISO 27001 certificate to verify controls, as well as the summary results of any penetration tests or vulnerability assessments conducted by the contractor. In the interim, IHS requires the contractor to submit an annual SOC 2 Type II report and/or an ISO 27001 certificate to verify controls, as well as the summary results of any penetration tests or vulnerability assessments conducted by the contractor.

Regular security check-ins or audits can be written into the oversight plan.

• Data Breach Notification and Incident Handling: Per OMB and FISMA guidelines for federal agencies, IHS must be promptly informed of breaches in cloud services. The contractor shall notify the contracting officer representative by voice call and via email within 24 hours of discovering any Security Incident involving IHS data. A security Incident is any breach of security that leads to accidental or unlawful access to or loss of customer data. The contractor shall include written details of the incident, the affected data, and the mitigation steps in that notification. Furthermore, IHS requires the contractor to cooperate with incident response efforts – e.g., allowing IHS to perform an investigation or audit after a significant incident and notifying IHS of any law enforcement or individual inquiries related to IHS data.

• Ongoing Oversight and Compliance Monitoring: The contractor shall provide a report on September 30, of each year of the contract. The report shall demonstrate monitoring to ensure compliance with NIST security controls at levels necessary to safeguard IHS data throughout this contract.

• Reporting and Audit Rights: IHS can reserve the right to audit the offeror's compliance with the contract terms and applicable controls. IHS requires quarterly compliance reports from the contractor’s CISO to IHS's CISO, covering up time, security incidents (if any), and any changes in procedures.

• IHS Points of Contact: Contracting Officer, Javier Medina Velazquez, Javier.Medina-Velazquez@ihs.gov; Contracting Officer Representative, Kevin Fulbright, Kevin.Fulbright@ihs.gov, mobile (301) 526-9652; Security team, ihsdisfedissoteam@ihs.gov; Data Privacy Officer, Tammy Crazy Bull, tammy.crazybull@ihs.gov.

• Training and Rules of Behavior: The contractor shall present a list of training and rules of behavior for their services. IHS shall review it and may adopt it to align with IHS training and Rules of Behavior.

• Contractual Remedies and Penalties: Failure or non-compliance with the terms and conditions outlined in the contract could result in termination of the contract and/or penalties for the total cost of the contract.

• Periodic Review of Terms: If new NIST guidelines and/or HHS regulations (Or FedRAMP when applicable) become available. IHS reserves the right to amend the contract terms and conditions to comply with new guidance and/or regulations.

The software must provide flexibility for user account management, including the ability for IHS administrators to easily add or remove users throughout the duration of the contract without penalty or significant administrative burden.

Quantity

The quantity for the base year is expected to be 600. It is anticipated, but not guaranteed, that the program will add 80 licenses per option year based on license request trends over the past year. Base Year: Quantity 600; Option Year 1: 680, Option Year 2: 760; Option Year 3: 840; Option Year 4: 920.

Line Qty Brand Name Specific:

Part Name Unit Price Total

Base Year

600 GRMLYENT-200