Attachment B - SOW_102424.docx

Business Data Enrichment Services 1.0 Indefinite Delivery/Indefinite Quantity Statement of Work (DRAFT)

Table of Contents

1. BACKGROUND

1.1 ORGANIZATIONAL BACKGROUND

The Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biological products, medical devices, tobacco products, our nation’s food supply, cosmetics, and products that emit radiation. FDA is also responsible for advancing the public health by helping to speed innovations that make medicines, devices, products, and foods more effective, safer, and more affordable as well as helping the public get the accurate, science-based information they need to use medicines and foods to improve their health.

FDA’s work and business are extremely information intensive. As such, the Agency continues to increase its reliance on the successful operation, maintenance, and enhancement of its information technology (IT) systems, which enable FDA to meet the following statutory requirements:

· The Drug Supply Chain and Security Act (Title II, Drug Quality and Security Act, 2013): The Act addresses risks in the pharmaceutical distribution supply chain by establishing a national system enabling stakeholders and regulators to trace each product package.

· Executive Order 14001: President Biden signed Executive Order 14001 on January 21, 2021 ordering immediate action to secure supplies necessary for responding to the COVID-19 pandemic and increasing Department of Health and Human Services (HHS) role in the Public Health Supply Chain.

· Executive Order (EO) 14017 On America’s Supply Chains: President Joseph R. Biden issued EO 14017 in response to which HHS delivered its report on what it has done to help make our public health supply chain and industrial base more resilient, diverse, and secure.

· The Food and Drug Omnibus Reform Act of 2022: Grants more power to FDA to perform inspections at home and abroad.

· The Safe Medical Devices Act of 1990, Medical Device Amendments of 1992, and Mammography Quality Standards Act (MQSA) of 1992

· The Food and Drug Administration Amendments Act (FDAAA) of 2007

· The Food and Drug Administration Safety and Innovation Act of 2012 (FDASIA)

· The FDA User Fee Act and its associated amendments

· Prescription Drug User Fee Act (PDUFA)

· Generic Drug User Fee Act (GDUFA)

· Medical Device User Fee Act (MDFUA)

· Biosimilar User Fee Act (BSUFA)

· Over-The-Counter Monograph Drug User Fee Program (OMUFA)

· Animal Drug User Fee Act

· Animal Generic Drug User Fee Act

· The FDA Modernization Act of 1997

· The FDA Food Safety Modernization Act

· The Drug Quality and Security Act

· The Sunscreen Innovation Act

· The 21st Century Cures Act

· The FDA Reauthorization Act of 2017 (FDARA)

· The Federal Information Security Management Act (FISMA)

· The Federal Food, Drug, and Cosmetic Act

To accomplish this, FDA uses the One Health strategy to develop stronger cross-Center and cross-office relationships, exchange educational experiences within the Agency and with other Federal agencies, and further public and global health. The key priorities of this strategy are:

· Advancing Regulatory Science and Innovation: A wide range of regulatory activities, include setting standards for products that address unmet public health needs; identifying and mitigating the spread of disease using informatics; modernizing toxicology and hazard assessments; protecting the food supply; and regulating tobacco.

· Strengthening the Safety and Integrity of the Global Supply Chain: Complex global supply chains, international trade, the foreign sourcing and manufacture of regulated products, and increased volume and complexity of imported products have forced FDA to reevaluate its approach to supply chain safety. FDA must require more and better information about product supply chains and monitor this information throughout the product life cycle.

· Strengthening Compliance and Enforcement Activities to Support Public Health: FDA enforcement actions affect not only the manufacture and distribution of foods, drugs, biologics, medical devices, tobacco, and cosmetics, but also their development and marketing. Enhancing FDA’s compliance and enforcement programs will strengthen the Agency’s focus on preventing problems and responding rapidly when violations occur.

In support of the Agency’s mission, FDA has established an Information Technology Strategy Plan (2024 – 2027). More than a roadmap, this plan is a shared FDA vision for excellence. This unified approach will innovate and enhance public health outcomes by focusing on six key goals:

1. Enhancing Collaboration: Create a Shared OneFDA Ecosystem.

2. Strengthening Infrastructure: Modernize and secure IT infrastructure.

3. Modernizing Services: Optimize IT services for stability and adaptiveness.

4. Sharing Data: Drive efficiency and innovation.

5. Adopting AI and Innovations: Embrace emerging technologies.

6. Cultivating Talent and Leadership: Develop technology expertise and leadership.

FDA has identified the need to improve the data management of regulated and related business entities throughout their full lifecycle, from pre-market through postmarket activities. FDA has a vision to create an environment where regulatory data and submission information are based on common standards, are available electronically and available to support advanced analytics to better inform regulatory decisions for improving public health. It is critical that each business entity is correctly identified, validated, and verified, and that FDA has access to third-party business information relating to that entity. This includes but is not limited to applying data standards, formatting, and data cleansing, matching and/or merging, and enriching data as needed.

The Federal Food, Drug, and Cosmetic Act requires that most manufacturers and processors of FDA-regulated products register their facilities with FDA, and in many cases also provide FDA with a listing of their products in commercial distribution. Due to various factors, FDA registration and other facility identification data were inaccurate and incomplete, especially with foreign business entities. The Agency has been harmonizing the tracking of regulated establishments (unique entity), products, associated application data, regulatory activities, and adverse events to address the following findings:

· No single source of truth for corresponding business-related data, from investigational to pre-market and postmarket and safety surveillance phases

· Difficulty in exchanging information between IT systems

· Inconsistency of data format and content across multiple IT systems

· Out-of-date data (due to the multiple and inconsistent versions of data maintained in many IT systems)

· Insufficient management of multiple data identifiers

· Inability to track data changes and their provenance over time.

To uphold the Agency’s responsibilities, FDA has multiple ongoing projects and activities that require business information and support services to help establish business entity identities, assess regulatory and product risk, determine a business entity’s involvement in FDA-regulated activities, and track product supply chains.

The FDA Safety and Innovation Act of 2012 (FDASIA), requires FDA to specify a Unique Facility Identifier System for drug manufacturers to accurately identify their establishments (unique entity) and their importers when registering with the Agency. FDA has initiated an Enterprise Master Data Management program to harmonize the data and identifiers for all business entities throughout the Agency. This requires integration with third-party data, subscription and/or services (e.g., GS1, LEI, SAMS.gov or other industry/international unique entity identifier etc.) to identify and validate each registration in accordance with FDASIA. Additionally, FDA is embarking on a global strategy of regulatory information-sharing across multiple domestic and foreign regulatory agencies. Linking of regulatory information from diverse sources to the correct business entity requires accurate identification and verification of that entity with universally recognized unique facility identifiers. FDA plans to use third-party systems with their matching, validation, verification, and business information services to ensure that regulatory information from multiple diverse sources is properly linked to the correct business entities.

FDA requires access (through most commonly known secure data distribution methods subscription, file transfer, download, web services or portals or application program interfaces/APIs) to and use of retail sales data (i.e., point of sale) from all outlets for past and future years for use in mission-critical work and future surveillance efforts. FDA’s previous data access consisted of national data for edible and non-edible categories/modules/departments, sent both as raw files for years and as direct access to this data over a rolling five-year period in a “live” online database (e.g., packaged foods, perishable foods, tobacco). FDA also gained access to weekly out-of-stock reports (e.g., Baby Formula/Electrolytes, pediatric and adult analgesics, upper respiratory medicines, OTC medicines, and selected commodities).

We are requesting continued direct access to data with options for additional geographies (region, county, designated market area (DMA), state, or metropolitan statistical areas (MSAs)) and timeframes (e.g., weekly vs. 1-month lag) with the option for eCommerce data and consumer panel and eating pattern data so that we can have the most current available data to run queries and extract data for reports. We also may require specific data pulls of raw data as well as specific reports. Data that are compatible with our existing scanner data are necessary to continue ongoing research projects that use data of identical characteristics and to develop new research projects since the national data projections would not align with competitor data to allow observation of trends. The data will therefore allow FDA to expand time-series research projects by implementing the same analytical approach with the most recent data.

Office of Data Analytics and Research The FDA Office of Digital Transformation has tasked the Office of Data, Analytics and Research (ODAR) to review data management and other related services. This includes technical oversight of data-centric system development processes, policies, methodologies, and management of IT infrastructure to ensure FDA has a robust IT foundation that enables data interoperability and enables development of enterprise-wide, multi-Center, and Center-specific data management capability necessary to meet FDA’s mission.

1.2 OBJECTIVES

FDA’s data strategy goal is to implement an enterprise master data management program to improve the completeness and accuracy of existing and incoming data, and ensure all business data are accurate, consistent, and fit for purpose across operational and analytical systems that interact with the Agency. This goal is accomplishable through a multi-tiered approach aimed at prioritized and focused components of enterprise data management and enterprise data interoperability.

Tier 1: Operational Data Enrichment Services:

1) Establishing the Validation and Verification Services to verify the identity and business status of each domestic and foreign business entity that interacts with FDA using Name, Address, Geocode location, and unique entity identifier numbers (e.g. Dun and Bradstreet “DUNS,” GS1, LEI, SAM.gov or other industry/international unique entity identifier).

2) Using business entity matching, validation, and verification services to verify the identity and business status of each domestic and foreign business entity that interacts with FDA.

3) Providing a unique indexing key for integrating all information FDA has, receives, or shares on each specific business entity.

4) Accessing additional business information to enrich the existing data (e.g., industry, line of business, entity size, classifications details, employee contact and other details, local/country/region identification numbers, NAIC Code, SIC Code or any other related data elements.

5) Accessing additional corporate family tree(s) and associated entities (e.g., parents, subsidiaries, headquarters, and branch offices of a corporate family, legal ownership, franchise, subsidiary, outsourcing, other connection type).

Tier 1A: FDA Objectives Include:

1) Verification of business identity and operational status, identification of potential duplicate records, and notification of entities that are no longer in business, have moved, or have never registered with FDA.

2) Assistance in identifying, matching, merging (when needed), and linking FDA and other source records relating to business entities that interact with FDA (past, present, and future).

3) Utilization of manual resolution processes (including human lookup, telephone contact, web searches, and on-site visits) to verify business entity identification, business information (including operational status), and to reconcile data inconsistencies.

4) Access to additional business intelligence information acquired through data collection activities or special investigations, to include corporate family relationships, trade activity, and financial and other potential risk information that can supplement FDA risk assessments.

5) Utilization of software, systems, and consulting support.

6) Access to online subscription services that allow FDA staff to obtain detailed business intelligence information relating to specific business entities on an ad-hoc basis.

FDA intends to develop its business intelligence information using entity information indexed to its unique entity identifiers and any others suitable vendors. The validated unique entity identifier serves to minimize confusion and misidentification of business entities with similar names or possessing other duplicate record information. As a unique identifier, Entity Identifier is used by FDA in linking information from various sources about a business entity. Proper facility identification utilizing data enrichment services enables sharing of regulatory information with external entities, including domestic and foreign government agencies.

Tier 3: Analytics Data Enrichment Services:

1. Enabling secure and convenient access to the following information:

a. Company/Entity financial data; including bankruptcy filings, suits, employee details, and other pertinent data.

b. Company/Entity contact details.

c. Company/Entity insights obtained through data collection and special investigation.

2. Enabling secure and consistent access to obtaining the third-party data:

a. Product sales data perspective, both foreign and domestic

b. Tracking and tracing products through supply chain data

c. Market profiling related to industry insights.

As FDA’s collection of business entity information continues to grow (estimated at 7-10% per year), a harmonized process for tracking regulated and related business entities, and their products, has the potential for assisting the regulatory processes to generate and link information more efficiently, reliably, and uniformly across the Agency, thus expanding its beneficial impact on the nation’s health. This harmonization goal will identify and link business information from multiple sources to a single identifier within different types of business data domains that span from investigational to approval through postmarket surveillance.

Tier 4: Social Media-based Data Enrichment Services

The Contractor shall provide FDA social media data (e.g., text from original posts, text from comments on posts, and images or additional media, when available) to provide FDA with real-time and historic insight into the public discourse on matters regulated by or impacting FDA. Social media data is defined herein as content originating from commonly used social media applications in the U.S. (e.g., Reddit, X). Coverage shall include access to social media data in topics directly relevant to product areas regulated by FDA (e.g., food, drugs, tobacco products, biologics, medical devices, veterinary products, cosmetics, and radiation-emitting electronic products) and topics that affect FDA policy or otherwise inform FDA about U.S. public health (e.g., general medical health, pregnancy, weight loss, illegal and recreational drug use).

· Perpetual license to gather information on a broad scope of existing and emerging research targets. Those include ongoing surveillance of known products/behaviors of interest, as well as time-bound research on emergent topics.

· FDA business processes require interaction with external customers. We are tracking mentions of our customers when discussed in a subreddit.

· FDA business processes require direct access to social media data via primary source APIs to provide a full corpus via API or scheduled static archives.

· FDA business processes access to social media data without content restrictions, and with agreements in place to govern the dissemination of research products and development of machine learning models.

· FDA’s transparency initiatives provide downloadable public access to large amounts of FDA data on adverse events, enforcement activities, and product labeling; these need to include “social listening” and brand monitoring.

· Social media data shall be accessible via an Application Programming Interface (API). Data acquired via the API shall be transportable to other platforms (e.g., Python, R) for data analysis.

Tier 5: Access to National Brand Sales Data

Enterprise Access is the ability of authorized FDA users to run queries, reports and analysis on products, time periods, geographies, measures, and syndicated attributes, and to publicize aggregate data in support of public health issues. The external collaborators will have access to the data for the sole purpose of conducting FDA-approved projects. Similar security standards as those used for the FDA’s own confidential and sensitive data will be used to provide access to the external collaborators. Contractor must approve all external collaborators directly accessing the data, and a Third-Party Agreement (TPA) will be put in place. The resulting findings will be disseminated through multiple media, including but not limited to professional economics journals, FDA publications, the FDA website, and presentations at meetings of professional economics associations.

Throughout this document, the term “raw data” shall refer to data or other information provided by the/a Contractor, which is identifiable from the data or information originating from the/a Contractor. Before public release, FDA will review all publications and reports to meet data disclosure requirements and to strictly maintain privacy and confidentiality requirements of data purveyors. FDA will not disclose any retailer or manufacturer name, disclose any retailer or manufacturer-identifiable information, including specific brands or product names, or disclose any market share data at the retailer, brand, or item level in any market. The Enterprise Access structure shall provide the following online representative features and functionalities:

Access to national retail data, such as Circana Point of Sale (POS) syndicated Unify OmniMarket Core Outlets, per the following scope:

· Data are updated approximately weekly.

· FDA will have access to syndicated time periods with up to five years of historical back data as available.

· FDA will have access to all syndicated measures, excluding H&W Nutrition Fact Measures, relative to the measure sets for projected geography sets.

· FDA will have access to Total U.S. Multi-Outlet (“MULO”) plus Convenience Channel.

· FDA will have access to data that is reasonably related to Food Products, Tobacco Products, Cosmetic Product, Ingredients, Biologics, Devices, Animal Food, Animal Drug, Human Drugs, Combination Drug/Device products, Radiological Products (see FDA.gov for more details).

· Enterprise access includes up to 50 Unify users with the ability to purchase FDA and other government agency user access in 5 user, 25 user, and 50 user increments. To the extent available, users shall have access to the database data dictionary, including definitions of all fields and data elements and what these fields and elements fully represent, any other data guides, and documentation on any abbreviations or acronyms used in the dataset.

· To the extent available, users shall have access to information detailing sampling methodology, how data was projected, retailer participation lists, and any other data or information that is required by users to perform data analysis.

· Notification of database or database-related information updates, changes, modifications, eliminations, or additions.

· To the extent available, users shall have access to written documentation on how to appropriately work with differences in data availability between comparison years, including applying techniques for trend analyses.

· To the extent available, users will have access to written documentation on all quality control procedures.

· Training will be provided for Enterprise Access levels of 200 users, 50 users, 30 users, and 15 users at Government facilities.

· Online access to audiovisual training resources for FDA users (e.g., webinars).

· Vendor shall provide data verification of reports run by FDA via phone or online chat.

· Provide consultation to registered FDA users on configuring/refining FDA-run queries; representative activities include general inquiries on how to build queries, filter, and run reports.

· Provide advice on using measures and attributes in the system.

· Contractor shall monitor and track number of concurrent users that have access to the database, and identities of users generated under the pertinent access structure.

Tier 5: Supply Chain Related Data Enrichment Services

· National Sales Perspectives (NSP): Measures dollar and unit sales for pharmaceutical products across multiple distribution channels, including retail, mail, and non-retail. Data are collected from a panel of wholesalers, distributors, and pharmaceutical manufacturers.

· National Prescription Audit (NPA): The industry standard source for national pharmaceutical prescription activity, NPA measures demand in terms of dispensed prescriptions to consumers across three unique pharmacy channels: retail, mail service, and long-term care.

· Provides detailed prescriber level prescription information for the U.S., including dispensed drug prescription information from retail pharmacies (chain, mass merchandisers, independent, and food stores), mail service pharmacies, and long-term care facilities.

· Worldwide healthcare markets, pharmaceutical market, Drug Device Market, Food Market tracking virtually every product by classifications and provides estimated product volumes, trends, and market share through retail and non-retail channels across the countries.

The scope of this IDIQ is to obtain data licenses, software licenses, subscription(s), IT hosting services, matching, validation, and manual resolution and verification services, and/or various professional, technical, and consulting services. This may include related to data science, data analytics and data engineering, to fulfill FDA’s project objectives as specified at the time of award of specific IDIQ Task orders. Emphasis is on business entity identification and verification, data cleaning and linking, business intelligence, and risk assessment in relation to FDA-regulated products, as well as providing support in making FDA’s regulatory activities more efficient and effective.

2 PURPOSE

The purpose of this IDIQ is to obtain business information and data management support services that will extend the Agency’s master data management capabilities for business entities and increase the quality, extent, and accessibility of information on business entities that interact with FDA, both directly and indirectly. The IDIQ will allow the Agency to develop an enterprise-wide and cohesive approach to collecting, maintaining, and integrating business entity information, and enhance data quality, in addition to enhancing risk assessment regarding regulated products and those who manufacture, process, or distribute them. Hence, the Agency seeks to engage outside expert consultants, data, systems, and services to provide, as required under specific IDIQ Task orders, support for business entity data management.

3 CONSTRAINTS

3.1 TECHNICAL STANDARDS AND GUIDELINES

The following current standards and guidelines are subject to change as further guidance becomes available, and must be considered in the execution of this IDIQ:

· Health and Human Services (HHS) Enterprise Performance Life Cycle (EPLC) Framework

· FDA Project Management Process and Templates

· Food and Drug Administration Investment Life Cycle (ILC)

· IT Infrastructure Library (ITIL).

All Contractor and sub-Contractor employees are required to sign the Contractor's Commitment to Protect Non-Public Information Agreement FDA 3398 before commencement of work. The Contractor will be invited to meet with key FDA representatives to review current activities and status, project management repository contents, current policies, procedures, plans and charters, and any other materials and discussion(s) deemed relevant to the subject areas described in this SOW. Additional discovery and relevant materials can be made available to the Contractor as needed to support execution of tasks as they are awarded.

3.2 TECHNICAL ENVIRONMENT

FDA’s applications and databases are deployed, operated, and maintained in several environments (Development, Testing, Pre-Production, and Production) in FDA’s White Oak Data Center (WODC) in Silver Spring, MD and in the Ashburn Data Center (ADC) in Ashburn, VA. These environments are typically implemented using shared infrastructure technologies, such as Cloud and virtual servers. Engineering tasks are performed in a “Sandbox” (proof-of-concept environment), development, test, pre-production, or production environments in either FDA’s WODC or ADC facilities or through an FDA-approved Cloud Service Provider (CSP).

3.3 FDA MASTER APPROVED TECHNOLOGIES (MAT) LIST

The FDA Master Approved Technology (MAT) List contains a list of approved technologies that include applications (software), infrastructure, and peripherals (hardware), and scientific software and devices. The Contractor must follow the FDA process to submit a request for approval for new software, if necessary. Approval takes a minimum of two (2) weeks and the Contractor is responsible for ensuring the form is submitted in a timely manner.

3.4 CONTRACTOR COMPLIANCE

The Contractor shall adhere to all applicable federal information technology and information management laws, regulations, policies, and standards at the government-wide, HHS, and FDA levels. At the government-wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/ . HHS documents are found at: http://www.hhs.gov/ocio/.

3.5 SECTION 508 STANDARD REQUIREMENTS

Implementation of Software and IT services under this IDIQ will be required to conform with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, which requires that all electronic and information technology (EIT) products and services developed, acquired, maintained, or used must comply with the “Electronic and Information Technology Accessibility Provisions” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 1194. Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.gpo.gov/fdsys/granule/CFR-2011-title36-vol3/CFR-2011-title36-vol3-part1194/content-detail.html . This requirement shall comply with the following standards:

1194.21 – Software Applications and Operating Systems

1194.22 – Web based Intranet and Internet Information and Applications

1194.31 – Functional Performance Criteria

1194.41 – Information, Documentation, and Support

3.6 CHANGE CONTROL PROCEDURES

All changes to software and FDA IT infrastructure will follow the FDA established change control procedures. These procedures provide a standardized process that ensures efficient and prompt handling of all changes to the software and FDA IT Infrastructure. They will facilitate the efficient and prompt handling of all changes and maintain the proper balance between the need for change and the potential negative impact of changes as well as ensure that traceability and accountability are supported.

3.7 RELEASE MANAGEMENT PROCEDURES

All software releases will follow the FDA established release management procedures. The following are high-level steps for the software release process for all version upgrades:

· Determine if IT Standards and the IT Investment Management (ITIM) approval is required.

· Register planned deployment dates on Master Application Release Schedule (MARS_

· Participate in Release Management and Coordination (RMAC)

· Create Version Description Document (VDD) for deploying to release.

· Request ADC Resources for Pre-Production and Production

· Request Infrastructure Change Control Board (ICCB) approval for deployments.

· Represent Request(s) For Change (RFC) at ICCB meeting.

· Deliver final “Release Package" to FDA Office of Information Management (OIM) Configuration Management Team.

· Validate successful deployment to target environment.

Evaluate all RFCs and Defect candidates for each release to ensure quality and performance standards.

3.8 COMPATABILITY WITH EXISTING FDA ENTERPRISE ARCHITECTURE

Development activities of this IDIQ must follow and be compatible with existing FDA Enterprise Architecture Standards. These range from the standard Oracle RDBMS, Microsoft SQL Server, to the SOA-based environment that span across the Web/Presentation, Application, and Data layers currently existing in FDA. These FDA Enterprise Architecture Standards will be provided to the Contractor once the work has commenced.

3.9 IT SECURITY

This section ensures the system is compliant with Federal and Agency security requirements and supports all security-related activities including the certification and accreditation process. Project compliance includes:

· HHS Information Security and Privacy Program http://www.hhs.gov/ocio/securityprivacy/index.html

· FISMA http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf

· NIST SP800-53: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

· FDA Security Authorization process, which closely resembles NIST SP800-37: https://doi.org/10.6028/NIST.SP.800-37r2

3.10 DATA STANDARDS AND GUIDELINES

FDA intends to fully utilize and comply with existing internal and external data standards, where applicable, for each data domain. Examples include:

· Use HL7 Structured Product Labeling (SPL) standards for Product Listing and Business Entity data registration.

· Use existing standard terminologies/vocabularies such as National Cancer Institute (e.g., dosage forms, package type); ISO (e.g., 3166-1 Alpha-3 Country Code, ISO IDMP); FDA (e.g., UNII, NDC), etc.

· As appropriate, use the common data exchange format (e.g., XML, JSON, etc) in exchanging data among IT component(s).

Additionally, as regulations and standards are implemented to facilitate higher volume of data and better data quality from electronic submissions, FDA will exploit the feasibility of automating and consuming (i.e., acquire, validate, transform, transport, etc.) much of the data directly from input sources, thereby increasing the efficiency and quality of the overall master data environment.

3.11 DATA SECURITY AND DATA RIGHTS

The FAR Clause 52.227-14 (Alternate II, IV, and V) governs the parties’ rights in data created in the performance of this IDIQ.

The Contractor shall implement and maintain the highest security measures, in accordance with the FISMA and FDA policies and procedures, with respect to FDA's data in the Contractor's possession. All electronic interfaces between FDA and the Contractor and the Contractor's sub-Contractors, shall be managed in accordance with FDA's security policies and firewall requirements. These requirements include ensuring that FDA accounts and data shall be maintained secure and hidden from those outside FDA, with exceptions only when individually granted by FDA IT security personnel. User access rights must be authorized, tracked, and reviewed periodically. FDA transactions, queries, and reports shall not be monitored by or available to any outside party except when individually granted by FDA IT security personnel. During the installation process, the Contractor shall discuss all security issues with the Contracting Officer Representative (COR) and FDA's IT security personnel to guarantee that data provided through the FDA firewall are protected from any viruses, worms, or any other corruptions or security threats. Additionally, the Contractor shall ensure that FDA data used in generating reports is for FDA use only and is not accessible or used by the Contractor or other parties at any time.

If this IDIQ is terminated for any reason, the FDA data sets, reports, and associated data shall be transferred in an electronic format to FDA at the time of termination, and all FDA data must be deleted and scrubbed from the Contractor's systems in accordance with FDA policies and procedures.

All security incidents dealing with FDA information must be reported to the FDA IT Security office immediately. The FDA Security office will perform regular reviews and assessments of the Contractor site to ensure that the FDA policies and procedures are followed, implemented, and operating effectively.

The Government will maintain ownership in perpetuity to all data and code generated or received from any non-unique entity identifier party in performance of this IDIQ to fulfill FDA’s mission, in compliance with all laws, statues, and regulations governing FDA and its stakeholders. The Government will maintain ownership in perpetuity to all data and code generated by the Contractor in the specific performance of this IDIQ.

Perpetual Retention Upon Termination: Because unique entity identifier number and associated information provided by unique entity identifier data services have been integrated into various FDA IT systems, for the continuity of operations of these FDA IT systems, the Contractor shall eliminate the requirement to remove sourced content from FDA systems if another party takes over unique entity identifier support role.

The Contractor shall assist FDA in consolidating and improving activities related to the organization and accuracy of business entity information using the third-party data services, which will be included in FDA’s systems for business entities that interact with FDA. The Contractor shall provide matching, validation, and manual resolution and verification services, along with various professional and consulting services. To this end, the Contractor shall provide specific services to validate and improve the quality of FDA business entity data, host the data as needed, refresh the data based on the Contractor’s updates to entity information, and provide manual and on-line validation and verification services to assist FDA in maintaining or identifying an external unique identifier and associated entity information.

The Contractor shall furnish all necessary services, qualified personnel, material, development tools and methodologies, not otherwise provided and subject to FDA approval. The Contractor shall provide technical support throughout all phases of FDA’s EPLC (. IT and data management support include knowledge transfer in a wide range of activities including:

· Concept development; project initiation and planning

· Preparing and overseeing project schedules, tracking, and reporting cost expenditures, etc. (including interacting with various points-of-contact (POCs) for specific tasks regarding progress, issues, and concerns)

· Preparing reports and briefings to FDA senior management in support of project goals

· Developing and reviewing requirements and monitoring their implementation in FDA, to ensure that business needs are met.

· Providing business and technical expertise to assist in planning and managing FDA projects.

· Providing technical writing capabilities in support of technical and project management decision-making.

· Monitoring program status and relating any trends as they become known.

4.1.1 DATA AND SOFTWARE LICENSING

The Contractor shall provide licensing for the unique entity identifier system to allow its use and incorporation into FDA’s systems and into all FDA business processes, including:

· Perpetual license to use third-party data services as a component of FDA’s systems for incorporation into all its business processes. This includes sharing of non-proprietary information with external parties (including the public) using FDA’s systems (to include third-party identifier/unique entity identifier).

· FDA business processes require interaction with external business entities using the unique entity identifier, and these identifiers must be available to those who need them.

· FDA business processes require sharing of regulatory information with external entities (e.g., state, and foreign regulatory entities) using the entity unique identifier.

· FDA business processes require sharing of health information to the public, often in ways that include the unique entity identifier.

· FDA’s transparency initiatives provide downloadable public access to large amounts of FDA data on adverse events, enforcement activities, and product labeling; these need to include the unique entity identifier where a facility is mentioned.

· Annual license for unique entity identifier software and data for use within FDA, including user documentation and technical support and a resource center and help desk for resolution of issues.

4.1.2 ROUTINE TRACKING OF BUSINESS ENTITY INFORMATION

The Contractor shall provide routine tracking of business entity information, to include identity verification, operational status, line of business, corporate family relationships, and other business intelligence for business entities of interest to FDA. Basic business information shall be readily available to FDA staff. Enhanced business intelligence, such as business information report products, shall also be available on an as-needed basis. Access to database information and on-line report products shall be provided on a 24/7 basis.

4.1.3 TRAINING

The Contractor shall provide basic training on implementation and use of third-party data and related products, and on analysis, interpretation, and use of the data provided.

As specified in an IDIQ Call, the Contractor shall plan, develop, and deliver training related to implementation and integration of third-party data and services. The Contractor shall develop and execute a training strategy that will provide FDA users with the skills necessary to effectively utilize the available unique entity identifier resources. Training programs (courses, material, etc.) will be evaluated, tracked, and measured for effectiveness in meeting business goals and objectives.

Representative activities under this task area may include:

· Performance of training assessments, evaluations, and analyses

· Developing a training plan

· Developing training material

· Providing on-demand training

· Updating training material

· Developing and implementing web-based training

4.1.4 PROJECT MANAGEMENT

The Contractor shall provide IDIQ Call level project management to establish control, management, monitoring and notification mechanisms, ensuring that contracted tasks stay on track and important milestones and performance measures are met. For each IDIQ Call, the Contractor shall prepare a Project Management Plan describing the technical approach, organizational resources, risk management and other management controls to be employed to meet the cost, performance, and schedule requirements throughout IDIQ Call execution.

The Contractor shall provide written Monthly Status Reports for all awarded IDIQ Task orders to the COR. The Monthly Status Report shall include accomplishments, plans, outstanding issues, and an updated project schedule. Within the first 30 days after IDIQ award, the Government and the Contractor will design and agree on a standard reporting format that includes the following information at a minimum:

· Work performed within the period of performance reported.

· Status and progress of all tasks

· Resources expended to date by task

· Cost and schedule variances, with an updated budget and project schedule

· Outstanding issues and significant risks to scheduled deliverables and plans to mitigate them.

· Accomplishments and progress against service level metrics

· Recommendations for changes or additional activities to ensure that the tasks support progress on the overall Regulatory Review Support Contract objectives.

The Contractor shall track the contract funds at the subtask level and report as part of the Monthly Status report the contract funds at the task order and subtask levels. If the Contractor needs to re-allocate funds across subtasks, but within the overall contract funds, the Contractor shall submit their request in writing to the COR for prior approval to which the COR will respond in writing. This request shall be submitted via email.

In addition to progress reporting, the Contractor shall be proactive in informing the designated government Project Managers and Contracting Officer Representatives of any issues, problems and recommendations that should be addressed for the overall effective accomplishment of IDIQ Call goals. Recommendations for actions that need to be taken by FDA staff, or other Contractors, shall be clearly defined and communicated to the responsible party and the FDA, and have identified dates for completion.

The Contractor shall also provide a final report at the end of each IDIQ Call period and at the end of the final Option Year of the contract to summarize accomplishments, outstanding tasks and recommendations, transition plans, lessons learned, and funding balance and resource closeout for the duration of the period of performance.

The Contractor shall also be responsible for preparing and participating in program reviews, management briefings, stakeholder presentations and cross-Agency information exchanges.

4.2 DOCUMENT MANAGEMENT

For tasks areas that are governed by the FDA EPLC, the Contractor shall ensure that all system documentation be completed as required by a specific IDIQ Call. The Contractor shall store and track documentation using FDA established tools that will be provided at task award.

4.3 TASK AREA – MATCHING AND VALIDATION FUNCTIONALITY

The Contractor shall provide matching functionality of FDA or external records to third-party global data services business entities and provide or validate their identifying Numbers. This will include matching diagnostics and may include cleansing (standardization) of the name/address information and provision of address type (e.g., residential, business, multi-unit), move history, and geospatial coordinates.

The Contractor shall provide validation functionality to verify that third-party identifiers used in records submitted to FDA correctly reflect the appropriate third-party record identifier (e.g., GS1, LEI, SAM.gov or other industry/international unique entity identifiers) and associated business identity information.

4.4 TASK AREA – ADDITIONAL BUSINESS INSIGHT RELATED INFORMATION

The Contractor shall provide current operational status, business intelligence, and specific risk information (including risk indicators, both currently available and those developed in the future) for FDA use. These shall be provided for individual business entities and may include their ownership relationships (corporate family tree), historical data, and/or information on business executives (individuals). This may also include batch or interactive processes for provision of business information in risk assessment models or algorithms. This may also include specialized reports for determination of FDA-related business entities that are in a specific line of business (e.g., market analysis), are missing from our registration systems, are out of business, or whose data are inaccurate. It may include monitoring and periodic updates to specific business information for selected business entities; for example, a risk monitoring list for a specific category of business entities might provide notifications for business entities with negative risk information, those with little or no entity unique identifier’s information, or those with adequate and only positive unique entity identifier risk information.

4.5 TASK AREA – MATCHING, VERIFICATION AND DATA QUALITY SUPPORT

The Contractor shall provide support for resolution of issues related to matching, entity verification, business information, and data quality through services that include data management, analysis, automation, and manual resolution services (see Work Area 4.6). This includes assistance with unique entity identifier and FDA processes of matching FDA records to unique entity identifier records, education on understanding the matching components and interpreting match results, customizing match parameters, developing viewers for potential matches, conducting specialized batch matches, analyzing the matching processes, and reporting results. The Contractor shall support FDA in identifying duplicate records in FDA databases, analyzing issues relating to merging these records, and making recommendations regarding and aiding FDA's merging processes for those records.

The Contractor shall support, evaluate, and document recommended improvements to existing processes and produce best practice documentation for Enterprise and Master Data Management process enhancements and support tools. Representative activities under this task area may include:

· Provide technical guidance related to enterprise and master data management strategy, business analysis, and system integration to support, evaluate, improve, and transform existing programs and processes.

· Analyze existing business processes, scenarios, activities, architecture, and information flow.

· Perform impact analysis scenarios and gap analysis activities to identify inefficiencies, redundancies, obsolescence, technology support gaps, and to ensure standardization and consistency across data systems.

· Assess and document potential alternatives that could support the major objectives of the Enterprise and Master Data Management effort.

· Provide future state business and technology roadmaps to include blueprints, to-be business processes, information flow and data flow diagrams, conceptual data models, and system architectures that will transform the current state to the desired future state of business processes and systems.

4.6 TASK AREA – INVESTIGATIVE AND ANALYTICAL RELATED SERVICES

The Contractor shall provide manual resolution services that may include human lookup in unique entity identifier databases and Internet or other sources, telephone interviews, and on-site verification visits (domestic and foreign). The Contractor shall provide investigative services (both standard and customized) to verify a business entity and its operational status, find or assign an associated unique entity identifier number, or collect specific FDA-related information (e.g., operational hours, product lines, products marketed in the US, regulatory status, risk indicators). These activities may include specific data collection, data retrieval, data integration, and data analysis activities. Representative activities may include:

· Conduct specific data collection activities targeted at business entities of interest to FDA, including customized investigation services, and on-site verification of FDA-specific information about the business entity's involvement in FDA- regulated activities:

· Perform data retrieval activities, including extraction of facility-specific information from r data systems and providing it to FDA in a manner that can be utilized for a specific FDA…