Attachment A. SOO RFP.pdf

Attachment A. SOO, RFP No. 75P00121Q00029 Title: COVID-19 Wastewater Data Testing

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A— Health Resources Priorities and Allocations System.

SECTION 1 – SUPPLIES OR SERVICES/PRICES

1.1 DESCRIPTION/SPECIFICATIONS/ TITLE:

The purpose of this PWS is to outline proposed Contractor support to assist the HHS Office of the Chief Information Officer (OCIO) with leveraging wastewater data to detect trends in COVID-19 cases in the community and including that data in the HHS Protect Program.

1.2 CONTRACT TYPE

This is a Firm Fixed Price type contract.

1.3 SEVERABILITY

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

1.4 COMMERCIAL ITEMS/SERVICES:

The services specified in this task order have been determined to be commercial.

1.5 CONSIDERATION AND PAYMENT (Fixed Price – Severable Services)

Base: Twelve (12) weeks from the date of award (anticipated award date by March 12, 2021)

In consideration of satisfactory performance/delivery of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN. The contract is priced as follows:

CLIN Description QTY/WEEKS Unit Price Extended Price

1 Phase 0 3 $ $ 2 Phase 1 9 $ $

TOTAL FFP $

1.6 DESCRIPTION / STATEMENT OF OBJECTIVES / PERFORMANCE WORK STATEMENT

1.6.1 Background:

Under the direction of the White House Coronavirus Task Force, the Department of Health and Human Services (HHS) and our federal partners are working with state, local, tribal and territorial governments and with the private sector to execute a whole of government response to fight the COVID-19 pandemic and protect the public’s health.

To that end, Departmental leadership and HHS Operating and Staff Divisions are working to obtain sufficient and necessary data to address the needs of this public health emergency. Through the authorities under the Foundations for Evidence-Based Policymaking Act, the HHS CIO/CDO is responsible for ensuring the effective execution of data management practices across our organization.

Data collection and analysis is of the utmost importance in responding to COVID-19 and coordinating efforts to collect that data will accelerate our work to protect the public and lessen the spread and impact of this virus. With the increasing number of cases in the United States and across the globe, it is critical for the United States Government to have access to all available resources to support efforts in the response.

This requirement is a critical and urgently need to support the nation's response to the COVID-19 health emergency. The HHS Protect platform is critical to manage data and information for HHS to the nation, White House task force, and the National Response Coordination Center. The HHS OCIO has a requirement to immediately provide this capability to the various senior decision makers that are providing medical and pharmaceutical related material and services to various locations across the US during this public health emergency.

This HHS Data Sharing platform is critical to the COVID-19 White House Task Force, the HHS response teams, and the inter-governmental COVID-19 teams that are hosted by the FEMA National Response and Coordination Center. In furtherance of this need, the Government is planning to ingest HHS data sets on the HHS COVID-19 Data Sharing Platform, as well as, publicly available data sets, state and local data sets, and private sector data sets. These data are the foundation for the White House’s decision-making and daily public presentations.

The HHS COVID-19 Data Sharing Platform data sets may contain certain sensitive data elements, including residual personally identifiable information that are required in furtherance of these COVID- 19 response efforts therefore data protection is critical. The Government integrates multiple products to the data sharing platform to address issues related to role-based access – what levels of data are needed, how to accomplish secure data transmission, and to ensure awareness of the anticipated level of use and sharing of data provided.

Trends in SARS-CoV-2 concentrations in wastewater have been demonstrated to correlate with trends in new COVID-19 cases reported 4 to 11 days in the future. Wastewater testing data provided by the Contractor will illustrate a more complete picture of local, community-level COVID-19 trends, where clinical cases may be under-reported and transmission levels not well understood. This can be particularly helpful for communities with limited testing access, or for communities in which demand for testing remains low for other reasons. The Contractor will work with HHS to find the best path forward so that testing can have the greatest impact on the overall health of the American populace.

1.6.2 Scope:

The Contractor shall provide additive data and support to the HHS Protect Program by detecting pathogen SARS-CoV- 2 in community wastewater, compiling that data, performing predictive analysis on that data, and securely transferring the derived data into the HHS Protect system in a .csv format that corresponds with the Federal Information Processing Standard Publication (FIPS) code level to link locality. The contractor shall support wide-scale and regular testing of the American population for COVID-19 using wastewater surveillance to help guide reopening and mitigation strategies, and also serve as leading indicator for local re-emergence events to enable rapid containment.

The contractor must recruit and maintain wastewater facilities to perform the services to fulfill all the objectives and requirements of this contract. The Contractor must provide all staff, equipment, supplies, and logistical support to perform all services described in this contract, including but not limited to, identification of sample collection location, and sample analysis. This will include supplying sample collection supplies and shipping materials.

1.6.3 OBJECTIVES:

1.6.3.1 Leveraging wastewater data to predict new COVID-19 cases

1.6.3.1.1 The contractor shall support wide-scale and regular testing of the American population for COVID-19 using wastewater epidemiology to help guide the overall reopening strategy, but also serve as an early warning system for local re-emergence events to enable rapid containment.

1.6.3.1.2 Contractor will provide self-contained sampling kits and shipping materials to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples, greater than or equal to 500 ml.

1.6.3.1.3 Contractor is responsible for maintaining an adequate supply of testing kits to support the continuous flow of testing throughout the contract period.

1.6.3.1.4 The contractor shall recruit and maintain testing with at least 320 wastewater facilities with a ramp up period of 3 weeks.

1.6.3.1.5 The contractor will conduct testing of wastewater samples from the 320 wastewater facilities twice a week producing 640 test results per week.

1.6.3.1.6 The contractor will deliver the test results within 36 hours of receipt of wastewater sample.

1.6.3.1.7 The contractor shall work with communities across all 50 states and territories including federally recognized Indian tribes according to IHS and establish COVID-19 wastewater testing for over at least 100 million people. This testing will serve as an invaluable early warning system to guide local and national strategies controlling the spread of the COVID-19 outbreak

1.6.3.1.8 In order to recruit diversity in wastewater facility participation and include rural, underserved and marginalized communities in this national testing program, an additional goal is to get participation from various size facilities in each state, territory and tribal region – large, medium and small as practicable for each jurisdiction, defined as follows:

o Large: >500,000 population o Medium: 50,000 – 500,000 population o Small: <50,000 population.

1.6.3.2 A national wastewater testing platform for HHS

The contractor shall provide COVID-19 wastewater testing in the United States. This testing will generate qualitative trend data of SARS-CoV-2 concentrations in sewage, providing critical information on how to strategically reopen American cities and the economy, and an early warning for new outbreaks.

Wastewater testing detects increases in new COVID-19 cases 4 to 11 days earlier than clinical case surveillance. Data and analysis provided by the contractor’s wastewater surveillance will illustrate a more complete picture of local, community level COVID-19 trends, where clinical cases may be under-reported, hampering public health response. This can be particularly helpful for communities lacking testing facilities or testing supplies, or for communities in which demand for testing remains low for other reasons. The contractor will work with HHS to find the best path forward so that testing can have the greatest impact on the overall health of the American populace.

1.6.3.3 Testing Criteria

1.6.3.3.1 Contractor runs laboratory analysis to quantify SARS-CoV-2 RNA via reverse transcriptase quantitative polymerase chain reaction (RT-qPCR) or droplet digital polymerase chain reaction (ddPCR). The testing protocol must include measurement of recovery efficiency, matrix inhibition evaluation, and human fecal normalization that meet the requirements for the National Wastewater Surveillance System as described here: https://www.cdc.gov/coronavirus/2019-ncov/cases-updates/wastewater-surveillance/testing-methods.html

1.6.3.3.2 Contractor implements QA/QC measures to ensure the validity of the reported data as described here: https://www.cdc.gov/coronavirus/2019-ncov/cases-updates/wastewater-surveillance/testing-methods.html. Required QA/QC controls include extraction blanks, negative controls, positive controls, standard curves (if using RT-qPCR), and data management policies.

1.6.3.3.3 list of laboratory QA/QC procedures and assay controls that includes definitions and pass/fail criteria

1.6.3.3.4 Contractor generates SARS-CoV-2 sequence data that is appropriate for strain surveillance and submits the raw sequence data and sample metadata to NCBI within 3 weeks of sample receipt by the Contractor. Sequencing methods may include concentration of viruses followed by next generation sequencing or amplicon-based next generation sequencing. Sanger sequencing of amplicons is not appropriate. Sequence analysis shall be conducted on one representative sample (individual or pooled) per week from each participating utility.

1.6.3.4 Data Use

All data generated through this contract are the sole property of HHS. Under no circumstances may Contractor use this data for purposes not explicitly described in this Contract without prior written approval from HHS. Examples of prohibited uses include, but are not limited to, inclusion in research publications, data sharing with other public or private entities, or incorporation into marketing materials.

The Contractor shall report to HHS, both verbally and in writing, any instance in which a sample or any other data obtained in connection with this contract is subpoenaed or becomes the subject of a court or administrative order or other legal process (including a public records request under the Freedom of Information Act). The Contractor shall provide such report to HHS as soon as feasible upon receiving or otherwise becoming aware of the legal process; provided, that the Contractor shall provide such report no later than five (5) business days prior to the applicable response date. If HHS determines that it shall respond directly, the Contractor shall cooperate and assist HHS in its response.

The Contractor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the samples and that prevent use or disclosure of such data other than as provided for by this Contract. As soon as possible, but in any event no later than twenty-four (24) hours after Contractor becomes aware of a misuse or mis-disclosure not permitted under the Contract, the Contractor shall verbally report the Event to HHS with as much of the details as possible, and shall follow such verbal report within three (3) business days with a written report outlining the misuse or mis-disclosure and shall provide any additional information as HHS may reasonably request. The Contractor acknowledges that samples subject to this contract are sensitive, and violations of this section shall be deemed a material breach of the Contract.

1.6.3.5 Facility Monitoring

It is imperative that the contractor monitors the facility with adherence to the testing schedule. The absence of data collection can impair the monitoring of tracking SARS-CoV-2 concentrations in sewage.

This is a voluntary program and a facility may choose to no longer participate or they may not provide the manpower to comply with the testing schedule. The contractor should reach out to a facility when they miss a collection date. If a facility misses an entire week, the contractor should notify the project manager with a written correspondence of the interaction with the facility and whether the testing schedule has been resolved. If a contractor has difficulties reaching the facility after three attempts, the contractor should notify the facility that they are being replaced in the program and the contractor should fill the slot with a new facility. If a facility continues to miss reporting weeks, that facility too should be notified that they are being replaced and the contractor should fill the slot with a new facility.

1.6.3.6 Data Quality

It is imperative that the data received from the contractor is error free. This includes proper file type, proper file format, accurate column headings, consistent data standards, and accurate data. The program manager will notify the contractor if they find data quality issues. The contractor is responsible to isolate and resolve these issues. If the same issue occurs multiple times, the program manager may ask for a corrective action plan to resolve the issues. In the corrective action plan, the contractor will provide a root cause analysis and the steps to be taken to prevent the issue from re-occurring.

1.6.3.7 Contractor Program Management

1.6.3.7.1 The Contractor shall manage their performance to ensure compliance with all requirements of the contract. The Contractor shall assign a Program Manager who will ensure the Contractor’s performance complies with all requirements and will be the primary point of contact for the work to be performed. The Program Manager shall have sufficient corporate authority to direct, execute, and control all elements of the task and ensure that all necessary management, business, contracts, engineering, implementation, and maintenance resources are available and sufficient, both in numbers and qualifications, to successfully perform all the tasks required by the contract.

1.6.3.7.2 The Contractor shall continuously monitor the performance of this contract, and of all subcontracts, to provide the Government with a timely assessment of program progress and problems and to control contract activities to include Subcontractor and/or vendor activities. This should involve the development and execution of a Communication Plan to include the methodology and approach for communicating status, issues, and risks to OCIO through the COR and for communicating with stakeholders outside OCIO

1.6.3.8 Deliverables:

- Kick off Meeting

- Status Report (Weekly)

- Monthly Contract Review Meetings (Frequency: Monthly)

1.6.4 REQUIREMENTS:

1.6.4.1 Phase 0: Rapid ramp-up of testing deployment and establishment of data transfer protocols between Contractor and HHS Protect.

Duration: The contractor must begin to continuously test as soon as possible. Within 2 weeks of contract initiation, Contractor ramp-up to receive and test biweekly wastewater samples from a minimum of 100 facilities. Within 3 weeks, the contractor must be ramped up to 320 wastewater facilities.

1. Establish data reporting format and test data transfer protocols between Contractor and HHS

Protect

2. Leverage existing and prior contractor relationships with wastewater treatment plants to ramp-up and onboard testing to cover at least 320 wastewater treatment plants in a minimum of 47 states or including jurisdictions, US territories and federally recognized Indian tribes, representing at least 100 million people.

Phase 0 Deliverables:

Contractor shall establish data reporting format and test secure data transfer to HHS Protect. The format shall comply with the NWSS-DCIPHER data dictionary which is provided. Any additional fields necessary to comply with reporting shall be appended to the tail of the NWSS-DCIPHER data set. (NWSS-DCIPHER data dictionary is provided as Attachment G to the solicitation)

Contractor shall prepare and host at least two training sessions, no less than 30 minutes/each, for the government and their representatives, covering how to digest and analyze the provided data

Contractor shall provide data collection instrument for required wastewater treatment plant metadata.

o modified NWSS-DCIPHER data dictionary which describes additional fields required for reporting o a current list of participating facilities that are covered by this contract. Whenever there is a change of participating facilities, this file must be updated and delivered to the government.

This shall include:

NPDES_ID (This id is provided in the EPA_Wasterwater_Facilities_clean.xlsx Attachment E to the solicitation)

Facility Name State Population covered o a separate file which describes the area of coverage for the wastewater treatment facility.

This shall include:

NPDES_ID

Facility name FIPS_CD (This code is provided in the FIPS.xlsx Attachment F to the solicitation) State County Served (Each county served is a separate record in this table)

Contractor shall provide thorough documentation and guides for HHS to analyze the data streams

1.6.4.2 Phase 1: Testing and reporting for at least 320 wastewater treatment plants twice per week in a minimum of 47 states including US territories and federally recognized Indian tribes, representing at least 100 million people, including quality assurance and quality control (QA/QC).

Phase 1 Duration: 9 weeks

1. Contractor will provide self-contained sampling kits and shipping materials to participating wastewater facilities for 24-hour composite samples (if capacity available at wastewater facility), or grab samples, greater than or equal to 500 ml.

2. Provide training to wastewater facility staff on proper collection, packaging, and shipping of wastewater samples to the contractor. Sample collection and shipping protocols are provided.

Shipping costs are covered by the contractor.

3. Contractor runs laboratory analysis to quantify SARS-CoV-2 RNA via reverse transcriptase quantitative polymerase chain reaction (RT-qPCR) or droplet digital polymerase chain reaction (ddPCR). The testing protocol must include measurement of recovery efficiency, matrix inhibition evaluation, and human fecal normalization that meet the requirements for the National Wastewater Surveillance System as described here: https://www.cdc.gov/coronavirus/2019-ncov/cases-updates/wastewater-surveillance/testing-methods.html

4. Contractor implements QA/QC measures to ensure the validity of the reported data as described here: https://www.cdc.gov/coronavirus/2019-ncov/cases-updates/wastewater-surveillance/testing-methods.html. Required QA/QC controls include extraction blanks, negative controls, positive controls, standard curves (if using RT-qPCR), and data management policies.

5. Contractor consistently reports data to HHS within 36 hours of sample receipt by the contractor.

6. Contractor provides regular data streams to HHS Protect, at a minimum of 2x/week.

7. Contractor generates SARS-CoV-2 sequence data that is appropriate for strain surveillance and submits the raw sequence data and sample metadata to NCBI within 3 weeks of sample receipt by the Contractor. Sequencing methods may include concentration of viruses followed by next generation sequencing or amplicon-based next generation sequencing. Sanger sequencing of amplicons is not appropriate. Sequence analysis shall be conducted on one representative sample (individual or pooled) per week from each participating utility.

Phase 1 Deliverables:

- Transfer quantitative SARS-CoV-2 data to HHS a minimum of 2x/week.

- Report testing performance including QA/QC, turnaround time, and percent of samples requiring repeat testing.

- Upload sequence data to designated NCBI database within 3 weeks of sample receipt by the

Contractor.

- One additional 30-minute training sessions with the government and their representatives;

- Contractor shall monitor participating facilities to ensure timely transmission of test samples to ensure that:

o The facility adheres to sample collection and delivery methodologies.

o The facility provides viable test samples.

o If a facility is not complying with schedule, the contractor engage the facility to encourage participation o In cases of continued non-compliance or voluntary drop out, the contractor will find a suitable replacement facility to replace previous facility.

o The provider will continue to monitor facility participation to ensure:

At least 47 states are covered At least 3 U.S. Territories are covered At least 3 U.S. tribal Indian facilities are covered The total population covered threshold does not fall below 100 million The total participating facilities does not fall below 320.

- Contractor shall provide corrective action plan when data issues persist. The plan shall include:

o Issue being addressed o Root cause analysis o Corrective action to prevent issue from arising again.

1.6.5 CONTRACTOR PERFORMANCE WORK STATEMENT

The contractor shall provide a Performance Work Statement that fulfills the scope, objectives and all requirements of this contract and the Performance Work Statement will be incorporated as an Attachment to the contract award.

SECTION 2 – DELIVERIES OR PERFORMANCE

2.1 PERIOD OF PERFORMANCE

The period of performance shall be for a base period of twelve (12) weeks from the date of award, with anticipated award date by March 12, 2021, as follows:

Base Period: 12 weeks from date of award

2.2 PLACE OF DELIVERY/PERFORMANCE

Work will be performed at the Contractor’s site, but the contractor is not prohibited from allowing its employees to telework in accordance with the contractor’s policies if the work and required level of performance can be completed successfully in accordance with the contract requirements. The Contractor shall coordinate employee telework or any on-site Government location delivery/support in advance with the Contracting Officer’s Representative.

Delivery information is as follows:

Procurement Name: Wastewater Data Testing Procurement POP:

Technical Point of Contact: TBD POC Email: TBD POC Telephone:

COR: TBD

COR Email: TBD COR Telephone:

Delivery: Via email to COR and Technical POC; 200 Independence Avenue, Washington DC 20001

2.2a PACKAGING AND MARKING

All deliverables shall be delivered to the Contracting Officer’s Representative (COR) identified in Section G and shall be marked as follows:

1. Name and address of the Contractor;

2. Contract Number;

3. Description of item contained therein; and

4. Consignee's name and address.

2.2b. PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information including forms, reports, etc. to the Contracting Officer or COR shall be paid by the Contractor.

2.2.c INSPECTION AND ACCEPTANCE

Pursuant to FAR clause 52.212-4, all work described in Section C to be delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the Contracting Officer’s Representative (COR), who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

Inspection and Acceptance Criteria

Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the place of delivery by the COR.

General Acceptance Criteria

General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Statement of Work.

Accuracy - Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

Clarity - Work Products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements - All work products must satisfy the requirements of this Statement of Work.

File Editing - All text and diagrammatic files shall be editable by the Government.

Format - Work Products shall be submitted in hard copy and electronic copy. The electronic copy must be in a format as indicated in the Deliverables Table.

2.3 PERFORMANCE

Contractor Performance Evaluation:

During the life of this contract, contractor performance will be evaluated on an interim and final basis pursuant to FAR Subpart 42.15. The Contractor Performance Assessment Reporting System (CPARS) will be utilized for these reviews. Information on CPARS can be located at http://www.cpars.gov.

Key Performance Parameters/Quality Management Plan:

The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this contract. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which the contractor assures that their work complies with the requirement of the contract.

This Quality Management Plan (QMP), which contains a Quality Assurance Surveillance Plan (QASP) and Quality Control Plan (QCP), is pursuant to the requirements listed in this contract. This plan sets forth the procedures and guidelines the Government will use in evaluating the technical performance of the selected contractor (“Contractor”) as it performs the services required under the contract.

After initial acceptance of the QMP, the Contractor shall receive in writing the Government Contracting Officer’s (CO) acceptance of any mutually agreed-upon proposed change to the quality control system.

The contractor must incorporate the following Government metrics into the Quality Management Plan.

The contractor may propose additional metrics to align with their approach to fulfill the objectives and requirements of this contract.

Performance Standards:

Task Description Performance Indicator Required Performance

Measurement

Providing data transfers into HHS Protect

Delivery Time Data transfer is completed -without delays or errors – 2x/week

Providing consistently complete data

Accuracy Deliverables require two revisions or less

HHS Protect Support Response Time Respond to all inquiries & requests for assistance within one business day

State Coverage Your CPARs will be graded on how well you cover the desired number of states and proactively keep a consistent coverage

50 to 47 states = CPARS 5 46 to 44 states = CPARS 4 43 to 41 states = CPARS 3 40 to 38 states = CPARS 2 37 to 35 states = CPARS 1 34 or less states = CPARS 0

US Territory Coverage Your CPARS will be graded on how well you cover the desired US territories and proactively keep a consistent coverage

3 + territories = CPARS 5 2 territories = CPARS 4 1 territory = CPARS 3 0 territories = CPARS 0

Tribal Indian Territories Your CPARS will be graded on how well you cover the desired tribal Indian Territories and proactively keep a consistent coverage.

3 + tribal area = CPARS 5 2 tribal areas = CPARS 4 1 tribal area = CPARS 3 0 tribal areas = CPARS 0

Population Coverage Your CPARS will be graded on how well you cover the US population and proactively keep a consistent coverage

100 million + = CPARS 5 99 to 90 million = CPARS 4 89 to 80 million = CPARS 3 79 to 70 million = CPARS 2 69 to 60 million = CPARS 1 59 million or less = CPARS 0

Medium Sized Wastewater Facility Coverage: A facility is considered medium for this purpose, if it covers between

Your CPARS will be graded on how well you can recruit and maintain medium sized facilities in the program

100 + facilities = CPARS 5 99 to 80 facilities = CPARS 4 79 to 70 facilities = CPARS 3 69 to 60 facilities = CPARS 2

50 thousand to 499 thousand people

59 to 50 facilities = CPARS 1 49 or less facilities = CPARS

Small Sized Wastewater Facility Coverage: A facility is considered small for this purpose, if it covers less than 50 thousand people

Your CPARS will be graded on how well you can recruit and maintain small sized facilities in the program

100 + facilities = CPARS 5 99 to 80 facilities = CPARS 4 79 to 70 facilities = CPARS 3 69 to 60 facilities = CPARS 2 59 to 50 facilities = CPARS 1 49 or less facilities = CPARS

Facility Reporting Your CPARS will be graded on how well you monitor and facilitate adequate reporting of the facilities.

Always provided documentation on facilities that have missed a week of reporting and current action plan = CPARS 5 Missed reporting when facilities haven’t reported for a week, 1 to 10 times =

CPARS 4

Missed reporting when facilities haven’t reported for a week, 11 to 20 times =

CPARS 3

Missed reporting when facilities haven’t reported for a week, 21 to 30 times =

CPARS 2

Missed reporting when facilities haven’t reported for a week, 31 to 40 times =

CPARS 1

Missed reporting when facilities haven’t reported for a week greater than 40 times

= CPARS 0

Contractor shall establish and maintain good data quality standards when reporting

For repetitive data quality issues, the program manager may ask the contractor to provide and action plan to correct the issue, providing a root cause analysis and steps taken to prevent the issue.

0 requested action plans =

CPARS 5

1 requested action plan =

CPARS 4

2 requested action plans =

CPARS 3

3 requested action plans =

CPARS 2

4 requested action plans =

CPARS 1

More than 4 requested action plans = CPARS 0

2.3 NOTICE TO THE GOVERNMENT OF DELAYS

In the event the Contractor encounters difficulty in meeting performance requirements, or when the Contractor anticipates difficulty in complying with the contract delivery schedule or completion date, or whenever the Contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the Contractor shall immediately notify the Contracting Officer, the Contracting Officer’s Representative and the Program Management Office, in writing, giving pertinent details. This data shall be informational only in character and this provision shall not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this task order.

SECTION 3 - Contract Administration Data

3.1 AUTHORITIES OF GOVERNMENT PERSONNEL

Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of this contract will require maximum coordination between the Government and the Contractor. The following individuals will be the Government's points of contact during the performance of this contract:

Contracting Officer Name: Jennifer Browning Email: jennifer.browning@hhs.gov

Contracting Officer's Representative Name: TBD Address: 200 Independence Ave, S.W., Washington DC 20201 Email: TBD

Note: The Contracting Officer is the only individual authorized to modify the contract.

3.2 CONTRACTING OFFICER’S REPRESENTATIVE (COR) AUTHORITY

(a) Performance of work under this contract must be subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing. The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(b) Technical direction must be within the scope of the specification(s)/work statement.

The Contracting Officer's Representative does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

(2) Constitutes a change as defined in the clause entitled "Changes";

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

(d) The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officers, Representative. If, in the opinion of the contractor, any direction of the Contracting Officers, Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

3.3 INVOICE SUBMISSION

(1) Invoice Submission

The contractor shall submit invoices under this contract once per month. Invoices shall be submitted in accordance with the contract terms.

A proper invoice, with all required back-up documentation shall be sent electronically, via email, to:

1) Contracting Officer's Representative (COR): TBD

2) Contracting Officer: Jennifer.browning@hhs.gov

3) Contract Specialist: Lashawn.Haggins@hhs.gov

4) Financial Management Services: psc_invoices@psc.hhs.gov

5) Acquisition Management Services: pscsas.invoices@psc.hhs.gov

The subject line of the invoice submission email shall contain the contract number, order number (if applicable), and the number of invoices contained within. Each invoice shall be submitted as a single file, limited in size to 25MB, which includes all required back-up documentation based on the contract type. In the event an invoice file exceeds the size limitation, the contractor shall contact the Contracting Officer to provide all required supporting documentation. The email may have multiple invoices for the contract. Invoices must be in the following formats: PDF, TIFF, or Word. No Excel formats will be accepted. The electronic file cannot contain multiple invoices; example, 10 invoices requires 10 separate files.

(2) Invoice Elements

Invoices must include all elements required by FAR 52.212-4(g). The contractor is required to include electronic funds transfer (EFT) banking information. In accordance with the requirements of the Debt Collection Improvement Act of 1996, all payments under this contract will be made by electronic funds transfer (EFT). The Contractor shall provide financial institution information to the Finance Office designated above in accordance with FAR 52.232-33 Payment by Electronic Funds Transfer - System for Award Management.

Additionally, the Program Support Center (PSC) requires:

(i) Invoices must break-out price/cost by contract line item number (CLIN) as specified in the pricing section of the contract.

(ii) Invoices must include the Dun & Bradstreet Number (DUNS) of the Contractor.

(iii) Invoices that include time and materials or labor hours CLINS must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

3) Prompt Payment Act

Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR Part 1315.

SECTION 4 - Special Contract Requirements

4.1 KEY PERSONNEL

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances.

The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The Government does not currently identify any key personnel. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

4.2 HHS PRIVACY AND SECURITY REQUIREMENTS

Contractor must comply with or receive an applicable waiver for all HHS-OCIO security, privacy, and section 508 requirements.

Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS) if so required.

Service Level Agreements. The Contractor shall understand the terms of the service agreements that define the legal relationships between cloud customers and cloud providers and work with OPS to develop and maintain an SLA.

Interconnection Agreements/Memorandum of Agreements. The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of Agreements/Understanding in accordance with HHS/OS policies.

4.3 REQUIREMENTS FOR CLOUD SERVICES

HHS Privacy and Security Requirements

The Contractor (and/or any subcontractor) shall be responsible for the following privacy and security requirements:

HHS Compliant ATO. As applicable, since HHS Protect Data Sharing Platform relies upon an existing moderate HHS compliant solution – Oracle Federal Managed Cloud Services. The contractor shall comply with HHS Security Assessment and Authorization (SA&A) requirements and to ensure the information system/service under this contract maintains a valid HHS compliant (approved) authority to operate (ATO) in accordance with Federal Information Processing Standard (FIPS) Publication 199 defined security categorization.

a) Implement applicable baseline controls commensurate with the agency-defined security categorization and the applicable security control baseline. The HHS Information Security and Privacy Policy (IS2P) a Outlines controls identified by the agency.

b) A security control assessment must be conducted by an HHS third-party assessment organization for the initial ATO and annually thereafter or whenever there is a significant change to the system’s security posture in accordance with the application’s Continuous Monitoring Plan.

1. Data Jurisdiction. The contractor shall store all information within the security authorization boundary, data at rest or data backup, within the continental United States (CONUS).

2. Interconnection Agreements/Memorandum of Agreements. The Contractor shall establish and maintain Interconnection Agreements and or Memorandum of Agreements/Understanding in accordance with HHS policies.

4.4 PROTECTION OF INFORMATION IN A CLOUD ENVIRONMENT

1) If contractor (and/or any subcontractor) personnel must remove any information from the primary work area, they shall protect it to the same extent they would the proprietary data and/or company trade secrets and in accordance with HHS policies.

2) HHS will retain unrestricted rights to federal data handled under this contract. Specifically, HHS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of HHS and hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data must be available to HHS within one (1) business day from request date or within the timeframe specified otherwise. In addition, the data shall be provided at no additional cost to HHS.

3) The Contractor (and/or any subcontractor) shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with HHS requirements and policies.

4) The contractor shall support a system of records in accordance with NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to the following:

a. Maintenance of links between records and metadata, and

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

5) The disposition of all HHS data shall be at the written direction of HHS. This may include documents returned to HHS control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

6) If the system involves the design, development, or operation of a system of records on individuals, the Contractor shall comply with the Privacy Act requirements.

A. Security Assessment and Authorization (SA&A) Process

1) The Contractor (and/or any subcontractor) shall comply with HHS requirements as mandated by federal laws, regulations, and HHS policies, including making available any documentation, physical access, and logical access needed to support the SA&A requirement. The level of effort for the SA&A is based on the system’s FIPS 199 security categorization and HHS security policies.

a. The contractor shall complete and maintain an agency SA&A package to obtain agency ATO prior to system deployment/service implementation. The agency ATO must be approved by the HHS authorizing official (AO) prior to implementation of system and/or service being acquired.

2) HHS reserves the right to perform penetration testing (pen testing) on all systems operated on behalf of agency. If HHS exercises this right, the Contractor (and/or any subcontractor) shall allow HHS employees (and/or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with HHS requirements.

Review activities include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

3) The Contractor must identify any gaps between required HHS Security Control Baseline/Continuous Monitoring controls and the contractor’s implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts. In addition, all gaps shall be documented and tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require remediation at the contractor’s expense, before HHS issues an ATO.

4) The Contractor (and/or any subcontractor) shall mitigate security risks for which they are responsible, including those identified during SA&A and continuous monitoring activities. All vulnerabilities and other risk findings shall be remediated by the prescribed timelines from discovery: (1) critical vulnerabilities no later than thirty (30) days and (2) high, medium and low vulnerabilities no later than sixty (60) days. In the event of a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they shall be added to the designated POA&M and mitigated within the newly designated timelines. HHS will determine the risk rating of vulnerabilities using HHS baselines.

5) Revocation of a Cloud Service. HHS has the right to take action in response to the CSP’s lack of compliance and/or increased level of risk. In the event the CSP fails to meet HHS security and privacy requirements and/or there is an incident involving sensitive information, HHS and may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the CO and/or COR may direct the CSP to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor information system under this contract.

Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

B. Reporting and Continuous Monitoring

1) Following the initial ATOs, the CSP (and/or any subcontractor) must perform the minimum ongoing continuous monitoring activities specified below, submit required deliverables by the specified due dates, and meet with the system/service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities.

2) At a minimum, the CSP Contractor must provide the following artifacts/deliverables on a monthly basis

a. Operating system, database, Web application, and network vulnerability scan results;

b. Updated POA&Ms;

c. Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the System Owner or AO; and

d. Any configuration changes to the system and/or system components or CSP’s cloud environment that may impact HHS’s security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency.

C. Configuration Baseline

1) The contractor and CSP shall certify that applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB), DISA Security Technical Implementation Guides (STIGs), Center for Information Security (CIS) Security Benchmarks or any other HHS-identified configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved HHS Protect Platform configuration baseline.

2) The CSP contractor shall use Security Content Automation Protocol (SCAP) validated tools with configuration baseline scanner capability to certify their products operate correctly with HHS and NIST defined configurations and do not alter these settings.

D. Incident Reporting

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving

PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send HHS Protect Platform ISSO and Protect Data Sharing Platform COR approved notifications to affected individuals.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the HHS Incident Response Team (IRT), COR, CO, Protect Data Sharing Platform SOP (or his or her designee), and…