B01 - Attachment 1 - DRAFT Performance Work Statement (PWS).pdf

PERFORMANCE WORK STATEMENT (PWS)

TECHNICAL SUPPORT SERVICES FOR ORACLE (EDC/SAE)

for

ENTERPRISE INFORMATION TECHNOLOGY PROJECT MANAGEMENT OFFICE (eIT PMO)

Agency/Activity: Defense Health Agency (DHA) Operational Medical Systems (OPMED), Enterprise Information Technology Project Management Office (eIT PMO)

Title: Professional Services, Upgrade and Migration Services for Oracle (EDC/SAE)

SECTION 1.0: GENERAL INFORMATION

1.1 Purpose

To award technical support services for Oracle in support of the Electronic Data Capture (EDC) and Serious Adverse Event (SAE) products following DoW/DHA/Army regulations and eIT PMO policies. The award should include training, mentoring, technical support, and Food and Drug Administration (FDA) validation support services for Oracles Inform GTM, Central Designer, Central Coding, Inform Adapter, CRF Submit, and Oracle’s Argus Safety.

1.2 Background

1.2.1 The DHA OPMED is comprised of multiple subordinate commands with disparate organizational structures, mission areas, and internal processes. These entities provide a wide array of products and capabilities to enable the United States to provide, improve, and enhance the supply, protection, and sustainment of all the Armed Forces.

1.2.2 The DHA OPMED eIT PMO at Fort Detrick is responsible for providing medical research and regulatory Information Technology (IT) solutions to DHA and the Services in accordance with DoW, DHA and Army/MEDCOM policies and regulations. This primary mission includes several major activities:

Actively maintain and manage requirements associated with eIT PMO IT Systems for DHA and the Services.

Acquire, configure, and test IT capabilities to comply with approved requirements.

Establish and maintain applicable Project Baselines. Ensure these are effectively managed with appropriate

Acquisition Configuration Management (CM) Control and associated processes.

Train the customer base, maintain, and sustain all operational IT systems and capabilities.

1.2.3 The eIT PMO requires product training, customer specific mentoring, technical support, and validation support services to maintain the EDC and SAE products and to support the product end users throughout DHA and the Services.

1.2.4 EDC became operationally ready in the fall of 2012. It houses all current and future clinical trials conducted by the DHA and the Services. The EDC product is comprised of several Oracle Health Sciences Global Business Unit (HSGBU) Software products: Inform GTM, Central Designer, Central Coding, CRF Submit, and Inform Adapter.

1.2.5 SAE became operationally ready in 2010. It provides a system for reporting adverse events associated with clinical trials conducted by the DHA and the Services. SAE is comprised of the Oracle HSGBU Argus Safety Software.

1.2.6 These comprise two of five FDA compliant major capabilities that the eIT PMO manages and maintains for the DHA and the Services. It is the eIT PMO’s intent to support product growth with this contract. To learn more about the eIT PMO and SAE and EDC go to: https://www.dha.mil/Offices-and-Programs/OPMED/EIT

1.2.7 The scope of the contract shall cover all products named or their equivalent Oracle Products, to account for name changes in training modules, product name changes, or product replacements. The eIT PMO requires the support service provider to understand Oracle Database Software, business processes and technology designs within the Oracle HSGBU Clinical Data Capture and Management and Adverse Event Reporting products.

1.3 Period of Performance

The anticipated period of performance of this contract is a 12-month base year plus four (4) twelve month (12-month) option periods to be exercised at the discretion of the government (total potential of a five (5) year contract): 28 March 2026 through 27 March 2031.

Base Period: 28 March 2026 – 27 March 2027 Option Period 1: 28 March 2027 – 27 March 2028 Option Period 2: 28 March 2028 – 27 March 2029 Option Period 3: 28 March 2029 – 27 March 2030 Option Period 4: 28 March 2030 – 27 March 2031

1.4 Estimate Level of Effort (LOE)

Fully support the requirements to achieve the Performance Objectives as described in Section 4.0 of this PWS.

Contract must include support services to meet requirements.

SECTION 2.0: GOVERNMENT-FURNISHED PROPERTY AND SERVICES

2.1 Government-Furnished Property

Reserved

2.2 Government-Mandated Training

Not applicable

SECTION 3.0: CONTRACTOR MINIMUM REQUIREMENTS

3.1 Oracle Partner

The Contractor shall be able to demonstrate subject matter expertise of the EDC/SAE product. The support Contractor shall demonstrate an established working relationship with Oracle.

3.2 Start Date

The Contractor start date for providing training, mentoring, technical support, and FDA validation services shall be 28 March 2026.

3.3 Kick-Off Meeting

The Contractor awarded this contract shall contact the COR to set up a post-award kick off meeting with the COR, OPMED designated staff, Contracting Officer and Contract Specialist within 10 calendar days after the start date of the contract. Attendees shall include: Contracting Officer, Contract Specialist, eIT PMO Project Manager, Contracting Officer’s Representative (COR), designated eIT PMO staff.

3.4 Quarterly Evaluations

Within 30 days of award, the Contractor shall contact the COR to set up quarterly evaluation meetings to discuss the status of the contract, deliverables, contract performance and results of the Quality Assurance Surveillance Plan

(QASP) evaluation. Prior to meeting, the COR will coordinate schedules for government to receive input for the evaluation of the performance of the Contractor. The QASP (Section 6.1) is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the acceptable quality levels (performance thresholds).

3.5 Training Requirements

The Contractor(s) shall be Oracle subject matter expert(s) (SME) to provide the training, mentoring and FDA validation services specified in this PWS. Verification of qualifications shall be provided in the contract proposal.

3.6 Business Hours

Contractor support services shall be provided during the hours of operation between 8:00-4:30 eastern Monday through Friday. Requests to work outside these hours or alternate schedules must be approved in writing by the COR in advance, but ensure 24x7x365 coverage for Critical and High Priority Incidents.

SECTION 4.0: PERFORMANCE OBJECTIVES

The technical services required shall provide continued training, mentoring and FDA validation support services to the EDC and SAE end users. The objective of this PWS is to enable the government to request and receive the product support services required in a timely, cost effective manner. The scope shall cover all products named or their equivalent Oracle Products, to account for name changes in training modules, product name changes, or product replacements.

4.1 General Program Requirements

4.1.1 Attend and participate, as requested, in eIT PMO project meetings, and assist with setting program milestones.

4.1.2 Participate in the development of project schedules as needed, working closely with the eIT PMO Product Lead and PM.

4.1.3 Provide technical peer review advice, plans, recommendations, and innovative approaches when defining business process improvements.

4.1.4 Participate in EDC and SAE Working Groups as requested.

4.1.5 Travel – Other Direct Costs

No travel costs will be incurred. If, during the course of the contract, travel is deemed required, the KO/CS will discuss with the vendor.

4.2 Special Requirements

The Contractor shall provide skilled personnel to address SAS related service requests in scenarios where the application support team is incapable of addressing the needs of government system users after 12 months of an open service request.

4.3 Reporting Requirements

4.3.1 Reports

4.3.1.1 Provide the COR and contract specialist with a monthly status report via email submitted by the 5th of each month, Deliverable 2. This report shall address each element of the QASP for ease of COR evaluation and will include status of all work in progress, as well as track work which has been requested by eIT PMO, but which has not yet been performed. The monthly report shall include cost estimates for any such work.

4.3.1.2 Provide the COR a monthly project burn report including funds remaining on each CLIN, estimates for outstanding invoices (for work that has been performed but not yet invoiced), and estimates for outstanding invoices from subcontractors, Deliverable 3. Provide this report via email submitted by the 5th of each month.

4.3.1.3 Provide ad-hoc reporting completely and accurately if additional information is requested or more explanation is needed.

4.3.1.4 Perform data analyses and ad hoc reporting to support the eIT PMO management activities such as briefing materials, reports, taskers, memos, procedures, etc.

4.3.1.5 All Vendor supplied documents must be converted to eIT PMO approved template/format prior to delivery/demonstration to the customer.

4.4 Deliverables

4.4.1 Training handouts, manuals/books, electronic copy of slides and other training materials for each onsite class should be provided at least 7 days prior to start of an onsite training session. Training materials must be converted to eIT PMO approved template/format prior to delivery/demonstration to the customer.

4.4.2 Schedules of classes available at vendor’s training site should be provided within 7 days of request – Deliverable 5.

4.4.3 Copies of all EDC or SAE validation scripts, instructions and other materials requested as part of the validation support services for all Oracle products or equivalent products as specified in this PWS and in a Microsoft Office Format. Copies should be provided within 7 days of request.

4.4.4 Levels of Effort (including estimated billable hours) and installation and FDA validation schedules for training, mentoring, technical support, and validation support requests should be provided within 7 days of request, Deliverable 5.

4.4.5 Inspection and Acceptance Criteria as specified in the Quality Assurance and Surveillance Plan (QASP)

4.4.6 A Quality Control Plan, Deliverable 1, for how the Contractor will ensure quality support during the execution of the contract.

4.5 Technical Requirements

The Contractor shall perform all necessary training, mentoring, technical support, and FDA validation support activities for Oracle Inform GTM, Central Designer, Central Coding, CRF Submit, Inform Adapter; and Oracle Argus Safety in accordance with DoW, DHA and Army/MEDCOM policies and regulations and the business processes established and managed by the eIT PMO.

4.5.1 Task 1: EDC Training and Mentoring

Provide Training and Mentoring Support, on an as needed basis for the EDC products (or equivalent Oracle products).

The Contractor shall:

Provide a list of training courses offered (private onsite, online or vendor’s training site) with associated costs for Oracle Inform GTM, Central Designer, Central Coding, CRF Submit, Inform Adapter, or equivalent products. The training is to be scheduled on an as-needed basis, at a mutually agreed upon time, up to four classes per year. The cost should be priced per class.

Provide descriptions and complete pricing to include estimated billable hours for available training options (course trainings, tailored trainings, and/or mentoring) to allow eIT PMO to compare and select from courses, vendor-provided training, or mentoring in advance.

Provide onsite training options for large groups.

Provide individual training options, which may be held at the vendor’s training site.

Provide online training options and a list of courses available online.

Provide training classes that include, but are not limited to, the products named.

Provide training that includes any new functionality, refresher training, and new modules that become available or are required.

Provide a list of what will be provided when training or mentoring is held at the Fort Detrick location. The

Government will provide the support and equipment as listed in section 2.1. The Contractor shall provide all other supplies or materials required for training.

Accommodate request for training or mentoring within 30 calendar days after notification from the government.

Provide onsite and remote mentoring for the development, programming and configuration and deployment of clinical trials for all EDC products, not to exceed 200 hours per year as required. The cost for mentoring should be priced at an hourly rate.

Provide certified implementation experts to conduct mentoring. The mentoring provided should be a combination of custom training in conjunction with hands on environment specific consulting.

4.5.2 Task 2: EDC Technical Support and Validation

Provide Technical Support, to include but not limited to: performing upgrades, providing validation scripts and/or services, and providing ad-hoc technical support on an as needed basis for the EDC products (or equivalent Oracle products).

The Contractor shall:

Provide technical remediation services and/or create ad-hoc custom capabilities for EDC products on an as needed basis.

Perform EDC software upgrades, not to exceed one major upgrade (up to 1500 hours) and one minor upgrade (up to 700 hours):

o Assist with migration of Inform trials as well as migration of data from older product versions by providing scripts, instructions and remote support, o Create updated validation scripts, (OQ, PQ), as needed, o Provide subject matter experts (SMEs) to conduct on-site delta workshops for training user personnel on the differences between the older and newer products.

Provide description of services and complete pricing based on estimated billable hours for technical remediation services, ad-hoc custom capability creation, or software upgrades in advance of work performance.

Provide an onsite validation support package for Oracle Inform GTM, Central Designer, Central Coding, Inform Adapter or equivalent Oracle products.

In the case of a validation services request, provide a list of precisely what will be provided as part of the validation services package. The validation package shall contain, at a minimum, the following components and templates:

o Master Validation Plan o User Requirements Specification o Configuration Specification o Validation IQ Test Plan and Scripts and Execute Validation IQ o Validation IQ summary Report o OQ Test Plan and Step Instructions and Execute the OQ Step Instructions o OQ Summary Report o PQ Test Plan and Step Instructions and Execute the PQ Step Instructions o PQ Summary Report o Production IQ Test Plan and Scripts and Execute the Production IQ o Production IQ Summary Report o Master Validation Summary Report

In the case of a validation scripts request (no services), provide a list of what will specifically be included as part of the validation scripts package. The minimum components and templates to be contained in the validation package are:

o Validation IQ Test Plan and Scripts o OQ Test Plan and Scripts o PQ Test Plan and Scripts o Production IQ Test Plan and Scripts Supply scripts that identify the product functionality difference between standard releases of the product, eliminating the need to validate all the standard functionality.

Provide the eIT PMO with product consulting and execution support, as requested as part of the validation package.

Provide a schedule for completing validation tasks once agreed upon.

Accommodate validation script requests or validation support requests within 30 calendar days after notification from the government.

4.5.3 Task 3: SAE Training and Mentoring

Provide Training and Mentoring Support, on an as needed basis for Oracle Argus Safety (or equivalent Oracle products).

The Contractor shall:

Provide a list of training courses offered (private onsite, online or vendor’s training site) with associated costs for Oracle Argus Safety and related products or equivalent Oracle products. The training is to be scheduled on an as-needed basis, at a mutually agreed upon time, up to four classes per year. The cost should be priced per class.

Provide descriptions and complete pricing to include estimated billable hours for available training options (course trainings, tailored trainings, and/or mentoring) to allow eIT PMO to compare and select from courses, vendor-provided training, or mentoring in advance.

Provide onsite training options for large groups.

Provide individual training options, which may be held at the vendor’s training site.

Provide online training options and a list of courses available online.

Provide training that includes any new functionality, refresher training, and new modules that become available or are required.

Provide a list of what will be provided when training is held at the Fort Detrick location. The Government will provide support and equipment as listed in Section 2.1. The Contractor shall provide all other supplies or materials required for training.

Accommodate request for training or mentoring within 30 calendar days after notification from the government.

Provide onsite and remote mentoring for the development, programming and configuration and deployment of SAE efforts, not to exceed 200 hours per year as required. The cost for mentoring should be priced at an hourly rate.

Provide certified implementation experts to conduct mentoring. The mentoring provided should be a combination of custom training in conjunction with hands on environment specific consulting.

4.5.4 Task 4: SAE Technical Support and Validation

Provide Technical Support, to include but not limited to: performing upgrades, providing validation scripts and/or services, and providing ad-hoc technical support on an as needed basis for Oracle Argus Safety (or equivalent Oracle products).

The Contractor shall:

Provide technical remediation services and/or create ad-hoc custom capabilities for SAE on an as needed basis.

Perform SAE software upgrades, not to exceed one major upgrade (up to 1500 hours) and one minor upgrade (up to 700 hours).

Provide description of services and complete pricing based on estimated billable hours for technical remediation services, ad-hoc custom capability creation, or software upgrades in advance of work performance.

Provide an onsite validation support package for Argus Safety (or equivalent Oracle products) In the case of a validation services request, provide a list of precisely what will be included as part of the validation services package. The validation package shall contain, at a minimum, the following components and templates:

o Master Validation Plan o User Requirements Specification o Configuration Specification o Validation IQ Test Plan and Scripts and Execute Validation IQ o Validation IQ Summary Report o OQ Test Plan and Step Instructions and Execute the OQ Step Instructions o OQ Summary Report o PQ Test Plan and Step Instructions and Execute the PQ Step Instructions o PQ Summary Report o Production IQ Test Plan and Scripts and Execute the Production IQ o Production IQ Summary Report o Master Validation Summary Report

In the case of a validation scripts request (no services), provide a list of what will specifically be included as part of the validation scripts package. The minimum components and templates to be contained in the validation package are:

o Validation IQ Test Plan and Scripts o OQ Test Plan and Scripts o PQ Test Plan and Scripts o Production IQ Test Plan and Scripts

Supply scripts that identify the product functionality difference between standard releases of the product, eliminating the need to validate all the standard functionality.

Provide the eIT PMO with product consulting and execution support, as requested as part of the validation package.

Provide a schedule/timeline for completing validation tasks once agreed upon.

Accommodate validation script requests or validation support requests within 30 calendar days after notification from the government.

4.5.5 Project Directive: FDA Title 21 CFR Part 11

The Contractor shall demonstrate experience working in FDA compliant environment. Title 21 CFR Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the U.S. Food and Drug Administration (FDA) regulations on Electronic Records and Electronic Signatures (ERES).

SECTION 5.0: SERVICE LEVEL REQUIREMENTS

5.1 Hours of Support

The Contractor shall provide support during Government Duty Hours (as indicated above) for standard tickets and ensure 24x7x365 coverage for Critical and High Priority Incidents.

5.2 Incident Intake & Acknowledgment

The Contractor shall acknowledge reported incidents within seven days during duty hours and within seven days after hours.

Incident Definition and Resolution Targets:

Critical (Severity 1): complete outage or mission stopped. Contractor shall drive immediate restoration and resolve within one business day, provide status updates at least every day until closure; after resolution, delivery an after-action report within seven business days.

High: mission critical impact. Contractor shall respond within two business days during Duty Hours.

Medium: mission critical but not an outage. Contractor shall respond within three business days and target closure within 30 business days.

Low: all other requests. Contractor shall respond within five business days and resolve per a schedule agreed upon with the Government.

Service Requests (Non-Incident Work) Contractor shall complete Urgent requests within five business days and Emergency requests shall be made safe within three business days.

Escalation

High Priority incidents not resolved within 30 business days shall be escalated to the next severity level and reported to the Government, with status provided every five business days or as requested.

Reporting and Reviews Contractor shall submit monthly SLA metrics (Deliverable 6).

Remedies Failure to meet the above service level may trigger performance remedies, including service credits or corrective actions, at the government discretion.

SECTION 6.0: CONTRACT DELIVERABLES

6.1 Inspection and Acceptance Criteria (Quality Requirements) The QASP defines performance requirements, standards, and quality criteria that will be used to inspect and accept the contract series:

Item Name of Deliverable

Distribute To

Initial Submission Subsequent Submission

Deliverable 1 Quality Control Plan USAMRAA:

CS & KO

With Proposal Submission NLT 14 days after contract award and as requested thereafter

Deliverable 2 Monthly Status Report aligned with the QASP

COR

After 30 days of contract award

Monthly NLT the 5th of each month

Deliverable 3 Monthly Project Burn Report aligned with the QASP

COR

After 30 days of contract award

Monthly NLT the 5th of each month

Deliverable 4 Non-Disclosure Agreement

COR

Signed statements are due for all personnel prior to performing any work.

Updated as needed

Deliverable 5 Delivery or Work Schedule(s)

COR

Work is collaboratively established and conducted according to the eIT PMO Integrated Master Schedule

Schedule revisions impacting the completion date of approved milestones must be approved by the COR

Deliverable 6 Monthly SLA Metrics

COR

After 30 days of contract award

Monthly NLT the 5th of each month

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

PWS Title: ORACLE SERVICES FOR EDC/SAE

Performance Requirement

Performance Standard Acceptable Quality Level

Method of Surveillance

R ep or ti ng

Provide monthly status report

Include status of all work in progress and any requested work not yet performed. Include cost estimates where applicable.

Provide monthly reports NLT 5th business day of each month.

100% Inspection

Provide project burn report

Indicate funds remaining on each CLIN as well as estimates for any outstanding invoices, to include subcontractor work.

Provide monthly reports NLT 5th business day of each month.

100% Inspection

Provide ad-hoc reporting

Address the request completely and accurately as requested.

Provide ad-hoc reports within 3 business days of request.

100% Inspection

E D

C /S

A E

T ra in in g an d M en to ri n g

Provides options for courses, vendor training, and mentoring to include associated costs and estimated billable hours.

Provides training to meet requirements.

Upon receiving a request provide timely and comprehensive training and mentoring by certified implementation experts for products.

Provide schedules of training/class options within 7 days of request, including vendor-provided training, or mentoring.

Include all associated costs and estimated billable hours. Provide training materials for onsite classes 7 days prior to the start of a training session. Training materials must be on approved eIT PMO format.

Complete training efforts within 30 days of initial request.

100% Inspection

E D

C /S

A E

T ec h n ic al

S u p po rt a n d

R em ed ia ti on

Provide technical support and remediation, ad-hoc custom capabilities for products, and/or perform upgrades.

Evaluate and resolve issues, deliver custom capabilities, provide validation scripts and services packages, and/or perform upgrades to completion as assigned in a satisfactory amount of time.

Conform to eIT PMO processes and procedures.

Resolve minor issues 90% of the time within 24 hours of initial contact;

resolve or identify a corrective action plan for 95% of major issues within 7 business days of initial contact.

When a schedule is required, perform scheduled tasking within 10% of baseline.

100% Inspection schedules for technical support and remediation, ad-hoc custom capabilities for products, and upgrades in advance.

Conform to eIT PMO processes and procedures.

Deliver schedules for upgrade tasking within 7 days of request, or within a mutually agreed upon timeframe for larger or more complex efforts.

100% Inspection

Deliver complete pricing in advance (to include estimated billable hours) before beginning work.

Provide pricing estimates and schedules in advance of performing work.

Deliver levels of effort with estimated cost within 7 days of request for upgrades, or custom capabilities, or within a mutually agreed upon timeframe for larger or more complex efforts.

100% Inspection

E D

C /S

A E

V al id at io n

S u p po rt validation support for product.

Provide validation scripts in advance.

Include all validation components in accordance with

PWS.

Evaluate and resolve issues, deliver custom capabilities, provide validation scripts and services packages, and/or perform upgrades to completion as assigned in a satisfactory amount of time.

Provide pricing estimates and schedules in advance of performing work.

Resolve minor issues 90% of the time within 24 hours of initial contact;

resolve or identify a corrective action plan for 95% of major issues within 7 business days of initial contact.

Deliver levels of effort with estimated cost within 7 days of request for validation efforts.

Complete validation efforts within 30 days of initial request. When a schedule is required, perform scheduled tasking within 10% of baseline.

100% Inspection

Provide schedules for completing validation in advance.

Conform to eIT PMO processes and procedures.

Deliver schedules for completing validation within 7 days of request, or within a mutually agreed upon timeframe for larger or more complex efforts.

100% Inspection

SECTION 7.0: SECURITY REQUIREMENTS

7.1 Security

Contractor employees with an area of performance within an Army-controlled installation, facility, or area shall comply with the requirements listed below:

7.2 Access and General Protection/Security Policy and Procedures

7.2.1 Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoW, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

7.2.2 For Contractors that do not require a CAC but require access to a DoW facility or installation. Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

7.3 Access to Government Computers

Not applicable

7.4 IT Security Requirements for Computer Access

Not applicable

7.5 Non-Disclosure Agreement (NDA) – Deliverable 4

The Contractor shall ensure that the NDA is signed by all staff assigned to or performing on this PWS prior to performing any work, including all subcontractors and consultants. The NDA shall be cosigned by a corporate official (Contractor Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and proprietary information of other Contractors. Note: A copy of the signed NDA shall be provided to the COR.

7.6 Organizational Conflicts of Interest (OCI)

Not applicable

7.7 Physical Security

Not applicable

7.8 Computer Users Policy Letter

Not applicable

7.9 General Information Assurance (IA)

Establish appropriate administrative, technical, and physical safeguards to protect any and all Government data.

Ensure the confidentiality, integrity, and availability of Government data in compliance with all applicable laws and regulations, including data breach reporting and response requirements, in accordance with DFAR Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference DoDD 5400.11, “DoD Privacy Program,” May 8, 2007, and DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007. The Contractor shall also comply with federal laws relating to freedom of information and records management.

7.10 Health Insurance Portability and Accountability Act (HIPAA) Not applicable

7.11 PII/HIPAA Breach Response

Not applicable

7.12 Privacy Act and HIPAA Training

Not applicable

7.13 Anti-terrorism and Operations Security (AT/OPSEC) Requirements/Contract Clauses

7.13.1 AT Level I Training

Not applicable

7.13.2 Access and general protection/security policy and procedures Not applicable

7.13.3 For Contractors requiring Common Access Card (CAC)

Not applicable

7.13.4 For contracts that require iWATCH Training

Not applicable

7.13.5 Army Training Certification Tracking System (ATCTS) registration for Contractor employees who require access to government information systems Not applicable

7.13.6 For contracts that require OPSEC Training

Not applicable

7.13.7 For Information Assurance (IA)/Information Technology (IT) training Not applicable

7.13.8 Threat Awareness Reporting Program (TARP)

Not applicable

Note: Contractor personnel must be escorted by a U.S. DoW Service Member or civilian employee at all times they are inside a U.S. government facility.

SECTION 8.0: CONTRACTOR MANPOWER REPORTING

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The Contractor is required to completely fill in all information in the format using the following web address: https://cmra.army.mil. The required information includes:

Contract Number:

Task Order Number:

Requiring Activity Unit Identification Code (UIC):

Command: W03JAA Contractor Contact Information:

Federal Service Code (FSC):

Direct Labor Hours:

Direct Labor Dollars:

Location:

The CMRA help desk number is 703-377-6199 for any technical questions. As part of its quote or offer, the Contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. The reporting period will be the period of performance not to exceed 12 months ending 30 September of each government fiscal year and must be reported by 31 October of each calendar year.

SECTION 9.0: SPECIAL REQUIREMENTS

10.1 The US Government will have unlimited data rights to all products modified or support provided to COTS systems.

(End of Attachment 1 – Draft PWS)