Attachment A - IDIQ SOW.pdf

The CBER Biologics Effectiveness and Safety (BEST) Community Engagement and Development Initiative (CEDI)

IDIQ Statement of Work (SOW) : June 10,2020

Table of Contents

1. Introduction

1.1 Background

1.2 (BEST) Community Engagement and Development Initiative Objectives and Scope

1.3 Objectives

1.4 Scope

2. Tasks Description

2.1 Task 1: The Community Engagement and Development Coordination Center (CED-CC)

2.1.1. Establish the CED-CC

2.2 Task 2: Meetings and Workshops

2.2.1 Develop, Coordinate, Host and convene meetings or workshops

2.2.2 Meeting Summaries, Draft publications or White Papers

2.2.3 Meeting Types and Topics

2.3 Task 3: Methods Development in Epidemiological, Informatics and related areas

2.3.1 Coordinate and/or conduct methods development in epidemiological, informatics and related areas 5

2.3.2 Draft Methods Publications

2.4. Task 4: Training, Outreach and Engagement

2.4.1. Conduct Training for FDA Staff on BEST

2.4.2. Conduct Outreach and Engagement of the BEST User, Stakeholder and research communities . 6

2.5. Task 5: Management Plan

2.5.1 Establish Project-Specific Protocols and Procedures

2.5.2 Organization and Management Procedures

2.5.3 Risk Management

2.6 Task 6: Outreach and Communications

2.6.1 Publications and Postings

2.7 Task 7: Transition Services

2.7.1 Transition-out

2.8 Representative Deliverables & Meetings

2.8.1 Delivery Instructions for Deliverables

3. Contract Constraints

3.1 Security and Privacy

3.1.1 Baseline Security Requirements

4. Other Requirements

4.1 Key Personnel

4.2 Government-Furnished-Information(GFI)/Government Furnished Equipment (GFE)

4.3 Travel

4.4 Administration

4.4.1 Period of performance

4.4.2 Place of Performance

4.4.3 Government Points of Contact (POCs)

5. Labor Category Descriptions

1. INTRODUCTION

1.1 BACKGROUND

The U.S. Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biologic products, medical devices, tobacco products, our nation’s food supply, cosmetics and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make medicines, devices, products, and foods more effective, safer, and more affordable; and helping the public get the accurate, science-based information they need to use medicines and foods to improve their health. As part of its mission, the FDA conducts monitoring of the safety of regulated products.

CBER regulates biologics which include vaccines, whole and blood components, blood products, tissues and advanced therapeutics. Some examples of blood products include all plasma-derived products such as immunoglobulins, coagulation products, fibrinogen concentrate and fibrin sealants. Some of the products in the category of tissues and advanced therapeutics include but are not limited to: acellular dermal matrix allografts, cornea transplants, allograft heart valves and cardiac conduits, amniotic membrane transplants, cellular therapies, gene therapies and fertility-related donations such as oocytes and sperm.

In September 2017, CBER launched the Biologics Effectiveness and Safety (BEST) initiative, an expansion of the CBER Sentinel System, to specifically address the unique characteristics of CBER-regulated biologic products. BEST is an active surveillance and evidence generation system that can support commitments of the Prescription Drug User Fee Act VI and 21st Century Cures Act of 2016. Two primary goals of BEST were 1) to develop a pilot system using electronic health records (EHR),some claims data sources, methods and tools to rapidly conduct queries, epidemiological studies and surveillance of biologics; and

2) to use innovative approaches such as artificial intelligence and natural language processing to automate adverse event reporting by detecting and mining biologic product adverse events in EHRs for use in populating individual case safety reporting forms for submission to the FDA. CBER awarded contracts aligned with the two primary goals and continues efforts to develop and expand its growing network of biologics active postmarket risk identification and analysis systems by using new data sources, enhanced capabilities and innovative approaches with the goal of providing deliverables in a more cost-effective, efficient, and timely manner.

This request seeks to provide FDA with the support of one or more organizations or entities to serve in a convening role to work collaboratively with FDA staff to plan, develop, coordinate, host and convene meetings or workshops. This effort shall require conducting training and outreach to share information and educate FDA staff and external stakeholders on the BEST infrastructure, capabilities and applications that serve FDA and stakeholder needs, to the extent possible. The proposed FDA work may be conducted or coordinated under a number of possible organizational structures and arrangements. The convener may be an academic or similar organization and have their own business staff and subject matter experts such as epidemiologists, bioinformaticians, clinical experts, programmers and others who are experienced in conducting safety and effectiveness studies for drugs and biologics as well as related areas such as statistics, clinical studies, supercomputing, artificial intelligence, natural language processing, machine learning, modeling, patient input sciences, benefit-risk assessment, etc.

1.2 (BEST) COMMUNITY ENGAGEMENT AND DEVELOPMENT INITIATIVE OBJECTIVES AND SCOPE

The primary goal of this Contract is to provide FDA with the support of a convener organization to work collaboratively with FDA staff to convene meetings or workshops; coordinate or conduct methods development activities; conduct training and outreach to educate FDA staff and external stakeholders on the CBER BEST system. This work promotes OBE’s mission to assure the safety and effectiveness of biologic products including vaccines, blood and blood products, tissues and advanced therapeutics. This work complements and supports other previous and current BEST sponsored activities to evaluate product safety and effectiveness and the use of innovative methods to potentially automate adverse event reporting for some biologic product areas.

1.3 OBJECTIVES

The objectives of this contract are for the convener contractor to:

1. To establish a Community Engagement and Development Coordination Center (CED-CC).

2. To develop, coordinate, host and convene meetings or workshops.

3. To coordinate and/or conduct methods development in epidemiological, informatics and related areas.

4. To conduct training, development, outreach and engagement of the BEST user and research communities and FDA staff.

1.4 SCOPE

The Contractor shall, independently and not as an agent of the Government, provide all necessary resources and personnel to provide convener support for the CBER BEST program. The scope of this program is the following:

1. Contractor shall work in collaboration with FDA.

2. Biologic products consist of vaccines, blood and blood products, tissues and advanced therapeutics.

3. The types of meetings or workshops that may be convened include but are not limited to public meetings or workshops; BEST contractors and Principal Investigators meetings; technical workshops; biologic product area-based workshops; issue-based meetings or workshops (e.g., real-world data, real-world evidence, etc; and others related to the CBER science-based public health mission.

4. Contractor shall have links and relationships with a large community of researchers (from more than 100 institutions) in pharmacoepidemiology, informatics and relevant areas representing academia and similar national and international organizations.

5. Methods development or coordination thereof includes areas such epidemiology, informatics, statistical and related areas and applied to claims data or electronic health records.

6. Training may include but not be limited to sessions for FDA staff including introductory sessions and more technical sessions.

7. Training sessions will be conducted for external stakeholders

8. Certain materials generated for sharing outside of FDA with external stakeholders may be posted on FDA websites and webpages.

9. The contractor shall collaborate with other BEST vendors and/or partners to accurately represent the BEST program and its partners.

2. TASKS DESCRIPTION

The following tasks constitute the performance of work expectations for the BEST program support.

2.1 TASK 1: THE COMMUNITY ENGAGEMENT AND DEVELOPMENT COORDINATION CENTER

(CEDCC)

The support of the BEST system for conducting safety and effectiveness surveillance of biologic products and development of new innovative methods shall require the contractor to establish a CEDCC. The purpose of the CEDCC is to coordinate potentially numerous and diverse set of activities and community/relationship development efforts with potential stakeholders and BEST user communities.

2.1.1. ESTABLISH THE CEDCC

The Contractor shall establish the CEDCC with an appropriate governance structure including an Executive Committee of contractor appointees to provide leadership have their own business staff and subject matter experts such as epidemiologists, bioinformaticians, clinical experts, programmers and others who are experienced in conducting safety and effectiveness studies for drugs and biologics as well as related areas such as statistics, clinical studies, supercomputing, artificial intelligence, patient input sciences, benefit-risk assessment, etc. The Contractor shall work collaboratively with the FDA CBER Office of Biostatistics & Epidemiology leadership team, the CBER Sentinel Team and FDA Staff as well as the other BEST Contractor Leadership Teams and Staff to complete the contract tasks, business requirements and deliverables.

2.2 TASK 2: MEETINGS AND WORKSHOPS

A major objective of this contract is for CBER to obtain contractor support to develop, coordinate and convene meetings or workshops. In some cases, CBER may provide funds or co-sponsor funding through this contract to public meetings, especially those hosted by academic or research organizations and/or where there is no apparent or perceived conflict of interest. FDA CBER may require that its name be in the title of the meeting or workshop.

2.2.1 DEVELOP, COORDINATE, HOST AND CONVENE MEETINGS OR WORKSHOPS

The contractor shall develop content and framing of relevant discussion topics and items for meetings, including a meeting backgrounder document, and lead development of the agenda, meeting content and identify and secure speakers and presenters. The contractor shall serve as overall meeting coordinator, moderator and provide one or more presentations and convene three to six meetings a year with meeting sizes expected to range from 75 (small meeting) to up to about 250 participants (large meeting).

The Contractor shall provide meeting resources including venue rental, audio-visual and webcasting support, research and development costs, supplies, administrative support, registration, as well as travel costs for out of town speakers and certain meeting participants and other miscellaneous items.

2.2.2 MEETING SUMMARIES, DRAFT PUBLICATIONS OR WHITE PAPERS

The contractor shall lead the effort to generate a draft summary of the meeting or workshop and provide a draft manuscript, white paper or similar document suitable for publication or FDA website posting. FDA staff would be expected to contribute to generated documents (which may require an FDA disclaimer) and all documents must be submitted and cleared through the FDA Clearance process prior to journal submission, external review, public posting or disclosure.

2.2.3 MEETING TYPES AND TOPICS

The contractor shall convene meetings or workshops to support BEST and related CBER programs that meet FDA needs and provide value to stakeholders including patients and the public. These may include but are not limited to smaller meetings; public meetings or workshops; BEST contractors and Principal Investigators meetings; technical workshops; biologic product area-based workshops; issue-based meetings or workshops (e.g., real-world data, real-world evidence, etc; and others related to the CBER science-based public health mission. These meetings may include but are not limited to any of the following:

Annual BEST Meeting: A public meeting that assembles FDA staff, BEST Contractors, other government agencies and stakeholders from the public sector, private sector, academia, researchers, patients and patient advocates, and the public.

BEST Contractors In-person Meeting: Participants will be limited to FDA contractors and collaborating organizations, other government and invited participants.

Below are additional topics for possible, general meeting and workshop topic areas:

CBER-regulated product areas: A public assembly with participation from specific regulated biologic product stakeholders and communities including manufacturers, academia, researchers, patients, and others.

Methods development topics: Focused presentations and discussions on methods development topic areas including but not limited to epidemiological, informatics, statistical and others to support BEST and related CBER programs.

Technology topics: Potential discussions of artificial intelligence, machine learning, natural language processing, supercomputing, computational sciences, next generation sequencing, modeling, systems biology and others.

Issue-based topics: Topics may range from real-world data, real-world evidence, RWD and RWE-generation, digital technologies, patient input science, clinical trial design, benefit-risk assessment, observational study design, and others.

2.3 TASK 3: METHODS DEVELOPMENT IN EPIDEMIOLOGICAL, INFORMATICS AND RELATED AREAS

The Contractor shall engage the broader research and stakeholder community (or the “community”), and CBER Staff in methods development to advance the development of BEST to address regulatory questions and stakeholder needs, to the extent possible. This effort combines many activities of this contract that the Contractor shall coordinate including identifying and engaging the community of researchers and stakeholders, conducting workshops and meetings to identify areas of mutual interest and need with FDA and the community, and moving towards continual improvement and building of the BEST system methods, tools and infrastructure to advance the scientific field and address common areas of need and interest.

2.3.1 COORDINATE AND/OR CONDUCT METHODS DEVELOPMENT IN EPIDEMIOLOGICAL, INFORMATICS

AND RELATED AREAS

The Contractor shall work collaboratively with FDA to identify methods development activities and projects in areas including but not limited to the following:

Possible epidemiological methods development areas may include: causal inference, prediction modeling, signal detection, confounding, bias, adjustment and weighting methods, statistical methods in distributed networks, quantitative bias, generating phenotype and cohorts, and others.

Possible informatics methods development areas include: Establish temporality between events, observation periods for study populations, interoperability, application of artificial intelligence, machine learning and/or natural language processing, vocabulary and mappings, Use of Fast Healthcare Interoperability Resources (FHIR) and bulk FHIR, and others.

2.3.2 DRAFT METHODS PUBLICATIONS

The contractor shall lead the effort to generate draft manuscripts, white papers or similar documents suitable for publication or FDA website posting for each project or activity. Authorship shall be agreed upon mutually with the FDA. FDA staff would be expected to contribute to generated documents (which may require an FDA disclaimer) and all documents must be submitted and cleared through the FDA Clearance process prior to journal submission, external review, public posting or disclosure.

2.4. TASK 4: TRAINING, OUTREACH AND ENGAGEMENT

The Contractor shall Conduct Training, Outreach and Engagement of FDA staff and the BEST stakeholder community to improve and advance BEST as a system that meets the needs of FDA and the community, to the extent possible. This includes training and development of FDA Staff throughout the contract period. The contractor shall conduct outreach and engagement of the future BEST user and research communities, first through identification, characterization; gathering of stakeholder input and information through methods including but not limited to interviews, surveys, meetings and workshops;

and then recommend approaches for the contractor and FDA to engage the stakeholder community and foster and encourage use of the BEST infrastructure for safety and effectiveness evaluations and surveillance, real-world evidence generation and other related activities. The contractor shall develop training for stakeholders and the research community range from a high-level presentation of concepts to more technical sessions for epidemiologists, clinicians, informaticists, and scientists from related life and health sciences areas and specialties.

The contractor shall provide most of the training sessions in the DC, Maryland and Virginia (DMV) area for FDA staff and the community in-person, to maximize interactions among participant. However, some training sessions may be conducted in other locations outside of the DMV area or as part of scientific, society, association meetings or large public meetings. The contractor may use seminars, webinars or other media-based approaches to conduct training as well. FDA may require that training sessions be posted on its public website to promote broader dissemination of the information and perhaps further encourage use of the BEST infrastructure as a resource for use by the community.

2.4.1. CONDUCT TRAINING FOR FDA STAFF ON BEST

The contractor shall conduct and/or coordinate training of FDA staff on aspects of the BEST system including the data, data characterization, tools, methods, approaches to conducting research and applications of BEST for conducting evaluations of CBER-regulated product safety and effectiveness studies, surveillance, and methods development. The contractor shall work with the CBER Sentinel Team to understand the training needs for CBER staff. Training shall be targeted to different groups of staff who may vary in their knowledge and understanding of areas such as active surveillance, epidemiological knowledge and the BEST system so training sessions should range from introductory sessions to more technical sessions. The size of FDA/CBER staff training sessions will vary for instance a general introductory session may be large have up to 75 or more participants, while more technical sessions may be smaller and have only approximately 20 participants.

2.4.2. CONDUCT OUTREACH AND ENGAGEMENT OF THE BEST USER, STAKEHOLDER AND RESEARCH

COMMUNITIES

The contractor shall identify and describe the community of stakeholders and potential users of the BEST infrastructure, their needs and how they may use the BEST system. The contractor shall gather and elicit information from the community (through discussions, interviews, meetings and workshops) on best approaches to improve the BEST system and infrastructure to better support FDA and the community;

this effort may be undertaken during the second year of the contract and may take one year to complete.

The Contractor shall identify potential projects or areas of mutual work for the stakeholder community and FDA. The contractor shall generate a report of the findings of these activities and provide recommendations of the strategies and approaches that FDA and the Contractor may use to engage the community and encourage use of BEST.

Training may range from introductory sessions providing a general overview of BEST and the BEST infrastructure and potential uses and applications to more technical training to epidemiologists, informaticians and others working regularly with BEST on the infrastructure as well as more in-depth methods, cohort and phenotype identification, complex study designs, and applied sessions.

As part of the contract and task orders FDA may provide funding for a Training Fellowship Program for Fellows to address regulatory questions relevant to FDA CBER products including methods, issues and product related topic areas. This is another area of outreach, training and development and another area where FDA and the stakeholder and research community can work jointly on projects of potentially mutual interest.

2.5. TASK 5: MANAGEMENT PLAN

The contractor shall develop a Management Plan (MP) including a manual of policies and procedures (MOPP), that outlines practices, policies and processes for the administration, day-to-day operations, handling conflicts of interest, handling of contractor-to-contractor collaborations, and interactions with stakeholders including but not limited to other BEST or FDA Contractors, researchers, manufacturers, and other stakeholder communities.

As part of the MP the Contractor shall deliver a Task Order (TO) Management Plan. The TO Management Plan (TOMP) shall include a Work Breakdown Structure (WBS), which shall contain all of the work elements described in the Task Order. The WBS elements shall also illustrate the sequence, timeline, and resources required for each work package. Additionally, the TOMP shall include a schedule that details activities; dependencies and timeframes for meeting FDA objectives and deliverables; and an organizational chart identifying relationships, authorities, and responsibilities. The TOMP shall include a description of the management controls that the Contractor shall employ to meet the performance, cost, and schedule requirements; and other areas the Contractor deems relevant and important to the management of the Task Order. The Contractor shall ensure that activities are coordinated across task orders, if applicable, to promote cohesiveness among contracted activities.

The TOMP shall address all the action items from any Kickoff Meetings and other follow-on meetings, as appropriate. The Contactor shall update the TOMP when re-planning any activities. Changes to the TOMP are subject to approval of the COR.

The contractor shall devise a plan for the governance of the program that will include governance structure, relationships and responsibilities, policies and procedures that will be followed by all the parties involved in terms of governing the program.

2.5.1 ESTABLISH PROJECT-SPECIFIC PROTOCOLS AND PROCEDURES

The Contractor shall work collaboratively with the FDA to develop and finalize the BEST project plans and the Management Plan (MP), and update components as needed to reflect the individual task order (ITO) activities. The Contractor shall work with the FDA to identify and meet all required review, approval and standard processes that comply with all relevant institutional, federal, state, and local laws and regulations to conduct the work such as Institutional Review Boards (IRB), data and information technology security such as Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA) and any others identified in the ITO. These procedures (i.e. the MP) shall address at a minimum the following: information collection, handling, sharing, ownership, and security; management and tracking, consensus definitions, transfer, and sharing considerations for summaries.

2.5.2 ORGANIZATION AND MANAGEMENT PROCEDURES

The contractor shall schedule and facilitate (to include notes, minutes, action items) meetings with FDA CBER personnel to ensure smooth operations. These meetings shall include administrative and budgetary telecons monthly telecons for executives/leaders of the contract and FDA CBER, as well as workgroup meetings for specific task orders every two weeks. The contractor will prepare and submit monthly progress and financial reports.

2.5.3 RISK MANAGEMENT

The Contractor shall identify and report for resolution to the Government any issues that prevent the Contractor from performing the work in any Task Order that the Contractor is unable to resolve independently. For each Task Order, the Contractor shall document and report the risks and opportunities within a risk registry. The Contractor shall maintain the risk registry and provide it to the COR on a monthly basis.

The risk registry shall contain, at a minimum, unless otherwise specified in the ITOs:

• Issue Number: a sequential numbering of all issues;

• Severity: assessment of issue severity i.e., likelihood and consequences (High/Medium/Low)

• Date Found: – date that issue was identified by the Contractor;

• Duration: number of days that issue has been open;

• Status: representing issue status as open or closed. The Contractor shall maintain a complete list of all issues – no issues typically should be deleted from the Contractor’s delivered list;

• Title: short description of issue;

• Updated: date for updated status;

• Details: narrative description of activities that have been completed to resolve issue;

• Assigned To: identify Government POC or Contractor that is assigned to resolve the issue;

• Solution or Workaround: description of the actions and activities taken to resolve or mitigate issue the issue.

2.6 TASK 6: OUTREACH AND COMMUNICATIONS

The contractor shall ensure ongoing communication and reporting to FDA. This includes the tracking, reporting, and outreach as necessary.

2.6.1 PUBLICATIONS AND POSTINGS

The contractor shall provide drafts of reports, presentation materials (e.g., presentation slides and posters), and manuscripts. In addition, the contractor shall share summary data findings and interpretation of findings in the context of the data and tools used. Details of the collaboration will be determined on a task order basis.

Reports and final reports, and final work products will be posted to a web-based resource library after clearance by FDA, the prime contractor, and subcontractors. The Parties agree this is a multi-site program and any publications as a result of studies shall be a multi-site publication coordinated by the prime contractor, subcontractors, FDA/CBER/OBE, and other involved sites. Authorship and other matters relating to publications shall be determined at the task order level. FDA may require outreach, training materials, and any other documents and deliverables to be posted on its web pages in the spirit of transparency and community building.

Representative deliverables for this task include, but are not limited to:

• Deliver well-written and formatted briefings, reports, presentation materials, abstracts and manuscripts

• Deliver a user-friendly secure portal with graphical interface for conducting day-to-day executive

• Communications related to the task.

2.7 TASK 7: TRANSITION SERVICES Transition activities take place to efficiently transition all activities from the incumbent Contractor to the new IDIQ Contractor. As tasked, the Contractor shall be required to develop transition-out plans and conduct transition activities for task orders issued against this IDIQ vehicle.

2.7.1 TRANSITION-OUT

The Contractor shall facilitate the transition-out of contracted activities and services to the Federal Government or, to a follow-on Contractor by the end of the contract period of performance.

The Contractor shall provide support for transition-out activities. During this period, the Contractor shall ensure no degradation in support provided under the task order. Between the turnover date designated by the COR and the end of the contract period of performance, the outgoing Contractor shall ensure all task order activities are closed out and provide sustainment support to complete the transition.

Representative deliverables include, but are not limited to:

• Developing and submitting a Transition-Out Plan and Schedule to the COR

• Providing the FDA with current versions of all documentation developed (i.e. Standard

Operating Procedures and Manual of Operations)

• Providing the FDA with a current inventory of all Government-Furnished Equipment (GFE) and Government Furnished Information (GFI) utilized by the Contractor along with full support in the reconciliation of this inventory

• Providing the follow-on contractor with the ability to “shadow” and participate in technical exchange meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

2.8 REPRESENTATIVE DELIVERABLES & MEETINGS

Five (5) Year Ordering Period

Item No.

Description of Supplies/Service SOW Section

Quantity Delivery Date

1. Establish and maintain a Coordinating Center (CC)

2.1 1 Within 8 weeks of award and throughout the Period of Performance

2. Kick Off Meeting N/A 1 Within 2 weeks of award

3. Develop, coordinate, host and convene meetings and workshops

2.2.1 5-8 per year Throughout the Period of Performance

4. Generate a draft summary of the meeting or workshop and provide a draft manuscript, white paper or similar document suitable for publication or FDA website posting.

2.2.2 5-8 per year

Throughout the Period of Performance

5. Identify methods development activities and projects in epidemiological, informatics and related areas

2.3 1-4 per year

Throughout the Period of Performance

6. Provide Training Sessions for FDA staff

2.4 2-4 per year

Throughout the Period of Performance

7. Develop and Implement a program Management Plan (MP)

2.5 1 Deliver draft within 4 weeks of award and implement throughout the Period of Performance

8. Identify and report for resolution to the Government any issues that prevent the Contractor from performing the work in any Task Order that the Contractor is unable to resolve independently. For each Task Order, the Contractor shall document and report the risks and opportunities within a risk registry.

The Contractor shall maintain the risk registry and provide it to the COR on a monthly basis.

2.5.3 1 Develop within 4 weeks of award and implement throughout the Period of Performance

9. Deliver well-written and formatted briefings, reports, presentation materials, abstracts and manuscripts. Deliver a user-friendly secure portal with graphical interface for conducting day-to-day executive. Prepare communications related to the task

2.6.1 Throughout the Period of

Performance Throughout the Period of Performance

10. Assemble Staff Organizational Units

2.5 1 Assemble within 8 weeks of award and convene through the Period of Performance

11. Schedule and execute routine meetings

• Telecons: monthly executive/leadership, bi-weekly administrative, and weekly scientific workgroup

• Face-to-face: quarterly

2.5.2 1 Develop schedule within 8 weeks of award and convene through the Period of Performance

12. Prepare monthly progress and financial reports

2.5.2 4 Prepare at the end of each month for the Period of Performance

13. Identify and Create Administrative Templates

• Identify needed templates

• Draft templates

• Finalize templates

2.3 2 Develop 1st draft of templates within 24 weeks of award and final version of templates within 36 weeks of award

14. Prepare a Transition-Out Plan and Schedule

2.7 1 Prepare 4 months prior to the end of Period of Performance

2.8.1 DELIVERY INSTRUCTIONS FOR DELIVERABLES

Unless otherwise specified, all deliverables, reports or copies of reports shall be delivered to the COR via email. The monthly progress and financial reports shall also be submitted to the Contracting Officer and/or Contract Specialist assigned to the contract. Requirements for inspection and acceptance are as follows:

• The COR or the POC designated in each TO, will inspect and accept the services provided to ensure they meet the requirements detailed in the relevant IDIQ task order.

• The Government will accept products and services only if they conform to all terms and conditions of the contract statement of work and each TO.

• The Government will provide written notification of acceptance or rejection within ten (10) calendar days of receiving the service.

• The Government will reject non-conforming products and services. The Contractor shall correct any deficiencies within thirty (30) calendar days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within ten (10) calendar days.

In addition, the Contractor shall be proactive in informing the designated CBER COR of any issues, problems and recommendations that shall be addressed for the overall effective accomplishment of contract goals and deliverables. Recommendations for actions that need to be taken by FDA staff, or other Contractors shall be clearly defined and communicated (via email) to the responsible party and the FDA and have identified dates for completion.

3. CONTRACT CONSTRAINTS

The following constraints are applicable to this contract:

1. The Contractor shall ensure that all appropriate administrative and regulatory approvals are obtained. These include but are not limited to those that address human subject considerations;

and Office of Management and Budget (OMB) which will be detailed during the ITO process.

2. The Contractor shall be responsible for knowledge of and compliance with all applicable federal information technology and information management laws, regulations, policies and standards at the government-wide, HHS and FDA levels.

i. The computer programs, data management systems, databases, and other resources used or developed through this contract shall comply with data standards and procedures established by DHHS and FDA (per http://www.fda.gov/ForIndustry/DataStandards/default.htm).

3. The Contractor shall not use confidential or otherwise privileged information shared by FDA with contractors to solicit or in any way encourage industry funding/financial sponsorship of research projects to be performed by the contractor. In the event that a third party, such as a drug sponsor, independently requests that the contractor conduct research on a safety issue the contractor may conduct such research only if both of the following conditions are satisfied: (1) the contractor shall not divulge confidential and privileged information previously shared by the FDA; and (2) the contractor shall recuse itself from all subsequent conversations with FDA about the safety of the involved biologic product(s). In conjunction with the above, the contractor shall provide a Conflict of Interest Plan as outlined in section H.2 of the RFP. .

4. The Contractor shall work collaboratively with FDA CBER during the task order proposal request;

projects will be mutually agreed upon by both parties, and final approval is required by the FDA CO. Communications, presentations, and publications require internal FDA clearance of up to 30 days. Generally, the FDA COR will offer final decision on products and FDA CO approval will be needed on any modifications to the contract or ITOs.

http://www.fda.gov/ForIndustry/DataStandards/default.htm

3.1 SECURITY AND PRIVACY

3.1.1 BASELINE SECURITY REQUIREMENTS

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

2) Access (Physical or Logical) to Government Information: A Contractor

(and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

a. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

3) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

4) Information Security Categorization. In accordance with FIPS 199 and National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [x] Low [ ] Moderate [ ] High

Integrity: [x] Low [ ] Moderate [ ] High Availability: [x] Low [ ] Moderate [ ] High Overall Risk Level: [x] Low [ ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[x] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [x] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for

Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet

Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee under this contract shall complete the FDA non-disclosure agreement (3398 Form, RFP Attachment D), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M- 03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

A. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract: [See the FDA Security Article, entitled Contractor Personnel Security Clearance Standards and Residency Requirements for the Position Risk Designation Tier(s) (i.e., 1, 2, and/or 4”) that apply to this award.]

12) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or

COR as soon as it is known that an employee will stop working under this contract.

13) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or FDA policies.

14) The Contractor (and/or any subcontractor) shall coordinate with the COR via email, copying the Contract Specialist, to ensure that the appropriate person performs and documents the actions identified in the FDA eDepart system http://inside.fda.gov:9003/EmployeeResources/NewEmployee/eDepartDepartureSystem /default.htm as soon as it is known that an employee will terminate work under this contract within days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request. Contractor shall work with COR to access eDepart system.

B. RECORDS AND MANAGEMENT AND RETENTION

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 - Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/FDA policies and shall not dispose of any records unless authorized by HHS/FDA.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/FDA policies.

C. FDA PERSONNEL SECURITY CLEARANCE REQUIREMENTS.

Contractor Personnel Security Clearance Standards and Residency Requirements (October 2017)

1. BACKGROUND - The Office of the Assistant Secretary for Management and Budget, Department of Health and Human Services (DHHS), requires that Contractor employees (including subcontractors) who will be working in DHHS-owned or leased space and/or who will have access to DHHS equipment, and non-public privileged, proprietary, or trade secret information, must undergo a background investigation that results in a favorable determination.

http://inside.fda.gov:9003/EmployeeResources/NewEmployee/eDepartDepartureSystem/default.htm http://inside.fda.gov:9003/EmployeeResources/NewEmployee/eDepartDepartureSystem/default.htm

Contractor employees who will work in DHHS-owned or leased space for less than thirty

(30) days are considered visitors and are exempted from background investigation requirements; and therefore, will not be issued a Personal Identity Verification (PIV) Card.

These contractor employees go through visitor screening each day and must be escorted at all time while in DHHS- owned or leased space.

2. GENERAL - The Contractor must submit the following items to the Contracting Officer’s…