Combined Synopsis Solicitation FINAL 9 FEBRUARY 2023.pdf

Combined Synopsis/Solicitation No. 75N96023Q00025

NIEHS, Office of Acquisitions

Manuscript Submission and Tracking System for Environmental Health Perspectives (EHP) & Journal of Health and Pollution (JHP)

Combined Synopsis/Solicitation for Commercial Products and Commercial Services

COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL ITEMS

I. General Information

Document Type: Combined Synopsis/ Solicitation Solicitation Number: 75N96023Q00025 Posted Date: February 9, 2023 Original Response Date: February 22, 2023 Current Response Date: February 22, 2023 Product or Service Code: DA10 - IT AND TELECOM – BUSINESS APPLICATION

/APPLICATION DEVELOPMENT SOFTWARE AS A SERVICE

Set Aside: Total Small Business NAICS Code: 513210 - Software Publishers

II. Contracting Office Address

NIEHS/OA

530 Davis Drive Morrisville, NC 27560

III. Description

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested, and a written solicitation document will not be issued.

This solicitation is a request for quotations (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC 2022-08.

The associated North American Industrial Classification System (NAICS) code for this procurement is 513210, with a small business size standard of $47 Million.

The National Institute of Environmental Health Sciences (NIEHS) monthly scientific journal Environmental Health Perspectives (EHP), along with its sister publication Journal of Health and Pollution (JHP) is seeking to purchase a manuscript submission and tracking system to keep work moving between the editorial office, the Associate Editors, Reviewers, and the authors themselves. The anticipated contract type is a firm fixed price, one-year (12 month) base contract with four (4) one year option periods. FAR 52.217-8 Option to Extend Services will also be incorporated into the contract.

All interested companies shall provide quotation(s) in accordance with the Attachment I Performance Work Statement (PWS) and Attachment II FAR 52.212-1 Instructions to Quoters- — Commercial Products and Commercial Services.

The purchase order period of performance is: 4 April 2023-3 April 2024 (Base Period) plus 4 option periods pursuant to FAR 52.217-9 (Option to Extend the Term of the Contract).

Option Period One: 4 April 2024-3 April 2025

Option Period Two: 4 April 2025-3 April 2026

Option Period Three: 4 April 2026-3 April 2027

Option Period Four: 4 April 2027-3 April 2028

IV. Place of Performance

NIEHS

Keystone Building 530 Davis Drive Morrisville, NC 27560

Main Campus 111 T.W. Alexander Drive Durham, NC 27709

Award shall be made to the quoter whose quotation offers the best value to the government, considering technical capability, past performance and price. The selection for award will be conducted utilizing Simplified Acquisition Procedures as delineated in FAR Part 13.5.

Technical Capability is more important than Past Performance. All evaluation sub-factors are of equal importance. Technical criteria and Past Performance and more important than Price.

The full text of FAR provisions or clauses may be accessed electronically at:

https://www.acquisition.gov/browse/index/far

The following solicitation provisions apply to this acquisition:

FAR 52.212-1, “Instructions to Quoters–Commercial Products and Commercial Services (Nov 2021) See Attachment II - FAR 52.212-1 Addendum, Instructions to Quoters–Commercial Products and

Commercial Services

1. FAR 52.212-2, “Evaluation – Commercial Products and Commercial Services (Nov 2021) https://www.acquisition.gov/browse/index/far

See Attachment III - FAR 52.212-2 Evaluation – Commercial Products and Commercial Services (Nov 2021)

2. FAR 52.212-3, “Offerors Representations and Certifications-Commercial Products and Commercial

Services (Dec 2022)

Offerors must complete annual representations and certifications electronically in the System for Award Management (SAM) accessed through https://www.sam.gov in accordance with FAR 52.212- 3, “Offerors Representations and Certifications–Commercial Products and Commercial Services. If paragraph (j) of the provision is applicable, a written submission is required.

The following contract clauses apply to this acquisition:

1. FAR 52.212-4, “Contract Terms and Conditions–Commercial Products and Commercial Services (Dec 2022).

2. FAR 52.212-5, “Contract Terms and Conditions Required to Implement Statutes or Executive Orders” —Commercial Products and Commercial Services (Dec 2022). The following subparagraphs of FAR 52.212-5 are applicable: See Attachment IV

Additional Department of Health and Human Services Clauses: See Attachment IV

All quoters shall submit the following:

See Attachment II – Addendum to FAR 52.212-1 Instructions to Quoters–Commercial Products and Services (Nov 2021)

All quotations shall be sent to the Contract Specialist/Contracting Officer, Chantal Cornelius, via email at Chantal.cornelius@nih.gov.

This is an open-market combined synopsis/solicitation for services as defined herein. The government intends to award a contract as a result of this combined synopsis/solicitation that will include the terms and conditions set forth herein. To facilitate the award process, all quotes must include a statement regarding the terms and conditions herein as follows:

“The terms and conditions in the solicitation are acceptable to be included in the award document without modification, deletion, or addition.”

Any questions or concerns regarding this solicitation should be forwarded in writing (Reference 75N96023Q00025 in the e-mail’s subject line) via e-mail to the Contract Specialist/Contracting Officer, Chantal.cornelius@nih.gov at or before February 14, 2023 at 1:00pm EST. No questions will be accepted or answered via telephone.

Submission shall be received not later than February 22, 2023 11:00 am EST via email to the Contract Specialist/Contracting Officer, Chantal Cornelius (Chantal.cornelius@nih.gov). Late submissions shall be treated in accordance with the solicitation provision at FAR 52.212-1(f). Faxed, hand delivered, or physically mailed quotes WILL NOT be accepted. The burden of ensuring the quote is received by this office, within the stated timeframe, is the Quoter’s responsibility.

Point of Contact

Chantal Cornelius Contract Specialist/Contracting Officer Email: Chantal.cornelius@nih.gov mailto:Chantal.cornelius@nih.gov mailto:Chantal.cornelius@nih.gov

ATTACHMENT I

GENERAL PERFORMANCE WORK STATEMENT

MANUSCRIPT SUBMISSION AND TRACKING SYSTEM

EHP, NIEHS

1. BACKGROUND: The National Institute of Environmental Health Sciences (NIEHS) supports the publication of a scholarly journals program, currently consisting of the flagship journal Environmental Health Perspectives (EHP) and its sister publication, the Journal of Health and Pollution (JHP). These publications, under the program banner of EHP, are scholarly, online-only journals posted in a continuous publication format. Since publication is supported by the Federal government, content published in EHP and JHP is completely open access, and is free of any author publication charges or page/graphics fees.

Thanks to its worldwide distribution and solid reputation, EHP disseminates cutting-edge research throughout the scientific community. The name EHP is synonymous with quality due to years of hard work from its dedicated team.

EHP and JHP are fully open-access (OA) journals that charge no author fees or page charges, and yet still produce and distribute high quality, composed, peer reviewed, and edited content. The EHP family of journals is also an online-only journal program; this distribution model keeps EHP and JHP content accessible to all authors and readers, and keeps the journal at the forefront of the publishing landscape.

The journal program is made available for free online at https://ehp.niehs.nih.gov. EHP currently publishes 12 issues per year, in a monthly format, and deposits this content into a number of third-party repositories (PubMed, PubMed Central, Crossref). Each issue of EHP consists of both Research and original News content. JHP plans to begin publishing in mid-2023, starting publication on a quarterly basis (4 issues per year). This diversity of content helps EHP to reach a broad audience, from researchers and clinicians to policymakers and citizen scientists.

Currently, Environmental Health Perspectives receives about 2,000 Research and Editorial papers submitted by authors per year (the percentage split is roughly 90–95% Research, 5–10% Editorial).

Approximately 80% percent of Research submissions are rejected by our Editor in Chief (EIC) and Science Editors without further review. About another 10% are rejected during the peer review process, with most of these being rejected after the first review. Total acceptance rate is approximately 10%.

Projected growth is approximately 5% per year.

Additionally, Environmental Health Perspectives currently commissions approximately 40–50 original articles per year, currently known as our News program. 80–90% of this content is short format (1–2 pages) Science Selections, with the remainder comprised of long format (7–10 pages) Focus articles.

These articles do not undergo traditional peer review, though they are subject to fact checking by in-house staff and external subject matter experts. Projected growth is approximately 5% per year.

The Journal of Health and Pollution (JHP) will begin accepting submissions in early 2023. While a rough estimate, we expect up to 550 manuscripts (projected) to be submitted to JHP per year, with approximately 50% rejected without peer review, 30% rejected during the peer review process, and 20% likely to be accepted. These totals are in addition to the totals in the previous paragraphs.

1.1 Current Processes and Specifications: Submissions, peer-review tracking, and post-acceptance manuscript handling for EHP Research content is currently handled by Editorial Manager (EM) and ProduXion Manager (PM), from Aries Systems. News articles are also currently assigned and tracked in EM and PM.

The journal JHP, which will begin accepting submission in early 2023, also uses the EM/PM systems for its submission and manuscript tracking needs. This contract will incorporate the needs of both EHP and JHP, and should include provisions for adding additional journals during the life of this contract.

2. OBJECTIVES: The flow of new manuscripts is vital to the life of a journal. Without content, a publication cannot succeed. The manuscript submission and tracking system is the first interface that an author is presented with once they have decided to submit to the journal, so it is critical that they have a positive user experience. Likewise, the journal staff and its contractors must interface with this system on a daily basis to keep work moving between the editorial office, the Deputy Editors, the Associate Editors, Reviewers, and the authors themselves. Any breakdowns or inefficiencies will be felt by a vast number of parties and could delay the sensitive metric of time to publication.

3. TASKS: The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government. The contractor, in turn, shall be accountable to the Government for contractor personnel, subcontractors, or contract service providers. The contractor shall provide the following services:

3.1 Technical Requirements

The following technical requirements must be met in order for the system to be considered for use by EHP journals. Any systems that do not substantively meet these requirements will not be considered for use.

1. The system shall accept manuscripts in both Microsoft Word and TeX (LaTeX and RevTeX, for example, and their associated BibTex and style files) formats and successfully build them into a preview PDF with other file formats automatically.

2. The system shall accept a wide variety of figure file formats, including PDF, TIFF, EPS, BMP, and JPG, and shall successfully build them into a preview PDF with the manuscript and other file formats automatically.

3. The system shall accept supplemental material uploads from authors: these will include text documents, figures, tables, video, audio, and data sets, among others. There shall be no restrictions on the file types that authors can provide, but EHP and JHP shall be able to restrict file types as it chooses for certain types of uploads. These materials shall also be accessible to all Editors and Reviewers during the peer review process.

4. The system shall have the ability for journals to build custom submission questions and fields for authors, and to make changes to these questions directly without intervention from the provider’s technical support staff.

5. The system shall allow the journals to define required metadata fields, both during initial setup of the product and during the normal use of the product, without intervention from the provider’s technical support staff.

6. The system shall offer a role-based permissions system for users, so new users can be assigned permissions to perform their job function quickly and easily.

7. The system shall log email correspondence sent to the editors, reviewers, and authors, including attachments (of any file type).

8. The system shall track all dates associated with the submission, peer review, and acceptance of the paper.

9. The system shall provide a mechanism for creating and using email templates for each peer review and production task. These emails shall allow for the use of hyperlinks and merge data to automatically pull relevant manuscript metadata (titles, authors, manuscript number, digital object identifier (DOI)) into the email templates.

10. The system shall allow user self-service options for updating contact information and resetting passwords.

11. The system shall be capable of sending automated reminder messages to authors, editors, associate/deputy editors, and reviewers on a schedule that is defined by the journals.

Configuration options must allow these reminders to be sent both before and after the assignment is due.

12. The system shall have a robust administration portal to ensure that each journal can directly modify the workflow, author upload requirements, article types, and various staff interfaces.

13. The system shall allow easy assignment of peer review tasks to reviewers and Associate/Deputy Editors.

14. The system shall contain an integrated Production module to track and administer production tasks after manuscript acceptance.

15. The system shall allow reviewers and Editors to be able to insert dates when they will be unavailable to participate in reviews, and shall restrict the flow of new assignments to them during these times.

16. The system shall be capable of exporting manuscript files (Word or TeX documents, figures, supplemental materials, and all associated files) in a Zip bundle, along with XML metadata (JATS XML shall be supported) and transmitting it as a bundle via ftp/sftp to an external server.

17. The system shall allow the journals to define the production workflow steps and allow the journals to directly modify those steps as needed. The system shall also provide an overview of all manuscripts in production, with relevant dates of completion for each step.

18. The system shall provide the ability to directly upload manuscripts to the iThenticate/CrossCheck system. There shall be options for both automatic upload of all content, and manual upload of selected manuscripts only. The resulting “similarity score” shall be displayed within the user interface of the system.

19. A system for compiling articles into an issue shall be included in the production module.

20. The system shall include a People database for allowing users to register and keep basic contact and login information on file. It shall also allow for a data transfer from the People database of our current system (Editorial Manager), ensuring that accounts and roles for current users are transferred to the new system.

21. The system shall have custom flags for both manuscripts and people.

22. The system shall be capable of assigning DOIs to all articles, using the preferred format of the publisher.

23. Open Researcher and Contributor ID (ORCID) integration is required. Authors shall be able to key-in and lookup their ORCID IDs (and the IDs of their co-authors) from within the submission interface, and users shall also be allowed to log into the system using their ORCID IDs.

24. The system shall provide Ringgold integration. Authors shall be able to select their institution from the Ringgold database during submission of their paper.

25. The system shall support co-author verification, whereby co-authors will be prompted by the system via email to confirm that they have acted as an author on the uploaded manuscript.

26. The system shall be web-based and hosted by the provider (either directly or via a hosting agreement)– NIEHS will not host this system on our servers. As a web-based system, uptime is critical, so scheduled maintenance periods shall be communicated to the government well in advance, and unscheduled maintenance periods shall be kept to a minimum.

27. The system shall provide a robust reporting system. The reporting system shall offer both preconfigured reports and the ability to create ad-hoc reports. Such reports shall be run and delivered to users on a schedule.

28. The provider shall include an online Help system for users, with documentation on all major features. Help videos shall also be provided for major features and shall also be accessible online.

29. All historic manuscript data and metadata from the current system (Editorial Manager) shall be preserved in any new system,and shall be accessible and reportable as “live” data in the new system via the normal workflow and reporting interfaces.

30. The system shall have the ability to reverse feed data from outside providers (composition systems, web hosts, data aggregators). This shall be a fully electronic mechanism whereby data/metadata files and packages can be delivered to the platform via automated means and ingested without follow-up action by the outside provider.

31. The system shall not impose hard file-size limits on the upload of any materials, including but not limited to manuscripts, figures, and supplemental materials. Publisher controls that allow the customer to set such limits for itself are encouraged, but the platform nor provider shall impose restrictions of the size of the files that can be attached to a manuscript record. Any system that imposes such restrictions on the publisher will not be considered.

32. The platform provider is free to implement an archive policy for manuscript files, but files shall not be archived prior to one (1) year from the paper’s acceptance date. The provider shall provide file restoration services upon request from journal staff, and there shall be no charge to the Government for up to ten (10) restoration requests per journal per contract year; additional requests beyond this may be billed at the provider’s nominal rate. Restored files shall remain on the platform for a minimum of thirty (30) days before they can be re-archived. Manuscript metadata shall not be subject to the archive policy and shall remain live on the platform at all times.

33. The system shall support invited/proposed manuscripts initiated by journal staff and provide the ability to define specific metadata and requirements for these manuscripts. These invited manuscripts shall follow the same review and production steps in the submission system as submitted manuscripts.

34. The platform shall support integration with preprint servers bioRxiv and medRxiv (at a minimum), allowing authors to submit papers to EHP journals directly from those systems into the platform.

35. The system shall support the ability to rate both papers and those involved in the review process for quality. The ability for the journals to customize and define when and how papers, editors, and reviewers are rated would be preferred. Alternatively, the system can support the following areas without customization:

a. Rating the quality of the original manuscript, and the ability to provide a separate rating for revisions.

b. Rating the performance of the Associate Editor on their handling of the manuscript.

c. Allowing subordinate editors (such as Associate Editors) to rate both the quality of the manuscript and the quality of the reviews.

36. The system shall also be Section 508/WCAG compliant. See Section 4 below for additional information and the applicable WCAG standards.

37. The system shall allow for transfer of papers from one journal to another within the system.

Although these may be counted as two (2) separate submissions, the migration of article files and metadata should not involve any manual data entry on the part of the user.

3.2 Customer Service

Questions and problems always occur, and timely, accurate responses shall be provided in those scenarios. A Project Manager/Customer Support contact shall be assigned to the EHP account at all times (the same contact shall be assigned for both journals EHP and JHP), and direct phone and email contact information for this individual (and for a backup) shall be provided to the government. The Project Manager shall be available for routine status calls with journal staff, no more than once per month for up to one (1) hour, to discuss performance issues with the system and/or customer service representatives.

In the event that the NIEHS EHP support contact will change, at least two (2) weeks’ notice shall be provided to the government. In addition, the government reserves the right to request that a new customer service representative be assigned to EHP’s account if EHP finds performance of the assigned representative to be in question.

In order to make the best use of the system, journal staff will require ongoing training. The vendor shall supply up to eight (8) hours of remote (WebEx, Zoom, or equivalent) general training per contract year, and additionally up to eight (8) hours of remote (WebEx, Zoom, or equivalent) training per contract year focused on utilizing the reporting functionality (both basic and advanced) of the system. The training schedule and material to be covered shall be worked out between the Project Manager and journal staff, but training does not need to be conducted by the Project Manager; the vendor is free to identify the individual most qualified to conduct the training. The vendor may expect each training session to be attended by multiple journal staff members (no more than 6 participants per session).

The Project Manager/Customer Support rep shall also be available to design up to six (6) custom reports per year for journal staff, based on requirements provided by journal staff. These reports shall be continuously available in the system, and editable by journal staff.

There shall be no per-incident charges to EHP for contacting the provider’s Customer Support, or for any training or support functions described in this section.

4. COMPLIANCE: All content published in NIEHS journals must meet Web Content Accessibility

Guidelines (WCAG) 2.0 level AA accessibility guidelines as defined by the federal government.

Please see the following URLs for details:

• About WCAG: https://www.w3.org/WAI/WCAG2AA-Conformance

• How to Meet WCAG: https://www.w3.org/WAI/WCAG21/quickref/

The platform must allow for government contractors to scan both the website and its published content to confirm compliance with 508/WCAG mandates.

5. OTHER CONSIDERATIONS

• Restriction on contractor’s use of or dissemination of databases: Mailing lists either furnished to the contractor by the COR or prepared by the contractor as part of its continuing efforts to support the journal are protected by the Privacy Act, and shall not be used by the contractor or any other third party for any purposes other than for the expressed purpose of this contract.

Mailing lists provided as part of this contract shall not be disseminated to other persons or entities, except the COR, and shall not be used by the contractor, its subcontractors, or any other organization of persons for any purpose other than the services specifically described by the PWS and contract document. The contractor shall ensure that all subcontracts and consultant agreements in support of this contract include this restriction.

• Privacy Act Notice: This PWS requires the Parties to do one or more of the following: design, develop, or operate a system of records on individuals to accomplish an agency function in accordance with the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 USC 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties. The Privacy Act System of Records applicable to this project is Number 09- 90-0024.

6. DATA RIGHTS: The Government has unlimited rights to all documents/material produced under this contract to the extent permitted by the data rights clauses. The parties mutually acknowledge their understanding that this is the government’s intent. All documents and materials, to include the source codes of any software, if applicable, produced under this contract shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government. These documents and materials may not be used or sold by the contractor without written permission from the contracting officer. All materials supplied to the Government will be the sole property of the government and may not be used for any other purpose. This right does not abrogate any https://www.w3.org/WAI/WCAG2AA-Conformance https://www.w3.org/WAI/WCAG21/quickref/ other government rights.

7. PERIOD OF PERFORMANCE: The period of performance shall include a twelve month base period (inclusive of a 1 month phase-in period) with four (4) 1-year option periods.

8. HOURS OF OPERATION: The contractor shall be responsible for providing routine services between the core hours of 8:00 AM – 5:00 PM Eastern time Monday through Friday, except federal holidays or when the government facility is closed due to local or national emergencies, administrative closings or similar government directed facility closings. All responses to queries from EHP staff and authors, reviewers, and associate editors must be issued in a timely manner, usually the same business day. The contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons.

When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential. No overtime (OT) or compensatory time (CT) is authorized under this contract.

Federal Holidays: The National Institutes of Environmental Health Sciences observes the following holidays:

• New Year’s Day Labor Day

• Martin Luther King’s Birthday Columbus Day

• Presidents Day Veteran’s Day

• Memorial Day Thanksgiving Day

• Juneteenth Christmas Day

• Independence Day

9. PLACE OF PERFORMANCE: The management office place of performance, and the place of performance for EHP’s customer support representative, shall be anywhere in the United States. Any other personnel involved in the contract outside of these particular positions, can be anywhere in the world as long as they are available in the required times of operations so as not to delay any contract requirement to the Government.

10. CONTRACTOR PERSONNEL: The contractor shall provide personnel who are qualified to provide all services and work in a professional and courteous manner. Contractor personnel shall abide by applicable regulations, NIEHS rules and procedures, and present a neat appearance if working at NIEHS locations.

11. KEY PERSONNEL: Qualified personnel shall be provided by the Contractor for performance of work listed herein to assure that requests for services are responded to in a prompt and safe manner. The following will be considered key personnel by the Government:

11.1.1 Central Customer Support Representative: The representative shall act as a single point of contact for all inquiries from the journal.

- Qualifications: A minimum of a High school diploma and a minimum of 2 years of customer service experience. Shall demonstrate strong customer service abilities and experience working with scholarly authors, researchers, translators, and reviewers.

12. POST AWARD CONFERNECE/PERIODIC PROGRESS MEETINGS:

The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

13. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES: This section identifies those items such as property, information and/or services that will be provided for the contractor’s use (without cost to the contractor) to allow the contractor to provide the required services, such as materials, facilities, training, etc. as follows:

• Facilities: The Government will not furnish workspace, workstations, computers.

• Materials: The Government will not provide Standard Operational Procedures (SOPs), applicable regulations, manuals, texts, briefs or any other materials associated with these projects.

• Training: The Government will not provide any training, management, or accountability for contractor’s staff beyond the initial guidance given during initial setup, and the ongoing feedback that is provided throughout the course of the contract.

14. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES: The contractor shall furnish all supplies, equipment, and services required to perform work under this contract that are not listed under section 13 of this PWS.

• Items: The contractor shall provide all required hardware, software, licenses, internet access, etc., along with all necessary support, to perform this work. The Government shall not provide any equipment, materials, or technical support. The contractor will not have access to the NIEHS network or email accounts.

• Security/Security Log: The contractor shall maintain the security and integrity of their systems at all times. This includes promptly installing updates to mitigate security threats, actively testing all software releases for potential security holes, and promptly informing customers of known or suspected data breaches.

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

This Quality Assurance Requirements Summary (QARS) is provided so that the Contractor can be familiar with the level of service expected.

Required Service

Deliverable Performance Standard

Acceptable Quality Level (AQL)

Monitoring Method

The Contractor shall provide a submission system for the EHP publishing program;

PWS, section 3.1, tasks 1-17, 27.

Fully functioning website providing a submission system for EHP Publishing staff, contractors, and volunteers to access submissions; generate emails to authors and reviewers; assign peer review tasks; and access reports.

Uptime and accuracy of changes.

99.9% of uptime and accuracy of changes (measured monthly).

100% surveillance – including downtime, random checks of links for accuracy, and customer complaints.

Provide a site that allows access to all content for people with disabilities such as but not limited to blindness, deafness, and colorblind, as

508/WCAG 2.0

AA

conformance of all content

People with disabilities can access website’s information.

100% accuracy of

508/WCAG 2.0

AA conformance

100% review of

508/WCAG 2.0

AA conformance test results; public (customer) inquiries for information that is detailed in the Compliance section;

PWS, section 4.

not 508/WCAG

2.0 AA compliant.

Provide a site capable of preserving EHP’s archive of previously submitted materials;

PWS, section 3, Task 29, 32.

Preserving archive submission files and metadata in system database.

Access to all historic manuscript data and metadata, as defined in the PWS and

AQL.

100% of provided archive material available on website;

fulfillment of up to ten (10) full file restoration requests per year.

Customer complaints

Excellent customer service, PWS, section 3.2.

Courteous and polite to customers, including EHP staff

No complaints from customers

99%+ accuracy

Random survey of customers, Customer complaints

APPENDIX A - HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND

IT PROCUREMENTS

SECTION A - INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or order (hereafter

"contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality , which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity , which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability , which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the NIEHS ISSO, NIEHS SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ X ] Low [ ] Moderate [ ] High Integrity: [ X ] Low [ ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Impact Level: [ X ] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/NIH/NIEHS privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed.

Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with

OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents. NIH will specify which documents/forms will be provided to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 days of the validation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the NIH/NIEHS non-disclosure agreement, https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/NIH/NIEHS Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete https://irtsectraining.nih.gov/ Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-based Training at:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-http://csrc.nist.gov/publications/ https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf http://irtsectraining.nih.gov/ https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html training/index.html .

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. In accordance with OMB M-17- 12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the…