Attachment E-Sample Task Order Statement of Work.pdf

Contractor-Hosted Fully Integrated Records Facility (FIRF) IDIQ Recompete Request for Proposal (RFP) No. 75F40126R00009

Attachment E: Sample Task Order Statement of Work Title of Task Order: FDA/CDRH Premarket/Postmarket Tracking Services

Attachment E

Sample Task Order Statement of Work

1. Background

The mission of the U.S. Food and Drug Administration (FDA), Center for Devices and Radiological Health (CDRH) is to protect and promote the public health. CDRH accomplishes its mission through the evaluation of new devices for marketing, developing and monitoring product quality and performance standards, acting against firms that violate the law, educating professionals and consumers on the safe use of devices, and performing research on device problems. CDRH develops and implements national programs to protect the public health in the fields of medical devices and radiological health. These programs are intended to ensure the safety, effectiveness, and proper labeling of medical devices.

CDRH receives, reviews, and renders determinations or otherwise acts upon thousands of premarket and postmarket submissions each year from device manufacturers and others seeking clearance to market or clinically test new or modified devices in the United States. CDRH maintains internal and public databases and records that provide up-to-date information to the Agency, other Federal agencies, and (where appropriate) industry and the public regarding the Center’s recent and historic actions and determinations on premarket submissions. CDRH also reports to industry, Congress, and the public on review timelines and other performance metrics associated with those actions and determinations.

Maintenance of these databases and records depends upon accurate and timely processing and tracking of premarket submissions, and upon appropriate retention and disposal of records.

In support of its mission, CDRH receives, tracks, and processes all premarket and postmarket submissions for records retention/disposal purposes. The execution of all tracking and archiving functions includes mail receipt, mail processing, mail distribution to and from divisions, operational functions, jacketing and labeling, electronic submission, user fee and eCopy processing, district office mail, and storage. This includes fulfilling all incoming and outgoing processing and quality control (QC) requirements on a same day as received basis. A late delivery is defined as physical deliveries received after 4:30 p.m. and CDRH portal submission received after 4:00 p.m. Each submission may have multiple transactions (i.e., cycles of processing and/or tracking). Contained in Section 4.3.1 of this Task Order are the approximate number of the submissions (by type) that CDRH receives each year.

2. Scope

The Contractor shall provide all personnel, equipment (exclusive of Government Furnished Equipment), vehicles, materials, supervision, training, facilities and other items necessary to perform the operation, management, tracking and retention/disposal of the CDRH premarket and postmarket submissions.

The scope of this Task Order encompasses the receipt and processing of all incoming hardcopy and electronic applications, submissions, and mail received at the FDA White Oak mailroom and at the Contractor’s Fully Integrated Records Facility (FIRF). This includes submission and applications received via email to a designated FDA mailbox. Processing records materials includes triaging incoming submissions, document preparation, scanning of files; preparing files to be delivered to authorized persons such as FDA reviewers and couriers, document distribution, meta data entry, manual data entry into CDRH tracking systems and repositories, uploading digitized images into EDRs, preparing Records Control Schedules (RCSs), tracking records material, storing files, file retention, retirement of files, and disposition of files.

In addition to the processing tasks identified above, the Contractor shall provide the following support services: Task Order management, physical and network access control, courier services, responding to stakeholder requests, file management, inventory management, quality control, retrieval of files, staging and preparation of documents for special projects, scanning services, shredding services, processing outgoing correspondence, relocation services, and transition activities. The Contractor shall be responsible for tracking all documents to and from the Contractor’s FIRF and the FDA White Oak campus.

The Contractor must be able to provide support in a dynamic and changing environment. In addition, the Contractor shall provide best practice advice on methodologies for improving the receipt and handling of records material regardless of the method of delivery.

3. Task Order Type

The order type for this Task Order is Firm-Fixed Price (FFP).

4. Tasks

4.1. Task 1: TRANSITION ACTIVITIES (ID/IQ SOW Task Area #6: Transition Work Activities)

4.1.1 Transition-In Services – (Note: these services are optional services for the Government and will be exercised at the Government’s discretion)

A smooth and orderly transition-in among the Contractor or FDA and the predecessor contractor is necessary to ensure minimum disruption to vital FDA business. Transition-In Plans shall include, at a minimum, a description of parallel operations, management plans, personnel on-boarding process tracking, and an updated list of Contractor personnel, with anticipated start dates and responsibilities. The Contractor shall cooperate fully in transition activities. The Contractor shall work with the FDA Help Desk Support during transition to implement the Help Desk Support Project Plan for any large-scale relocation/movement of equipment. This shall include, but may not be limited to, the relocation/movement of FDA IT computer equipment, such as computer monitors, keyboards, mice, laptop and desktop computers, printers, scanners or any other peripherals.

4.1.2 Transition-Out Services – (Note: these services are optional services for the Government and will be exercised at the Government’s discretion)

A smooth and orderly transition-out between the incumbent Contractor to a successor Contractor is necessary to ensure minimum disruption to vital FDA business. The Contractor shall be required to submit and execute a Transition-Out Plan to ensure business continuity for the FDA in the event that a new Contractor is chosen. At a minimum, this Transition-Out Plan shall include the following:

• Transition-Out Plan and Schedule, to be reviewed and agreed upon by the FIRF IDIQ COR, TO COR, TOPM, and successor Contractor.

• Inventory of documentation to be turned over.

• Inventory and return of all Government-Furnished Property.

• Schedule of knowledge walkthrough sessions.

• Training of successor Contractor employees on current policies and procedures.

• Classroom training; hands-on training of new Contractor employees.

• Lessons learned session and retraining.

• Submission of knowledge transfer documentation to include current and up-to- date Standard

Operating Procedures.

• Availability of personnel during transition period.

• Transfer of any documents/files on “hold” to the successor Contractor.

• Participate in all transition-in activities with successor Contractor.

• Identify, track, and discuss with the FIRF IDIQ COR, TO COR, and TOPM any potential or known problems, risks or issues associated with the transition; and

• With the successor Contractor, coordinate relocation of all documents from the incumbent’s

FIRF to the successor’s FIRF.

4.2. Task 2: Program and Project (Task) Management (ID/IQ Task Area 1: Program and Task Order Management Support)

The Contractor shall provide Task Order project management, to ensure that the scope, schedule, and costs are controlled and consistent with the contract. The Contractor shall designate a Project Manager for all work performed under this Task Order. The Project Manager shall act as a single point of contact to the FIRF IDIQ COR, TO COR, and TOPM.

4.2.1. Quality Control Plan and the Reporting of Quality Control Information

The Contractor shall complete a Premarket and Postmarket Tracking Services Quality Control Plan to ensure the requirements of the Task Order (TO) are provided to the Government in writing. The Quality Control Plan shall be presented to the Government, initially, as part of an Offeror’s proposal, and at the beginning of each period of performance, and four (4) months prior to the end of the period of performance.

The Quality Control Plan shall include at a minimum:

• Description and reporting on an inspection system covering all the services identified in the statement of work. It shall specify the areas to be inspected on either a scheduled or unscheduled basis, how often inspections shall be accomplished, and the titles of the individuals who shall perform the inspection;

• The methods for identifying and preventing defective occurrences in the quality of service performed before the level of performance becomes unacceptable;

• Off-site records of all inspections conducted by the Contractor and necessary corrective action taken. The Contractor shall include this documentation in the monthly reports provided to the Government;

• Timeliness and accuracy for scanning documents that are not subject to eCopy or eSTAR and placed into the IMAGE system. Quality control would include, for example, ensuring that submission supplements or amendments correctly relate to original documents and pages are scanned legibly;

• A plan in place for implementation of performance goals that are not being met, regardless of the reason for the lagging performance whether IT, increased workload, personnel issues, holidays, weather or other factors which are the cause;

• The Contractor shall have authorization to correct certain processing errors as agreed upon with the COR and/or Premarket/Postmarket Tracking Services TOPM without notifying the COR and/or Premarket/Postmarket Tracking Services TOPM of the processing discrepancy.

The processing errors are errors made by the Contractor, e.g. typos, transposing numbers, incorrect log-ins, etc. -- as long as the correction does not stop the processing timeframe.

Should the correction delay processing, the Contractor must notify the Program Office, TO COR and TOPM.

Reporting of Quality Control Information:

• The Contractor shall report on quality control information in the Premarket/Postmarket Tracking Services monthly reports. Quality Control activities for this Task Order includes adherence to Acceptable Quality Levels (AQLs) as well as identifying the AQLs that were not met and provide an explanation regarding the circumstances; ensuring proper handling and safeguarding of materials, identifying and mitigating risks, providing, when appropriate, value engineering efficiencies, resolving issues; and adhering to processes and procedures. The Contractor may also be tasked to provide guidance on proper quality assurance methods related to document control processes, records or information activities.

• The Contractor may, at any time, recommend to the FIRF IDIQ COR, TO COR, and/or TOPM value engineering improvements designed to improve processing

4.2.2. Project Management Plan

The Project Management Plan shall be presented to the Government, initially, as part of the proposal, and at the beginning of each period of performance thereafter and four (4) months prior to the end of the period of performance. The Project Management Plan (including a project schedule) shall contain, at a minimum, the following information:

• A detailed description of the Contractor’s approach for completing the tasks outlined in the Task Order SOW;

• An organizational chart for the FIRF. The organizational chart shall provide a list of employee names, job duties, job titles, and hierarchical structure;

• A Work Breakdown Structure (WBS) identifying activities and personnel/labor categories responsible for activities and risk management at activity levels identified; and

• An approach for mitigating risks pertaining to contractor performance, cost and schedule.

4.3. Task 3: Processing, Tracking, Courier, and Temporary Storage of Premarket/Postmarket Submissions (ID/IQ Task Area 2: Document Processing, Handling, Correspondence, and Delivery; ID/IQ Task Area 3: Document Scanning, Photocopying, Conversion, and Pre-market Services; ID/IQ Task Area 4: Document Data Entry Services, Data Analysis, Tracking Services, and Stakeholder Support; and ID/IQ Task Area 5: Tracking and Temporary Storage of Government Records)

Documents and records material will be received at the FIRF and White Oak Building 66 FIRF mail room. Contractor staff will receive U.S. Mail and deliveries via commercial and private couriers. The FIRF Contractor shall staff the FIRF and White Oak Building 66 FIRF mail room, sort mail, prioritize, triage, scan, bar-code/track, and distribute both U.S. mail and regulatory submissions to the FDA community or coordinate with U.S. mail couriers. The FIRF Contractor shall receive and deliver all mail for CDRH. The Contractor shall be responsible for tracking all documents to and from the FIRF and the FDA White Oak campus. All documents shall be tracked in a tracking system that meets all of the requirements listed in FDA/CDRH Document Control Center (DCC) Tracking System Requirements (Attachment A: Statement of Work Appendices, Appendix 5).

As tasked, the Contractor shall process required and voluntary electronic copies (eCopies) and eSTAR submissions provided to FDA on an electronic media (e.g., CD) or though the CDRH Portal into the official repository.

The FDA creates and receives a variety of non-regulatory Federal records. This includes but is not limited to, program records, office administration records. and dockets. Interaction with the public has grown significantly over the course of the last five years. The Contractor shall provide user support services to internal and external stakeholders. Some examples of user support services are responding to inquiries regarding the status of documents being processed, assisting firms with entering data into an electronic system to comply with regulatory requirements; assistance locating packages, assistance with procedures on sending in regulatory submissions.

In addition, but not limited to, the Contractor shall perform the following tasks related to document and records information processing:

4.3.1. Premarket and Postmarket Submissions

The Contractor shall be responsible for processing the document types listed below:

Document/Submission Types Total Anticipated Submissions in a 12-month period

Total Anticipated Transactions as a Multiplier* Investigational Device Exemption (IDE) Submissions 4,320 1.1

Q-Subs 10,400 1.1

UTNs (Universal Tracking Number) 2,200 1.1

EUAs/PEUAs 100 1.1

PreMarket Approval (PMA) Submissions 6,000 1.1

510(k) Submissions 10,000 1.1

All other Office of Product Evaulation and Quality (OPEQ) Documents ** 1,500 1.1

Establishment Inspection Reports (EIRs) and Exhibits 1,800 1.1

Warning Letters and Untitled Letter Responses 120 1.1

Medical Device Single Audit (MDSAP) Regulatory Audit Reports 6,000 1.1

Recalls 1,050 1.1

Allegations of Regulatory Misconduct (ARM) 4,200 1.1

Imports Reviews 300 1.1

522 Postmarket Surveillance Studies/Postmarket Surveillance as Special Controls

100 1.0

*NOTE: Numbers noted above are subject to change. They could increase or decrease from year to year. Total Anticipated Transactions is a multiplier which reflects the total number of documents that is processed to include the original document and any subsequent processing requirements. For 510(k) this number includes Format holds, user fee holds, combo holds, withdrawals, deletions and appeals. For IDE this number includes change/conversions and Format holds and withdrawals and PMA this number includes change/conversions, deletions, Format holds, user fee holds and combo holds. For EIRs, Warning letters, MDSAP, Recalls and ARMs, this number includes originals and supplements. These are not subject to the user fee or eCopy/eSTAR requirements.

** NOTE: All other OPEQDE Documents include documents such as misroutes and redirects.

Standard Operating Procedures (SOPs) associated with these documents will be provided at Task Order award.

The Contractor shall interpret guides and manuals for processing incoming requests, analyze the request to ensure that it is within CDRH jurisdiction, that there is adequate information to proceed, whether a high priority request has been identified, a time sensitive topic or a defined impact working rule applies, verify that all information was successfully entered into Image 2000 Plus, CEntry, CTS, RES, SharePoint, Compliance Management System (CMS), eNspect, Online Search and Retrieval System (OSAR), and DocMan and when needed investigate the request to validate the information and provide supporting sources to the request. The Contractor shall perform a QC on the data to ensure that the quality and accuracy of captured data is correct. If the quality and accuracy of captured data is not correct, the Contractor shall document the data discrepancies and forward to the Contractor's quality control inspectors for their corrective action.

Document Scanning: The Contractor shall ensure that the electronic image accurately contains the original paper copy received by FDA. The Contractor shall rescan pages discovered not to have been scanned and retain signed QC sheets for all documents scanned into the system. Destruction of inventory criteria is defined as: documents are verified in IMAGE 2000+. Once verified in IMAGE 2000+, documents are available for destruction immediately, however the contractor will hold those paper documents for a period of six (6) months and destroy after the time period has elapsed.

Electronic Copies and Electronic Submissions: The Contractor shall ensure that required information is captured by the system and correct information as required using available data entry systems. For electronic submissions received on compact disc (CD) the Contractor shall also verify that the submission is complete and properly packaged, authenticate that both the signed cover letter and CD are in the package, confirm the metadata information is correct, and validate that the bar code sheet and cover letter pages are readable. Destruction of inventory criteria for CDs and USB drives:

documents are verified in IMAGE 2000+. Once documents from electronic media are verified in IMAGE 2000+/DocMan they are available for destruction immediately, however the contractor will hold these electronic media for a period of six (6) months for Premarket submissions and 12 months for Postmarket submissions and will destroy after this time period has elapsed.

4.3.2. Document Maintenance and Shredding

The Contractor shall store at their facility the various documents identified above until they reach the retention period provided by the TOPM to shred the documents. After a valid eCopy or eSTAR is loaded, the relevant letter is emailed and placed in Image as well. At the end of the retention period all documents/eCopies/eSTARs will be double checked for accuracy and completeness in IMAGE 2000+ before shredding occurs and any discrepancies will be addressed before shredding.

4.3.3. Courier Services

The Contractor shall provide courier runs based on mail volumes each day. Runs shall be done, at a minimum, once a day, or twice a day depending on mail volumes. Mail runs shall occur from the

Contractor’s facility to the FDA White Oak Campus for drop-off and pick-up of documents. The Contractor shall be responsible for maintaining the security and integrity of all documents while performing courier services. The Contractor shall provide two (2), vehicles, primary and backup, to support courier services, as requested by the FIRF IDIQ COR, TO COR, and/or TOPM. The decision shall be based on the incoming document volumes and/or emergency document processing as directed by the FIRF IDIQ COR, TO COR, and/or TOPM.

The Contractor shall familiarize personnel by reviewing document control/mail functions currently in place which support Premarket/Postmarket Tracking Services activities. This review shall be accomplished by studying (or preparing) graphic flow diagrams of the current document control/mail distribution activities, and this information shall be included in the program reviews provided to the government. The Contractor may, at any time, recommend improvements designed to improve processing to the FIRF IDIQ COR, TO COR, and/or TOPM.

4.3.4. User Acceptance Testing (UAT)

The Contractor shall provide User Acceptance Testing (UAT) support for FDA applications and databases that are used on the Premarket/Postmarket Tracking Services program. This includes, but may not be limited to, applications such as: IMAGE 2000+, CEntry, eCopies Loader and Captiva. The Contractor shall be responsible for collaborating with system integrators during requirements gathering sessions and reporting progress to the FDA TOPM. In addition, the Contractor shall participate in various meetings with CDRH employees and other contractors, in testing application updates, documenting findings, analyzing problems when discovered, and recommending fixes or changes to enhance the application updates prior to deployment.

4.3.5. Scanning PreMarket and PostMarket Submissions

The Contractor shall provide assistance with scanning Premarket and Postmarket documents to include routine scanning of paper submissions, historical paper copy submissions and microfiche submissions. For historical copies and microfiche submissions, the Contractor shall first verify whether the submission is loaded into IMAGE. If the submission has not been loaded into IMAGE, the Contractor shall scan the submission and perform a QC on the images to ensure that the quality and accuracy of the scans. Once the submission has been verified in IMAGE, the Contractor shall destroy the documents immediately.

5. Meetings

5.1. Kick-Off Meeting

The Contractor shall participate in an initial meeting with the FIRF IDIQ COR; TO COR, TOPM; and FIRF stakeholders within five (5) business days after the start of the period of performance of this Task Order. The Contractor shall be responsible for preparing meeting notes and providing a copy of those notes to the FIRF IDIQ COR, TO COR and TOPM within two (2) business days after the meeting. The kick-off meeting agenda shall include the following:

• The objectives for the Task Order;

• A high-level overview and discussion of the Project Management Plan;

• Introduction of the Task Order Contracting Officer (CO) and FIRF IDIQ COR; TO COR, TOPM;

as well as the members of the Contractor’s team;

• A high-level overview of the Quality Control Plan.

• A questions and answers regarding the engagement.

Meeting notes shall detail the discussion held at the initial meeting, capture pertinent clarifications to the Task Order SOW, and reflect any areas of disagreement or misunderstanding on the part of either the FDA or the Contractor.

5.2. Site Visits

The FIRF IDIQ COR, TO COR, or TOPM, and at the FDA’s discretion, may perform site visits at the FIRF with the Project Manager and Supervisor(s). The site visit schedule shall be mutually agreed upon by both parties. If a site visit is cancelled, the cancelling party shall give the other party at least 24 hours’ notice prior to the scheduled site visit date.

5.3. Monthly Meeting

One (1) virtual meeting shall be held each month between the Contractor’s Program (Contract) Manager; Project Manager; Supervisor(s); and the FIRF IDIQ COR, TO COR, TOPM and other FIRF stakeholders. The meetings shall be held to discuss general Task Order progress; current issues/resolutions; previous business; QC issues; staffing changes; status of Government-Furnished Equipment; to provide the Contractor with FDA guidance; and any other topics as deemed necessary by any party.

The Contractor shall provide the meeting agenda to the FIRF IDIQ COR, TO COR, and TOPM two (2) business days prior to the meeting date. The Contractor shall provide the meeting minutes within two

(2) business days after the meeting has been held.

5.4. Program Reviews

FDA/CDRH expects the Contractor to be a partner in this program so premarket/postmarket tracking and records retention/disposal can be streamlined and made more efficient while maintaining high quality and timely entry of reports. The Contractor shall host two (2) program reviews each year.

During the program review, the Contractor shall discuss project status (to include staffing status (current and future), data entry backlog if any), organization chart with current names of all employees; project progress, efficiency and cost savings achieved, difficulties, and issues encountered, along with possible solutions. The Contractor shall be responsible for all of the data tracking needed to be able to analyze submission trends and assist in making recommendations for future anticipated submissions.

5.5. Emergency Meetings

For emergency processing matters/performance issues, the Program (Contract) Manager and Project Manager shall be available during normal duty hours upon request (within two (2) hours) by the FIRF IDIQ COR, TO COR or TOPM to meet (either at the Contractor’s facility, FDA’s White Oak Campus, by phone, or virtually) with Government personnel to discuss problem areas. After normal duty hours, the Program (Contract) Manager and Project Manager shall be available upon request at a time mutually agreed to the next business day.

The following are representative of the meeting types that the Contractor shall be expected to perform:

Meeting Activity Typical Location(s) Estimated Occurrences

Kick-Off Meeting

Meet with FIRF IDIQ COR, TO COR, TOPM, and CO, and-Personnel to review and finalize

Virtually (Teams, Zoom)

Within five (5) business days from the start date of Task Order.

Site-Visits Meet with FIRF IDIQ COR, TO COR, TOPM, Project Manager, Supervisor(s) and Program (Contract) Manager

Contractor’s facility, phone, or virtually (Teams, Zoom)

The site visit schedule shall be mutually agreed upon by both parties.

Monthly Meeting

Meeting with FIRF IDIQ COR, TO COR, TOPM, and Program Staff, Program (Contract) Manager; Project Manager, Supervisor(s)

Virtually (Teams, Zoom)

Meeting will be held monthly

Program Reviews

Meeting with FIRF IDIQ COR, TO COR and TOPM

Virtually (Teams, Zoom)

Bi-annually

Emergency Meetings

Meeting with FIRF IDIQ COR, TO COR, and TOPM

FDA White Oak Campus, Contractor’s facility, phone, or virtually (Teams, Zoom)

As agreed upon between

FIRF IDIQ COR, TO COR,

TOPM, Program (Contract) Manager, and Project Manager.

6. Deliverables

6.1. Standard Operating Procedures (SOPs)

The Contractor shall maintain detailed written SOPs that are accessible to FDA at all times. Existing SOPs will be provided to the Contractor after Task Order award. The Contractor shall present to the FIRF IDIQ COR, TO COR, and/or TOPM revisions and additions to the SOPs for review and comment as changes occur. The Contractor shall incorporate the Government’s comments in the revised SOPs within two (2) business days and implement the changes. The SOPs will be provided upon award to illustrate the many steps involved with record tracking and records retention/disposal. The SOPs are not intended to act as exact protocols for the Contractor to follow.

6.2. Manuals, Logs, and/or Checklists

The Contractor shall maintain manuals, logs, and/or daily checklists that identify letters mailed and documents received by the Contractor. The FIRF IDIQ COR, TO COR, or TOPM may request an original and a copy of these manuals, logs, or checklists on an as needed basis.

6.3. Monthly Progress Reporting

The Contractor shall provide an original and electronic copy of the monthly progress report to the FIRF IDIQ COR, TO COR, and TOPM by the tenth (10th) calendar day of each month, for the previous month’s actions. The report shall include the following:

• Number of regulated documents received, processed, entered, etc.

• Document type status.

• Summary of added, modified, or deleted SOP procedures as directed by the TO COR and/or

COR designee.

• Deliverables for the month.

• An overview of work completed, in progress, and planned for each task.

• Identification of problem areas with recommended remedial actions.

• Identification of risks and mitigation plans.

• Challenges and issues.

• Any necessary revisions to the Project Management Plan or Quality Control Plan.

• Number of pages scanned (by type of document/submission).

Also included in the monthly report shall be specific sections for any changes to the SOPs for the month.

6.4. Daily Report

The Contractor shall prepare and provide a daily report to the FIRF IDIQ COR, TO COR, and/or TOPM for review and comment. The Contractor shall maintain a reference file of these reports.

For each day, the daily report shall include:

• Total number of submissions received;

• Total number of submissions processed;

• Total number of submissions partially processed and supporting rationale;

• Total submissions received for the current work week;

• Total submissions received for the current work month; QC error report including number of documents QC’d, number of documents pending QC, number of errors located by senior staff;

• Total of rejection notifications sent out for eCopy and User Fee;

• If IT related issues; provide a percentage of IT down time per daily processing and per contractor staff;

• Provide details of any equipment issues.

• Any other report information that would be useful to include in the daily report as agreed to between the Contractor and TOPM.

6.5. Deliverable Schedule

Be advised that FDA does not accept documents which contain the use of macros. When submitting documents via email, DO NOT include .exe, .mso, or any other executable file types that could potentially trigger email security protections (i.e. email blocks, quarantine). Document submissions required throughout the award period(s) shall not have macro-enabled functionality and any document delivered having that functionality will be deemed delinquent, if not corrected prior to the due date.

Deliverable Title Quantity/Frequency Due Date(s)

Quality Control Plan Original and electronic copy

Draft Quality Control Plan submitted with Technical Proposal; FIRF IDIQ COR, TO COR and TOPM will provide comments to Contractor within ten (10) business days from the start date of the task order period of performance; Contractor shall provide the Final Quality Control Plan (Task Order specific) to the FIRF IDIQ COR, TO COR, and TOPM within five (5) business days from receipt of FIRF IDIQ COR, TO COR and TOPM’s comments and for each option period at the beginning of the period of performance and again four (4) months before the end of the period of performance.

Quality Control Monthly Information as part of monthly report

Original and electronic

Contractors shall submit to the FIRF IDIQ COR, TO COR, and TOPM as part of monthly reports

Project Management Plan Original and electronic copy

Note: The schedule shall be in MS Project format and supplemented with any text (Word) necessary to discuss activities.

Draft Plan submitted with Technical Proposal; FIRF IDIQ COR, TO COR and TOPM will provide comments to Contractor within ten (10) calendar days from the start date of the task order period of performance; Contractor shall provide the Final Plan within five (5) calendar days from receipt of FIRF IDIQ COR, TO COR and TOPM’s comments and again four (4) months before the end of the period of performance. Additionally, the Plan will be updated and submitted to the FIRF IDIQ COR, TO COR, and TOPM as changes occur.

Staffing Plan Original and electronic copy

A draft Staffing Plan shall be submitted with Technical Proposal. An updated Staffing Plan shall be submitted prior to the exercise of an Option Period to justify staffing needs.

Security Documentation/Paperwork for all employees

Original and electronic copy

Contractor shall submit documentation to COR within five (5) business days from kick-off meeting. FIRF IDIQ COR and/or TO COR will submit documentation for FDA Security review/approval.

Kick-Off Meeting Notes Original and electronic copy

Contractor shall submit two (2) business days after kick-off meeting to FIRF IDIQ COR, TO COR, and TOPM.

Monthly Progress Report Original and electronic copy

Contractor to submit to FIRF IDIQ COR, TO COR, and TOPM on or before the tenth (10th) calendar day of each month

Monthly Meeting Agenda Electronic copy to the COR

Contractor to submit to FIRF IDIQ COR, TO COR, and TOPM within two (2) days prior to the meeting date.

Monthly Meeting Minutes Electronic copy to the COR

Contractor to submit to FIRF IDIQ COR, TO COR, and TOPM within two (2) business days after conclusion of the meeting.

SOPs (new and revisions) Original and electronic copy (and

CC COR)

Contractor shall submit new SOPs to the FIRF IDIQ COR, TO COR and TOPM for review. The , TO COR and/or TOPM will return comments within ten (10) calendar days. The Contractor shall finalize the SOP within five (5) calendar days from receipt of comments.

Government-Furnished Equipment (GFE) Inventory

Original and electronic copy

Contractor submits to FIRF IDIQ COR, TO COR, and TOPM information about GFE in biannual program reviews.

Daily Report Electronic Provide by 10:00 AM the following business day to the FIRF IDIQ COR, TO COR, and

TOPM

Transition-In Plan (includes schedule)

Original and electronic copy

Draft Plan submitted with Technical Proposal; TO COR and TOPM will provide comments during Kick-off Meeting, Contractor shall provide the Final Plan within two (2) business days after the kick-off meeting.

Transition-In Meeting Minutes

Original and electronic copy

Within two (2) business days after conclusion of meeting.

Transition-Out Plan (includes schedule)

Original and electronic copy

Contractor to submit Initial Plan within ten

(10) calendar days of the Government exercising the Optional Transition-Out Services via written notice from the TO CO;

FIRF IDIQ COR, TO COR, and TOPM will provide comments to Contractor within ten

(10) calendar days from submission of Initial Plan; Contractor shall provide the Final Plan within five (5) calendar days from receipt of comments

Transition-Out Meeting Minutes

Original and electronic copy

Contractor submits to FIRF IDIQ COR, TO COR, and TOPM within two (2) business days from transition-out meeting.

7. Contractor Personnel

7.1. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

• Confidentiality: [ ] Low [ ] Moderate [X ] High

• Integrity: [ ] Low [ ] Moderate [ X] High

• Availability: [ ] Low [ X] Moderate [ ] High

• Overall Impact Level: [ ] Low [ ] Moderate [ X] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/Task Order involves:

[] No PII [ X ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries. FDA personnel must also request loaner GFE from the FDA Foreign Travel program for official travel to any foreign country. Please see the FDA IS2P, Appendix T Government Furnished Equipment for Foreign Travel.

h. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS and FDA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

i. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

j. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115- 232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25.

The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

k. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

l. Contract Documentation. The Contractor must use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

m. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with an encryption solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificates from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

n. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the FDA non-disclosure agreement (3398 Form), as applicable.

Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable FDA information security awareness, privacy, and records management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete FDA information security awareness, privacy, and records management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and FDA policies and standards.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Agency data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to…