CTMS questions Attachment 4_.pdf
PDF 109 KB Posted
- Solicitation number
- 2026-Q-97423
About this file
This document is a set of technical evaluation questions and requirements for a CDC federal contract solicitation regarding a SaaS platform for clinical trial management and regulatory compliance.
The solicitation requires vendors to address three primary capability areas. Under FedRAMP & Security Infrastructure, offerors must confirm whether their SaaS application is hosted on an infrastructure with existing FedRAMP Authorization to Operate (ATO) from providers such as AWS GovCloud, Microsoft Azure Government, or Salesforce Government Cloud, and provide the package ID if applicable. Vendors must detail their plan to meet a "Day 1" FedRAMP initiation milestone, including availability of a pre-prepared System Security Plan (SSP) template and dedicated federal compliance team. Additionally, vendors must confirm capability to conduct weekly or monthly authenticated vulnerability scans and deliver results to CDC in CSV or PDF format per Section XII requirements. The Technical Integration & Authentication section requires vendors to explain native integration capabilities with CDC's Secure Access Management Services (SAMS) using standard SAML or OAuth protocols and document prior successful integrations with SAMS or similar federal identity federation portals. Vendors must also describe API capabilities for establishing interoperability with an external Electronic Data Capture (EDC) system within 50 days of contract start. Under Functional Architecture (eTMF & eISF), vendors must explain how their platform natively links study-level Electronic Trial Master File (eTMF) workflows to site-level Electronic Investigator Site File (eISF) portals and confirm their licensing model covers up to 20 CDC users, 22 distinct site user accounts, and 25 eISF portal users within the total quoted price, with internal program staff retaining configuration rights without requiring paid developer support. Finally, vendors must complete the HHS Section 508 Product Assessment Template Voluntary Product Accessibility Template (VPAT).
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Questions_Answers Worksheet.xlsx | XLSX spreadsheet | |
| AI Use Compliance and Risk Attch 5.pdf | ||
| Letter of Supply Template Attachment 3.docx | DOCX document | |
| Attachment 1 SOW crosswalk.docx | DOCX document | |
| VPAT Report- Attachment 6.docx | DOCX document | |
| SOL-75D30126Q79181 DB.pdf | ||
| Pricing Schedule Attachment 2-.xlsx | XLSX spreadsheet | |
| RFP-CLINICAL TRIAL MANAGEMENT SYSTEM-FE.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
1. FedRAMP & Security Infrastructure
• Q 1.1: Is your SaaS application hosted on an infrastructure that already possesses a FedRAMP Authorization to Operate (ATO) (e.g., AWS GovCloud, Microsoft Azure Government, Salesforce Government Cloud)? If yes, specify the package ID.
• Q 1.2: Detail your organization's plan to meet the SOW's "Day 1" FedRAMP initiation milestone. Do you have a pre-prepared System Security Plan (SSP) template or a dedicated federal compliance team ready to engage with the CDC ISSO?
• Q 1.3: Confirm your system’s capability to conduct weekly or monthly authenticated vulnerability scans and deliver results to the CDC in CSV or PDF format as mandated in Section XII.
2. Technical Integration & Authentication
• Q 2.1: Explain your platform's native capabilities for integrating with the CDC’s Secure Access Management Services (SAMS) using standard SAML or OAuth protocols. Have your systems successfully integrated with SAMS or a similar federal identity federation portal before?
• Q 2.2: Describe your system's Application Programming Interface (API) capabilities for establishing interoperability with an external Electronic Data Capture (EDC) system within 50 days of contract start.
3. Functional Architecture (eTMF & eISF)
• Q 3.1: How does your platform natively link study-level Electronic Trial Master File (eTMF) workflows directly to site-level Electronic Investigator Site File (eISF) portals?
• Q 3.2: Confirm that your licensing model covers up to 20 CDC users, 22 distinct site user accounts, and 25 eISF portal users within the total quoted price. Do internal program staff retain configuration rights to fields, templates, and dashboards without requiring paid developer support?
Complete the HHS Section 508 Product Assessment Template Voluntary Product Accessibility Template (VPAT)
File details come from the government source that posted it. Updated .