Attachment I - CLAT IDIQ SOW.pdf

SOLICITATION NO.: FDA-20-SOL-1223486

Attachment I: CLAT IDIQ SOW

Computerized Labeling Assessment Tool (CLAT) Services

ATTACHMENT I:

IDIQ STATEMENT OF WORK

Indefinite Delivery Indefinite Quantity (IDIQ)

Request for Proposal (RFP)

FDA Center for Drug Evaluations (CDER) Small Business (SB) Set-Aside

NAICS Code 518210, SB standard $35M

I. BACKGROUND

The mission of the U.S. Food and Drug Administration (FDA) is to protect the public health (www.fda.gov). As part of this mission, FDA is responsible for ensuring the safe use of drug products by minimizing medication errors related to the product’s name, labeling, packaging and design.

The Division of Medication Error Prevention and Analysis (DMEPA) within the FDA, Center for Drug Evaluation and Research (CDER), Office of Surveillance and Epidemiology (OSE) is the scientific lead for medication error prevention and analysis for CDER-regulated prescription and nonprescription drug products. DMEPA’s responsibilities include the premarket (preapproval) and post-market review of drug product labeling (e.g., container labels, carton labeling, prescribing information, Drug Facts, Instructions for Use) to minimize the risk of medication errors. An overview of DMEPA’s mission and responsibilities can be found on the FDA website: https://www.fda.gov/drugs/drugsafety/medicationerrors/.

Biopharmaceutical companies electronically submit drug product labeling to FDA using various file formats (e.g., Word, PDF, XML, JPEG). DMEPA and other offices within FDA review the labeling to ensure the drug product conforms with applicable statues, regulations, standards, FDA guidance for industry, best practices for patient safety, and experience gained through FDA’s post-marketing surveillance program. If the FDAs review of the submitted labeling identifies potential deficiencies or inconsistences, FDA requests the company revise the labeling and resubmit it for additional review.

See Appendix A for a use case that provides an overview of the drug product labeling submission and review process.

Much of the FDA review of drug product labeling is manual, and thus labor- and time-intensive, and may be subjective based on individual reviewer perspective or prone to possible discrepancies related to human factors. FDA reviewers locate and download the files containing the drug product labeling;

manually review the submitted labeling against an internally-generated list of statutes, regulations, standards, FDA guidance for industry, and best practices for medication error prevention; create a written document that includes the review findings and recommendations; and then repeats this process if the company submits revised labeling.

The FDA offices who may participate in this contract include:

CDER, Office of Surveillance and Epidemiology CDER, Office of New Drugs CDER, Office of Generic Drugs CDER, Office of Pharmaceutical Quality CDER, Office of Compliance

FDA has many offices with different responsibilities for reviewing drug product labeling. To this goal, automating all or portions of manual review activities shall increase efficiencies, and help standardize reviews to ensure consistency across different products.

As part of FDA’s Technology Modernization Action Plan, FDA intends to apply novel and rapidly evolving technologies at an increasing pace to advance FDA’s public health mission (https://www.fda.gov/about-fda/reports/fdas-technology-modernization-action-plan). As FDA transitions to these technologies, it is expected that tasks under this contract shall be impacted. These impacts shall be assessed as they occur http://www.fda.gov/ https://www.fda.gov/drugs/drugsafety/medicationerrors/ https://www.fda.gov/about-fda/reports/fdas-technology-modernization-action-plan https://www.fda.gov/about-fda/reports/fdas-technology-modernization-action-plan and modifications to task orders under this contract may need to be considered.

II. OBJECTIVES

FDA requires a comprehensive solution to best accomplish FDA specific mission objectives to ensure the safe use of drug products by minimizing medication errors related to drug product labeling. These objectives include the following:

• Automate drug product labeling reviews

• Implement and promote operational and cost efficiencies

III. PROJECT SCOPE

The Government requires drug product labeling review support services for prescription and nonprescription drug products, that includes:

• Develop a Computerized Labeling Assessment Tool (CLAT) that meets FDA standards (e.g., security, usability, cloud infrastructure) and can be used to perform automated labeling review activities

• Implement CLAT in FDA’s environment that meets FDA’s infrastructure and security standards

• Access and organize submitted labeling files

• Apply automated capabilities to perform labeling assessments

• Report review findings (includes analytics and data visualization tools)

• Workload and performance metrics

• Use of open source software, artificial intelligence and other novel or emerging technologies to develop CLAT

• Test, and validate CLAT

• Evaluate new or additional labeling review activities for possible automation

• Enhance or expand functionality and capabilities for automated labeling review assessments by additional FDA offices and the public

• Quality assurance, quality control, and quality improvement

• User experience and user interface design

• Integrate CLAT with other internal or external data sources

IV. CONSTRAINTS

For all tasks the Contractor shall:

• Conduct all software implementation activities in a manner consistent with the Health and Human Services (HHS) Enterprise Product Life Cycle (EPLC), unless a waiver is granted by the FDA Contracting Officer Representative (COR). In all cases where the Contractor seeks to pursue an alternative to the EPLC, the request shall be made in writing (email acceptable) to the FDA Task Order (TO) Project Manager (PM) and/or the IDIQ COR. In all cases, permission to substitute or omit EPLC artifacts or otherwise interpret the EPLC requirements for this project shall be provided on behalf of the government by the FDA COR or his/her delegate.

• Work with CDER Information System Security Officer (ISSO) to maintain Federal Information Security Management Act (FISMA) regarding all software and software related processes. This may include physical security access controls.

• Utilize configuration management procedures approved by the FDA Task Order (TO) COR.

• Support the activities of the Configuration Control Boards and the Technical Control Boards of the programs that shall interface with CLAT and assist in the development and documenting of problem/change requests.

• Practice version control of all critical project documents and all application and database components. The Contractor shall work with FDA configuration management support staff to utilize existing configuration management practices and tools. The Contractor shall use tools approved by the Architecture Review Team (ART) of the FDA.

• Assist with FDA quality control audits by attending meetings and providing required information to verify that quality assurance practices are being followed.

• Follow the Hardware and Software specifications, and Security requirements once infrastructure within the FDA environment is defined, identified and documented by the Contractor.

• Interact, coordinate and work with other contractors designated by FDA to ensure successful integration of the various components that comprise in the Task Order.

• Provide a complete transition of work to a subsequent vendor, as necessary at the end of the contract.

• The Contractor shall utilize their own development environment to develop the prototype for CLAT as defined in Task1: Prototype for a Computerized Labeling Assessment Tool (CLAT), but the government shall own all software for the work done on this contract. Any exceptions must be in written form and signed by the FDA Contracting Office Representative (COR).

V. TASK AREAS

The Government requires a comprehensive solution to satisfy the stated objectives that provides all necessary services, qualified personnel, material, equipment, tools and methodologies, not otherwise provided and subject to approval by the FDA, to perform the following tasks:

• Task 1: Prototype for a Computerized Labeling Assessment Tool (CLAT)

• Task 2: Development, Modernization, and Enhancement (DME)

• Task 3: Operation and Maintenance (O&M)

• Task 4: Contract and Task Order Level Project Management

• Task 5: Development, Modernization, and Enhancement for Other FDA Offices and Public

A. TASK 1: PROTOTYPE FOR A COMPUTERIZED LABELING ASSESSMENT TOOL (CLAT)

As tasked, the contractor shall develop and deliver a prototype for a Computerized Labeling Assessment Tool (CLAT) that can be used to perform automated drug product labeling reviews.

The Contractor shall perform and adhere to the following:

• Project management, which includes planning, staffing, coordinating, scheduling, managing, communicating, reporting, and stewarding all tasks, activities and deliverables.

• Gathering, documenting, analyzing and validating business and system requirements in support of operational needs to satisfy FDA’s business goals.

• Decomposing stakeholder business requirements into detailed functional requirements.

• Transforming stakeholder DME business requirements into a detailed system design that describes the system architecture, its components (i.e., hardware and/or software), and their system interfaces and specifications.

• Define the business, functional and system requirements to ensure a common understanding of the functionality among business, IT stakeholders, and the development team.

• Develop a Computerized Labeling Assessment Tool (CLAT) that includes testing, validating, and incorporating appropriate open-source software, artificial intelligence and other technologies to perform labeling assessments; generating training and test files; user experience and user interface designs.

• Access and organize drug product labeling files and folders, which includes uploading the labeling files to the application; creating network, local computer, or application folders; and providing version control.

• Apply automated capabilities to a list of labeling review activities for prescription and OTC drug products, which includes identifying the software and other technologies needed to perform automated checks for the product identifier, linear barcode, appropriate size and prominence of the product name, required strength expression, use of error-prone abbreviations, and other review activities.

• Perform needs assessment of drug labeling review activities, which includes categorizing activities as low, medium or high complexity for possible automation.

• Ensuring that business requirements and associated use cases are translated for the design and development activities using appropriate tools and techniques (e.g. use cases, site maps, module flows, wireframes, and functional prototypes).

• Reporting review findings, which includes the review activities performed by CLAT, identified deficiencies or inconsistencies; generating the findings into a word processing document or spreadsheet.

• Provide quantitative and qualitative measures and metrics, which includes the number of reviews performed using CLAT, frequently identified deficiencies, amount of time to perform an automated review.

• Provide an assessment that defines the resources and path for the FDA authority to operate certificate, which includes the infrastructure requirements for an FDA production environment, central processing units, memory, servers, and software, 508 compliance, and security documentation and certification.

• Quality assurance, quality control, and quality improvement.

• Develop and deliver an assessment of the infrastructure requirements for a development, test, pre-production and production environments within FDA, but not limited to server provisioning and open source software that shall be required to perform Task 2: Development Modernization and Enhancement (DME).

B. TASK 2: DEVELOPMENT, MODERNIZATION, AND ENHANCEMENT (DME)

The contractor shall perform Development, Modernization, and Enhancement (DME) activities to expand and implement CLAT to meet stakeholder requirements for DMEPA. The contractor shall ensure CLAT is effective in meeting DMEPA’s needs.

The Contractor shall perform and adhere to the following:

Use the infrastructure assessment requirements delivered in Task 1 to prepare and setup infrastructure within FDA for all four environments in collaboration with Office of Information Management and Technology (OIMT).

• Document any additional FDA requirements gathered during prototype development and testing.

• Providing updated Business Architecture support by conducting business analysis, modelling, business solutions and architectures that promote reuse of design components, data, workflows, and patterns.

• Deploy the prototype developed in Task 1 in FDA’s development environment for refinement. This includes but not limited to:

o Expanding functionality, features and capabilities for any additional FDA requirements o Development of interfaces and system integration o Automating processes, if any identified during the prototype building that increases efficiency.

o Fix any issues identified during prototype testing o Improving performance and capacity o Modifying to be compliant with Government standards and HHS related regulatory and security policies.

o Modifying or enhancing based on best in industry practices

• Deploy the refined tool in FDA’s environments all the way from test to pre-production and production environments.

• Updating System Documentation per development release

• Developing Test Plans and conducting tests. These activities include but not limited to:

o Developing test specifications (i.e. test strategy, test plans, test scenarios, test cases, procedures/scripts, etc.) and documenting test results of all categories of testing o Performing development of the required system components using FDA approved software o Performing unit, system, regression, performance and integration testing of the applications, tools, automated workflows and interfaces o Facilitate and coordinate user acceptance testing o Conducting performance/stress testing o Conducting 508 requirements testing

C. TASK 3: OPERATION AND MAINTENANCE (O&M)

As tasked, the contractor shall provide operation and maintenance for the Computerized Labeling Assessment Tool (CLAT) application. This includes maintaining and upgrading the application, providing customer support, refreshing data, supporting performance requirements, performing quality assurance, and complying with FDA security and technical standards.

The Contractor shall perform and adhere to the following:

• Maintaining code, scripts, designs, documentation, reports, and templates;

• Analyzing and reporting the impact of infrastructure, software upgrades, capacity, and other changes to the CLAT environments;

• Participating in the Change Management process and responding to Change Request (CR)

• Enhancing the implemented tools and technologies based on documented and approved CRs;

• Perform evaluation, recommendation and implementation of new data sources, tools and technologies to enhance pharmacovigilance and product quality related activities;

• Conducting System Administration activities;

• Conducting issue identification and management;

• Developing test plans and conducting tests. These activities include but not limited to:

o Developing test specifications (i.e. test strategy, test plans, test scenarios, test cases, procedures/scripts, etc.) and documenting test results of all categories of testing o Performing development of the required system components using FDA approved software.

o Performing unit, system, regression, performance and integration testing of the applications, tools, automated workflows and interfaces o Facilitate and coordinate user acceptance testing o Conducting performance/stress testing o Conducting 508 requirements testing

• Collaborating with database administrative staff to ensure availability of technical environments;

• Maintaining software operational levels based on severity levels;

• Providing user support that shall include but limited to:

o Provide Support for associated software products for the FDA/Office of Information Management (OIM) Infrastructure Division Call Center in matters related to systems supported by this IDIQ trouble calls from 9:00AM -4:00PM EST, Monday through Friday.

o Maintain a log of trouble calls, problems reported and the resolution to problems. FDA and the Contractor, per request of COR, shall create and submit defect reports and recommend change requests on behalf of end users.

o Respond to service request based on severity. Ticket closure shall be initiated after user satisfaction is confirmed.

o The use support process entails: monitoring, correcting the issue, and responding to the customer, then closing the ticket.

o Working with FDA resources and within FDA’s processes to investigate reported issues, identify root causes, and provide solutions.

• Conducting performance monitoring and tuning;

• Monitoring data quality and conducting quality assurance;

• Providing back-up and recovery support;

• Providing data quality management;

• Provide training to stakeholders for initial user training of CLAT as well as application changes, or newly developed applications/modules. Representative activities in this task area include but are not limited to:

o Providing end user and stakeholder training o Providing various types of training, to include but not limited to 1:1, web based, standard commercial training, train the trainer, and customized classes o Preparing training materials

• System Disposition and Document Support.

• Provide emergency patching and troubleshooting support to maintain or restore system availability

• Deploying regular patches, enhancement and updates as they become necessary or available

• Providing upgrade support to database, middle-tier software versions and any open source software used

D. TASK 4: CONTRACT AND TASK ORDER LEVEL PROJECT MANAGEMENT

Contract Program Management

The contractor shall provide contract-level program management to achieve objectives and establish project plans, organization structures, processes, schedules, reporting requirements, communication channels, and quality control functions necessary to successfully execute the delivery, configuration, implementation, and maintenance of the CLAT software throughout the contract’s period of performance.

IDIQ Monthly Status Report

The contractor Program Manager (PM) shall provide a monthly contract level status report to the IDIQ Contracting Officer’s Representative (COR), incorporating all tasks at a high level and their progress.

Within the first 30 days after contract award, the Government and the Contractor PM shall design and agree upon a standard reporting format that includes the following information at a minimum:

The Contractor PM shall escalate issues related to any impediment to progress towards any deliverables defined in the IDIQ or an individual Task Order. The Contractor shall follow escalation procedures consistent with the line of command in FDA. The Contractor shall follow this order of escalation when reporting to FDA personnel:

• IDIQ Contracting Officer Representative (COR)

• Contracting Officer (CO)

Quality Management

The contractor PM shall provide Quality Management activities as identified in individual task orders.

Quality Management activities for this contract includes but is not limited to meeting Service Level Agreements identified in individual task orders; ensuring proper handling and safeguarding of sensitive data; identifying and mitigating risks; resolving issues; and adhering to processes and procedures. The Contractor shall develop Quality Management Plans for individual task orders based on American Society for Quality (ASQ) and Information Technology Infrastructure Library (ITIL) standards. The contractor may also be tasked to provide guidance on proper quality assurance methods related to document control, records or information activities.

The contractor PM shall provide service delivery models to the FDA on a quarterly basis as identified in individual task orders. Service Delivery Models include:

• Identification and Definition of Service Improvements

• Documentation of Measurement Baselines and Benchmarks for the Defined Improvements

• Monitoring and reporting on Performance Quality

• Designing, administering, and reporting on stakeholder and customer viewpoints via the use of surveys and/or questionnaires

Task Order Level Project Management

For the task orders released under this contract which could be parallel or sequential, the Contractor shall provide task order level project management to establish control, management, monitoring and notification mechanisms, ensuring that contracted tasks stay on track and important milestones and performance measures are met. For each task order, the Contractor shall prepare a Task Order Management Plan describing the technical approach, organizational resources, risk management, quality assurance and other management controls to be employed to meet the cost, performance and schedule requirements throughout task order execution. The Contractor shall use internal processes consistent with the FDA’s Enterprise Performance Lifecycle (EPLC) and IT standards.

Monthly Status Reports

The contractor PM shall provide monthly status reports on awarded task orders to report on the progress of activities identified in individual task orders and their progress to the Contracting Officer Representative (COR). Within the first 30 days after contract award, the Government and the Contractor shall design and agree upon a standard reporting format that typically includes the following information at a minimum and may be modified in individual task orders:

• Identify overall progress of the project;

• Identify and describe progress on planned deliverables;

• Account for delivered products and services;

• Identify action items for the following month;

• Identify current, scheduled, or future training or training needs;

• Provide status on technical support issues;

• Identify status of in-progress and new Change Control Requests;

• Report Configuration or customization issues;

• Report current or anticipated problems with scheduled activities;

• Identify project risks to schedule, cost, and quality and provide risk mitigation strategies;

• Address Invoice issues or concerns;

• Identify accomplishments

In addition to the monthly status reports the contractor PM shall provide weekly project status reports to the COR identified in individual task orders. These reports present on-going activities, new activities, activities completed; progress to date on all above-mentioned activities; problems and corrective actions taken; risks, issues or concerns and proposed resolutions to address or mitigate them and, Government actions required.

Meetings

As tasked, the contractor PM shall support regularly scheduled and impromptu formal and informal meetings including, but not limited to weekly meetings, monthly meetings, informal review meetings, and formal presentations. Depending on the type of meeting, the Contractor may be tasked with preparing materials for and participating in all required meetings to ensure that adequate information is disseminated relative to the project status, governance council, and project team reviews.

Representative tasks for meetings include the following activities but not limited to:

• Schedule meeting place and time (meeting could be conducted remotely)

• Provide supporting information that may be required to include agendas

• Ensure all necessary materials are distributed far enough in advance to allow for review

• Prepare meeting room

• Give presentations

• Facilitate discussions

• Summarize discussions

• Draft notes and/or minutes of the proceeding

• Facilitate kickoff meeting

Change Management

The Change Management process establishes an orderly and effective procedure for tracking the submission, coordination, review, evaluation, categorization, and approval of all changes to the project’s baselines.

Types of Changes

There are four forms of changes to the CLAT System: PCRs, CRs, Defects, and ICRs. All of these changes shall be tracked and managed using the JIRA CM tool.

• Change Request (CR) – These change requests outline changes to the original baseline of the approved scope, requirements, technical changes, etc. Change Requests are tracked and maintained in the JIRA application. The formal change request process for CRs is outlined in this document.

• Defect – A defect is a condition in a software product which does not meet a software requirement or end-user expectations. Defects are tracked and maintained in the JIRA application and the formal process for defects is outlined in this document.

• Investigational Change Request (ICR) – Investigational Change Requests are CR’s that needed more than six hours of analysis in order to determine a technical approach and level of effort.

Investigational Change Requests are tracked and maintained in the JIRA application and the formal process for ICRs is outlined in this document.

• Process Change Request (PCR) – Process change requests propose changes to approved EPLC documentation. Changes to approved EPLC documentation must be approved by all signatories of the original document. All EPLC documentation shall be managed, reviewed, and updated thru Version Manager (VM).

Release Management

The contractor shall work with Office of Information Management and Technology (OIMT) to support the development and deployment of system releases to the appropriate environments. The FDA categorizes releases as Initial, Major, Minor, or Emergency/Patch. These release types are defined as:

• Initial Release: Scheduled first release of a new system.

• Major Release: A major release is a planned release that provides major functional changes to or extensions of the product. Major releases are usually not backward compatible with previous releases.

• Minor Release: Scheduled release to include defect corrections and/or minor enhancements, including software changes necessary to support system or patches. Minor releases are backward compatible with all releases up to the last prior major release.

• Emergency Release: Release to correct one or more problems with a system that is negatively impacting functionality and requires prompt resolution. Emergency Releases are added to the project schedule as needed upon approval by COR and/or Project Manager.

Documentation

The contractor PM shall provide documentation specific to the technical solution applied. Documentation may include software technical specifications, test scripts, configuration and installation guides to support a secure and authorized solution.

The contractor shall work with the COR to determine the appropriate EPLC documentation required for implementation, Operations and Maintenance (O&M), and Development, Modernization and Enhancement (DME) work performed on the CLAT tool under this IDIQ contract. The contractor shall create agreed upon documentation and submit to the COR. Typical documents include but are not limited to (See RFP Attachment 10: EPLC Artifacts for more detail on Agile methodologies):

• Project Charter / Project Process Agreement (PPA);

• Work Breakdown Structure (WBS);

• Risk Management Plan and Risk Tracking Log;

• Business Requirements Document (BRD);

• Project Management Plan and Schedule;

• Systems Requirement Specification (SRS);

• System Design Document;

• Requirements Traceability Matrix;

• Test Planning and Reporting;

• Training Plan and User Help;

• Version Description Document (VDD)

• Authorization to Operate (ATO) - The contractor shall support FDA stakeholders to identify and document security requirements associated with obtaining the Authorization to Operate (ATO) including NIST SP 800-53 Rev. 3. As tasked, the contractor shall document updated control descriptions for any NIST SP 800-53 Rev. 3 controls that shall be impacted due to the work performed.

E. TASK 5: DEVELOPMENT, MODERNIZATION, AND ENHANCEMENT FOR OTHER FDA OFFICES

AND PUBLIC

The contractor shall perform Development, Modernization, and Enhancement (DME) activities to build and expand CLAT to meet stakeholder requirements for other CDER Offices. Specifically, the contractor shall gather requirements, develop and implement CLAT for other CDER Offices. The contractor shall ensure CLAT is effective in meeting other CDER Office and public needs.

The Contractor shall perform and adhere to the following:

• Gathering, documenting, analyzing and validating business and system requirements in support of operational needs to satisfy other FDA Office business goals and DME efforts;

• Decomposing stakeholder DME business requirements into detailed functional requirements

• Transforming stakeholder DME business requirements into a detailed system design that describes the system architecture, its components (i.e., hardware and/or software), and their system interfaces and specifications

• Ensuring that business requirements and associated use cases are translated for the design and development activities using appropriate tools and techniques (e.g. use cases, site maps, module flows, wireframes, and functional prototypes).

• Providing updated Business Architecture support by conducting business analysis, modelling, business solutions and architectures that promote reuse of design components, data, workflows, and patterns.

• Expanding functionality, features and capabilities for additional FDA offices and the public

• Define the business, functional and system requirements to ensure a common understanding of the functionality among business, IT stakeholders, and the development team

• Development of interfaces and system integration

• Improving performance and capacity

• Automating processes, if any identified during the initiation and concept phase that increases efficiency.

• Evolving design to meet the changing needs of the stakeholder requirements and new regulations

• Developing Pilots/Prototypes as requested to test CLAT before being released into production

• Modifying to be compliant with Government standards and HHS related regulatory and security policies.

• Modifying or enhancing based on best in industry practices

• Updating System Documentation per development release

• Developing Test Plans and conducting tests. These activities include but not limited to:

o Developing test specifications (i.e. test strategy, test plans, test scenarios, test cases, procedures/scripts, etc.) and documenting test results of all categories of testing o Performing development of the required system components using FDA approved software o Performing unit, system, regression, performance and integration testing of the applications, tools, automated workflows and interfaces o Facilitate and coordinate user acceptance testing o Conducting performance/stress testing o Conducting 508 requirements testing

VI. TRANSITION ACTIVITIES

The contractor shall provide transition-in and transition-out services for up to sixty (60) days to ensure both the incumbent and successor contractor staff have the knowledge and tools to ensure the system is operational and effectively supports regulatory labeling review objectives. The purpose of the transition periods is to receive or transfer expert knowledge, data, and artifacts that are used to support the application. The contractor shall negotiate in good faith a plan with a successor to determine the extent of transition-in, transition-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan and shall be subject to the COR’s approval.

Representative Transition activities are as follows:

• Develop Transition-In or Transition-Out Plan to include a training program to ensure full operating accountability and responsibility of the operational task order

• Understand roles and responsibilities of incumbent and successor staff

• Engage in regularly scheduled meetings

• Plan and engage in knowledge transfer meetings

• Receive or transfer all system documentation

• Receive or transfer all workflows and business process development documentation

• Transfer source codes, if applicable

• Receive or transfer system administration responsibilities

• Receive or transfer current Change Requests

• Discuss change management processes and any other outstanding issues

• Receive or transfer Government Furnished Property or Information

VII. QUALITY ASSURANCE SURVEILLANCE PLAN

The COR will, in addition to providing documentation to the Contracting Officer, maintain a complete Quality Assurance file. The file shall contain copies of all reports, evaluations, recommendations, and any actions related to the Government’s performance of the quality assurance function, including the originals of all Surveillance Activity Logs. All such records shall be retained for the life of this contract. The COR shall forward these records to the Contracting Officer at termination or completion of this contract.

Criterion Description Performance Standard

Acceptable Quality Level Surveillance Method & Assessment

1 Demonstrates applicable project expertise specific to each task order

Compliance with all SOW requirements

100% of all deliverables in compliance with performance standards

• 100% Inspection

• Stakeholder feedback/survey evaluations

2 Quality of Deliverables

Deliverables are complete and meets all

SOW

requirements

• Acceptable: Two (2) or fewer revisions or resubmissions per document

• Unacceptable:

Three (3) or more revisions or re-submissions per document

100% inspection

:3 Timely submission of deliverables

Deliverables are delivered on time and meets all SOW requirements.

• Acceptable:

Deliverable is submitted by the assigned due date.

• Unacceptable: A deliverable is submitted after the assigned due date without government approval to adjust the due date

100% inspection

VIII. PLACE OF PERFORMANCE

The work to be performed under this contract will be performed at contractor’s facility.

IX. PERIOD OF PERFORMANCE

The total period of this task order is one, 12 month Base Period and four (4) 12 month Option Periods from the date of award.

X. ADVANCE UNDERSTANDING

All source code produced for the CLAT system will be owned by the government. Any paper or electronic documentation for the system will also be owned by the government and cannot be copyrighted by the Contractor nor should the Contractor’s name or company logo be affixed to any paper or electronic documentation.

XI. OBSERVANCE OF LEGAL HOLIDAYS & OTHER GOVERNMENT CLOSINGS

Coverage is expected during all Federal work days. Services will not be performed at the Federal site when the Federal Government is closed for reasons such as inclement weather or executive order. No services or deliveries shall be performed at the Federal sites on Federal legal holidays as shown below unless specifically requested by the COR (in the best interest of industry coverage).

• New Year’s Day

• Birthday of Martin Luther King, Jr.

• Washington’s Birthday

• Memorial Day

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

XII. OTHER DIRECT COSTS

Any Other Direct Costs (ODC) should be submitted through the invoice. All OCD over $3,500, other than those ODC acquired under the firm fixed price line items, must be pre-approved by the Contracting Officer, if not already approved through the issuance of a task order or modification.

To be eligible to receive reimbursement for ODC the Contractor must obtain at least three quotes for each transaction in excess of $3,500.00 to ensure that adequate price competition was sought, or the Contractor must provide an acceptable justification as to why it was impracticable to do so. For purchases of ODC, the Contractor shall provide the aforementioned documentation with every ODC purchase request to the Contracting Officer.

The Contractor shall maintain documentation of all reimbursable purchase until three years after the contract is completed and shall provide access to and copies of such documentation when requested by the Contracting Officer.

The Contracting Officer may reduce the reimbursement by any amount above that which the Contracting Officer funds, in his / her sole discretion, is greater than that which is fair and reasonable for the ODC giving due consideration to the facts and circumstances prevailing at the time that the Contractor procured the ODC.

Disputes as to the amount by which any reimbursement is reduced shall be resolved in accordance with the “Disputes” clause of the contract. It shall be the Contractor’s burden to demonstrate that the price it paid for the reimbursable items was fair and reasonable.

Type of ODC anticipated for the CLAT project include:

Software associated with Cloud implementation.

XIII. GOVERNMENT FURNISHED EQUIPMENT/GOVERNMENT FURNISHED INFORMATION

Each task order will identify Government Furnished Equipment and Government Furnished Information.

The Contractor will be provided with documented standards, policies, and FDA EPLC templates.

Additionally, FDA will provide updates to artifacts (standards, document templates, and processes) as they become available. As the FDA EPLC artifacts are modified, the contractor shall use the most current artifacts in all subsequent development activities.

https://www.fda.gov/media/81089/download

XIV. CONTRACT MANAGEMENT

Notwithstanding the Contractor’s responsibility for total management during the performance of this contract, the administration of the contract will require maximum coordination between the Government and the Contractor.

Communications pertaining to the contract administration will be addressed to the Contracting Officer.

No changes to the statement of work are authorized without a written modification to the contract executed by the Contracting Officer.

https://www.fda.gov/media/81089/download

The Contractor is advised that only the Contracting Officer can change or modify the contract terms or take any other action, which obligates the Government. Then, such action must be set forth in a formal written modification to the contract.

Contractors who reply on direction from other than the Contracting Officer do so at their own risk and expense. Such actions do not bind the Government contractually. Any contractual questions shall be directed to the Contracting Officer, or Contract Specialist.

XV. GOVERNMENT POINTS OF CONTACT

IDIQ Contract Specialist:

Laurel Woest Office of Acquisition and Grants Services U.S. Food & Drug Administration 4041 Powder Mill Rd.

Beltsville, MD 20705 laurel.woest@fda.hhs.gov

IDIQ Contracting Officer (Alternate POC):

Steven Gagnon Office of Acquisition and Grants Services U.S. Food & Drug Administration 4041 Powder Mill Rd.

Beltsville, MD 20705 Steven.gagnon@fda.hhs.gov

IDIQ Contracting Officer’s Representative (COR)

The Contracting Officer may designate other Government personnel (known as the Contracting Officer’s Representative) to act as her authorized representative for contract administration functions which do not involve changes to the scope, price, schedule, or terms and conditions of the contract. The designation will be in writing, signed by the Contracting Officer, and will set forth the authorities and limitations of the representative(s) under the contract. Such designation will not contain authority to sign contractual documents, order contract changes, modify contract terms, or create any commitment or liability on the part of the Government different from that set forth in the contract.

The Contractor shall immediately contact the Contracting Officer if there is any question regarding the authority of an individual to act on behalf of the Contracting Officer under this contract.

mailto:laurel.woest@fda.hhs.gov

IDIQ Contracting Officer Representative (COR): TBD

[INSERT COR NAME]

Center for Drug Evaluation and Research U.S. Food & Drug Administration

[INSERT ADDRESS]

[INSERT PHONE NO]

[INSERT EMAIL]

Task Order and Delivery Order COR

For each Task Order, a COR will be assigned. The COR shall serve as the Contractor’s first point of contact for any technical questions and is responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; (5) assisting in the resolution of technical problems encountered during performance; and (6) providing technical direction in accordance with section 14; and, (7) reviewing of invoices/vouchers.

The Government may unilaterally change its COR designation.

Technical Leads may assist the COR. The Technical Leads will not have the authority to provide technical direction; however, they may be responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and compliance with all substantive project objectives; (2) performing technical evaluation as required; (3) performing technical inspections and acceptances as required by this performance; and (5) reviewing of invoices/vouchers.

XVI. TECHNICAL DIRECTION

Performance of the work under task order shall be subject to the technical direction of the Task Order COR. The term “technical direction” is defined to include, without limitation, the following:

Directions to the Contractor which redirect the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual statement of work.

Provision of information to the Contractor which assists in the interpretation of drawings, specifications, or technical portions of the work descriptions.

Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the Contractor to the Government under the contract.

Technical direction must be within the general scope of work stated in the contract. The COR does not have the authority to and may not issue any technical direction which:

Constitutes an assignment of additional work outside the general scope of work of the contract.

Constitutes a change as defined in the applicable contract clause entitled FAR 52.212-4(c)

Contract Terms and Conditions – Commercial Items.

In any manner cause an increase or decrease in the total estimated contract cost, fixed-fee, or the time required for contract performance.

Change any of the expressed terms, conditions, or specifications of the contract.

All technical direction shall be issued in writing by the IDIQ or Task Order COR or shall be confirmed by him/her in writing within 5 working days after issuance.

The Contractor shall proceed promptly with the performance of technical direction duly issued by the COR in the manner prescribed by this article and within his/her authority under the provisions of this article.

If, in the opinion of the Contractor, any instructions or direction issued by the COR is within one of the categories described above, the Contractor shall not proceed but shall notify the Contracting Officer in writing within 5 working days after the receipt of any such instructions or direction and shall request the Contracting Officer to modify the task order, accordingly. Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of this contract.

The Contractor shall proceed immediately with the instructions or directions and shall be subject to the “Disputes” clause within FAR 52.212-4(d) “Contract Terms and Conditions – Commercial Items”.

XVII. CONTRACTOR’S CONTRACT ADMINISTRATION INFORMATION

The Contractor’s contract administration functions will be performed at the following address:

Name and Title:

Responsible Office:

Address:

Telephone Number:

Fax Number:

E-mail Address:

DUNS#:

TIN:

XVIII. NOTIFICATION REGARDING ADMINISTRATIVE PROBLEMS

If at any time during the performance of this contract, administrative problems should arise which will have an adverse impact on the timely performance by the Contractor or affect the contract costs or funding, the Contractor is required to immediately notify the Contracting Officer.

XIX. 508 REQUIREMENTS

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation

(HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

• E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

• E203 Access to Functionality (Appendix A, Application and Scoping Requirements)

• E204 Functional Performance Criteria (Appendix A, Application and Scoping Requirements)

• E205 Electronic Content (Appendix A, Application and Scoping)

• E208 Support Documentation and Services (Appendix A, Application and Scoping

Requirements)

• Chapter 6 Support Documentation and Services (Appendix C, Functional Performance Criteria and Technical Requirements)

• E207 Software (Appendix A, Application and Scoping Requirements) http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/

• Chapter 5 Software (Appendix C, Functional Performance Criteria and Technical

Requirements)

XX. SECURITY AND PRIVACY

FDA Information Technology Security – Information Security and/or Physical Access

SECTION 1

A. Baseline Security Requirements:

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

2) Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

a. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

3) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against…