Attachment A - SOW Regulatory Support Services BPA.docx

Draft Statement of Work U.S. Food and Drug Administration Regulatory Support Services BPA

1. Introduction

The Food and Drug Administration’s (FDA) mission is to protect public health by assuring the safety, efficacy and quality of human and veterinary drugs, biological products, medical devices, our nation’s food supply, cosmetics, and products that emit radiation. FDA is also responsible for planning, managing, directing and coordinating major tobacco program objectives to support the Family Smoking Prevention and Tobacco Control Act. This law gives FDA authority over tobacco products by adding a new chapter to the Federal Food, Drug, and Cosmetic Act for tobacco products.

2. Background

FDA develops rules and guidance documents that are aligned with FDA’s mission to promote and protect public health. This regulatory process is governed by laws including but not limited to the Administrative Procedure Act (APA) (5 U.S.C. Chapter 5), Congressional Review Act, Paperwork Reduction Act, and the Regulatory Flexibility Act. One area outlined in the APA is the notice-and-comment rulemaking process, which is often used when creating FDA regulations. During the notice-and-comment process, the FDA, at a minimum, must publish a notice of proposed rulemaking, give the public an opportunity to comment on the proposal, and consider the comments that have been submitted.

Publishing a notice of proposed rulemaking, involves many steps, including drafting the document, different levels of review and clearance, and finally, publication in the Federal Register in accordance with the requirements of the Office of the Federal Register (OFR) and the Government Publishing Office (GPO). After the notice of proposed rulemaking is published, there is a public comment period (typically between 60 and 90 days). This comment period gives the public an opportunity to provide information to agencies on the potential effects of a rule or to suggest alternatives for agencies to consider. The FDA must analyze and consider all relevant and substantive comments and information. Based on the comments and information submitted, the FDA might decide to end the rulemaking process, issue a new proposed rule, or to issue a final rule. If the FDA decides to issue a final rule, the agency must develop the regulatory text along with a preamble explaining the rule’s basis and purpose and responding to all significant issues raised in the comments.

The E-Government Act of 2002 requires agencies, to the extent practical, to accept comments “by electronic means” and to make the public comments and other materials included in the official rulemaking docket (a folder for documents or other information related to an agency’s rulemaking activities) available online. To meet these requirements the FDA uses the Federal Docket Management System (FDMS) and the public-facing Regulations.gov. FDMS is a federal government-wide document management system structured by dockets (or file folders) that offer an adaptable solution to service a wide range of regulatory activities routinely performed by federal agencies. Agency- approved users accessing FDMS.gov can, based on the user role, review and import data from public submissions; update document metadata; and/or publish submissions to Regulations.gov (excluding inappropriate, unrelated, incomplete, duplicate, CBI documents). The public-facing website of FDMS is Regulations.gov, which is an interactive website that allows the public to comment on regulatory documents, review comments submitted by others, and access federal regulatory information.

The FDA is often required to conduct regulatory activities under exceptional circumstances including, but not limited to:

· Expedited regulatory timelines due to court-mandated deadlines for the issuance of proposed and final rules, (e.g., American Academy of Pediatrics, et al. v. U.S. Food & Drug Admin.).

· Extremely high volumes of public submissions, including individual dockets that receive over 100,000 comments (e.g., FDA-2014-N-0189 with 119,058 comments received; FDA-2021-N-1349 with 175,557 comments received) and individual dockets that receive over 500,000 comments (e.g., FDA-2017-N-6565 with 525,478 comments received);

· Regulatory documents and public comments that cite or include research data or studies, requiring further in-depth analyses; and

· Continuous changes in the regulatory environment, including new court rulings, executive orders, and legislative updates.

To successfully carry out its public health mission, FDA needs a contractor with extensive, up-to-date regulatory process knowledge that is capable of providing both regulatory and public comment support services when requested.

3. Scope of Work

This BPA shall include activities to support the development and implementation of regulatory actions in accordance with the Family Smoking Prevention and Tobacco Control Act, Administrative Procedure Act (APA) (5 U.S.C. Chapter 5), Congressional Review Act, Paperwork Reduction Act, and the Regulatory Flexibility Act, court rulings, executive orders, and legislative updates. These support services include but are not limited to document support services, Paperwork Reduction Act support services, and other regulatory development and implementation support services.

Additionally, the BPA shall include public comment support services including but not limited to public comment analysis, development and maintenance of a public comment database and, if needed, posting docket comments submitted to Regulations.gov using the Federal Dockets Management System (FDMS). The BPA shall also provide project management services to successfully provide these regulatory and public comment support services.

4. Task Areas

Task orders issued under this BPA will detail required services from these general task areas:

4.1 Regulatory Support Services

4.1.1 Document Support Services

4.1.1.1 Quality Review

The contractor shall review documents to ensure they meet the highest standards of quality from both legal and scientific perspectives, and that they are written clearly and are easily understandable to the lay reader. Additionally, the contractor shall analyze the logic, completeness, and accuracy of documents as well as their consistency with previous Center decisions and existing FDA regulations and policy.

4.1.1.2 Format Review

The Contractor shall perform evaluations of rules, guidance documents, and other regulatory documents for style, consistency, and formatting that meets the guidelines from the Government Printing Office, Office of the Federal Register, and FDA’s Regulations Editorial Section (RES).

4.1.1.3 Accessibility Review

The contractor shall review and edit documents to ensure compliance with accessibility standards including, but not limited to Section 508 of the Rehabilitation Act, Web Content Accessibility Guidelines (WCAG), and applicable U.S. Access Board rules and guidance documents.

4.1.2 Paperwork Reduction Act Support Services

The contractor shall provide Paperwork Reduction Act (PRA) support services including, but not limited to support with: Information Collection Requests (ICRs), Federal Register notices, public comment analysis, and OMB requests.

4.1.3 Other Regulatory Development and Implementation Support Services:

The Contractor shall provide other regulatory development analysis, and implementation business process support services that may be required for the development and implementation of the regulations, including but not limited to other document support services, other Paperwork Reduction Act services, guidance documents, and Federal Register notices.

4.2 Public Comment Support Services

5.2.1 Public Comment Analysis

The FDA will identify dockets for which public comment analysis support is needed and notify the contractor of each request. Docket analysis generally has three stages: 1) comment analysis planning; 2) comment analysis implementation; and 3) comment analysis completion. These stages can include but are not limited to the tasks listed below. Additionally, not all tasks listed below must be used for each analysis, and the tasks are not restricted to the stage in which they are listed (e.g., Stage 2 tasks may be used during Stage 3 and vice versa).

4.2.1.1 Stage 1: Comment Analysis Planning

4.2.1.1.a Establish Analysis Methodology Upon receipt of a docket analysis request, the contractor shall collaborate with FDA staff to establish agreed-upon methods and procedures to sort public submissions received on an FDA docket that includes key topics as well as specific issue categories involving the proposed rulemaking or notice. Once the planning is complete, the contractor shall create a document outlining all elements of the proposed coding structure and electronically submit this document to the FDA for review and approval. Once the FDA has approved the proposed coding structure, it can then be tested using a small sample of the docket’s public submissions.

4.2.1.1.b Sample Data Analysis Using the proposed coding structure, the contractor shall sort and group a small test sample of submission excerpts for the docket into the planned key topics and issue categories, then send the results to the FDA for review. The FDA will review the results and request adjustments or changes to the coding structure if necessary. Once adjustments or changes are completed (if necessary) and FDA approves the coding structure, the contractor may proceed with applying this coding to all public submissions.

4.2.1.2 Stage 2: Comment Analysis Implementation

4.2.1.2.a Implement Analysis Methodology Using the coding structure developed in Stage 1, the contractor shall sort and group public submission excerpts for the docket into the planned key topics and issue categories. As comment periods typically last for 60 to 90 calendar days, the full set of public submissions will not be available for coding until the comment period has closed. However, the contractor shall sort and group public submissions as they are being submitted during the entire open comment period.

4.2.1.2.b Trend Reporting Upon request from the FDA, the contractor shall develop interim trend report(s) that describe the comment analysis status and the trends identified in the comments received thus far during the open comment period of a docket. The trend report shall include but is not limited to the following information: number of comments received, processed, and analyzed (sorted by submission classification); a high-level summary of arguments most frequently provided by commenters; the count of submissions assigned to each category of the coding structure thus far; and any other information that is relevant to the docket analysis.

4.2.1.2.c Identify and Analyze Form Letter/Mass Mail Campaigns Upon request from the FDA, the contractor shall identify and analyze all form letter/mass mail campaigns identified in a docket thus far during the comment period. The contractor shall also develop a report that contains but is not limited to: the total count of form letter submissions by category (e.g., form letter master, form plus text, form letter copy, etc.); the docket submission number and commenter name for a representative copy of each form letter campaign along with the originating organization/source (if known) and the counts of form letter categories for each individual campaign; and any other information that is relevant to the form letter/mass mail campaigns.

4.2.1.2.d Identify and Analyze Submissions that Cite or Include Research Data or Studies Upon request from the FDA, the contractor shall identify and analyze all public submissions that cite or include research data or studies thus far during the comment period. The contractor shall also develop a report the contains but is not limited to: the author, title, and year of the research/study; the docket submission number and commenter name that cited or included the research/study; and any other information that is relevant to the submissions that cite or include research data or studies.

4.2.1.2.e Other Docket Analyses or Searches Upon request from the FDA, the contractor shall perform analyses or searches of public submissions based on criteria such as, but not limited to: requests for extension of the comment period; requests for a public hearing; multiple submissions bundled together; content in a foreign language; comments that threaten litigation; Freedom of Information Act (FOIA) requests; comments that require immediate attention (not otherwise specified); submissions deleted from FDMS; and any other criteria relevant to the development and implementation of regulatory actions. These requested analyses and searches may be conducted within one docket or across multiple dockets, depending on the FDA’s needs.

4.2.1.2.f Scheduled/Recurring Docket Reports Upon request from the FDA, the contractor shall monitor the dockets associated with a Center/Office and develop a report that provides updated information regarding the Center/Office’s dockets on a scheduled/recurrent basis (as determined at the order level). This report shall include information such as but not limited to: docket numbers and titles; number of docket submissions in FDMS; number of docket submissions posted to Regulations.gov; new docket submissions since previous reports; late docket submissions; and any other criteria relevant to the status of a Center/Office’s dockets.

4.2.1.3 Stage 3: Comment Analysis Completion

4.2.1.3.a Summary of Public Comments Upon request from the FDA, the contractor develop a report containing “comment summaries” that describe common themes discussed by commenters from a specified docket and highlight specific issues detailed in some of the docket’s substantive public comments. This report shall include but is not limited to: the contractor’s methodology for analyzing and creating the summary report; comment summaries organized by issues (coding structure categories); and any other information relevant to summarizing docket comments.

4.2.1.3.b Excerpt-by-Issue Report Upon request from the FDA, the contractor shall develop a report containing the verbatim text of all substantive comment excerpts from a specified docket. This report shall include but is not limited to: the contractor’s methodology for analyzing and creating the excerpt-by-issue report; the verbatim text of all substantive comment excerpts sorted by issue (coding structure categories); and any other information relevant to substantive comment excerpts.

4.2.1.3.c Docket Statistics/Closeout Report Upon request from the FDA, the contractor shall develop a report that analyzes the public submissions from a specified docket and characterizes the submissions in a numerical format that is organized by criteria such as, but not limited to: number of submissions in FDMS; number of submissions posted (and not posted, if any) to Regulations.gov; total submissions received; number of comments by submission type; number of submissions by commenter type; number of unique submissions by issue; number of all submissions (including form letter copies) by issue; number of comments by form letter category; counts of form letters for each individual campaign; and any other numerical information relevant to a docket’s public comment submissions.

4.2.2 Public Comment Database:

The Contractor shall establish and maintain a comments database that can store imported electronic public submission data from FDMS.gov and that meets the following specifications:

The imported public submission data shall be categorized in the database based on multiple attributes, including but not limited to:

· Metadata (e.g. submitter name, date, address, etc.);

· Issue categories (in accordance with coding structure);

· Commenter Type (e.g. private citizen, public health/advocacy group, manufacturer, distributor, retailer, anonymous, etc.);

· Submission Classification (e.g. substantive, other unique submissions, form letter categories (master, copy, etc.), non-germane, duplicates, etc.);

· Submissions that cite or include research, data, and/or studies; and

· Other attributes as indicated by the Government (e.g. requests for comment period extension, etc.).

Additionally, the contractor shall provide read-only database access to Government employees (number to be determined at the order level) that allows the user(s) to search all public submission data by attributes as well as perform full text searches.

4.2.3 Public Comment Posting

The Contractor shall support activities to post docket comment submitted to Regulations.gov using the Federal Dockets Management System (FDMS) as described in Tasks 5.2.3.1 and 5.2.3.2 below:

4.2.3.1 Electronic Comments:

The Contractor shall review electronic comments submitted to Regulations.gov, enter metadata in to the FDMS database, to include, but not limited to: submitter name, date, address, review submissions for confidential information and post comments when required.

4.2.3.2 Paper Comments:

The Contractor shall open envelopes, date stamp, sort into designated categories, prepare for scan operations, quality control, scan documents, quality control scanned documents, and enter metadata into the FDMS database, to include, but not limited to: submitter name, date, address, review submissions for confidential information and post comments.

4.3 Project Management:

The Contractor shall coordinate with FDA about the status of the Contractor’s work via conference calls and email; track expenditures; prepare progress and financial reports; ensure coordination and monitor progress on all tasks.

5. Transition

Transition activities take place to efficiently transition all activities from the incumbent Contractor to the new Contractor. As tasked, the Contractor shall develop transition plans and conduct transition activities for task orders issued against this BPA, as applicable.

5.1 Transition-In

As specified in the BPA order, the Contractor shall transition-in and assume the responsibility for activities and duties from the prior (incumbent) Contractor in a manner that ensures minimal disruption to ongoing evaluation activities as well as complete transparency to ensure total data transfer from the outgoing Contractor. The purpose of the Transition-In requirement is to provide an orderly and efficient transition from the prior Contractor. The Contractor shall work with the incumbent Contractor to affect a smooth transition of work.

Representative activities include, but are not limited to:

· Develop a Transition-In Plan to ensure full operating accountability and responsibility of the task orders. The contractor shall provide a final Transition-In Plan.

· Familiarize the incoming Contractor staff with FDA processes and requirements and work with the incumbent Contractor as related to transferring tasks and work activities being performed.

· Coordinate with COR to obtain access to the required data, applications, and required training.

· Participate in Transition-in meetings and other technical exchange meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the incumbent Contractor. The purpose of the initial meeting shall be to walk through the incumbent Contractor’s detailed plan for transitioning all activities and all Government assets to the new Contractor in a manner that is the least disruptive to ongoing activities.

· Certify that employees working on the BPA order have completed their review and understand the requirements of the task order, documentation, processes, and technical environments prior to the completion of the Transition-in activities.

· Verify to the COR that all Transition-in documents are available.

5.2 Transition-out

As specified per the BPA order, the Contractor shall facilitate the transition-out of contracted activities and services to the Government or, to a follow-on Contractor by the end of the period of performance. During the transition out period, the Contractor shall ensure that no degradation in service or support is experienced, per each BPA order. Between the turnover date designated by the CO and the end of the BPA order period of performance, the incumbent Contractor shall ensure all task order activities are closed-out and provide sustainment support to complete the transition.

Representative activities include, but are not limited to:

· Develop and submit a Transition-Out Plan and Schedule to the Contracting Officer and Contracting Officer Representative.

· Provide the Government with current versions of all documentation and all datasets (i.e., electronic and hardcopies).

· Provide the Government with a current inventory of all Government-Furnished Equipment (GFE) and Government Furnished Information (GFI) utilized by the Contractor along with full support in the reconciliation of this inventory.

· Provide the follow-on Contractor with the ability to “shadow” and participate in technical exchange meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor.

6. Contractor Deliverables and Timelines

Independently and not as an agent of the Government, the Contractor shall furnish all necessary personnel, materials, services, facilities, and otherwise complete all SOW tasks, necessary for or incident to the performance of the work as described in the Statement of Work (SOW). All work performed under this BPA shall be monitored by the Contracting Officer’s Representative (COR).

A BPA kickoff meeting between the BPA COR, FDA representatives, and the Contractor shall be conducted no later than 14 calendar days from the BPA award.

All deliverables shall be provided to the COR and Project Manager via email in MS Word format, unless otherwise specified. Specific deliverable schedules and timelines will be stated at the individual BPA order level.

All deliverables must adhere to Section 508 requirements for Web and materials content. The FDA shall have exclusive ownership of all deliverables and products developed under this BPA.

7. Delivery Instructions and Schedule

All deliverables submitted under this order must be complete, clear, concise, technically accurate, well organized, and properly referenced.

All deliverables must adhere to Section 508 requirements for Web and materials content. The Contractor must ensure that FDA has full ownership of all copywriting, designs, illustrations, photography, music, and other creative work produced under this order, including material produced by the Contractor and subcontractors.

8. Period of Performance The Period of Performance shall be a Base Year plus four (4) twelve (12) month Option Years.

9. Place of Performance

The specific place of performance shall be designated at the BPA order level.

The primary place of performance shall be at the Contractor’s facility or at an off-site/telework location. The Contractor will be required to attend meetings in person at FDA’s White Oak campus located at 10903 New Hampshire Avenue, Silver Spring, MD 20993 or to other FDA facilities in the Washington, DC metro area for short periods of time for training/guidance; to provide support for on-site comment processing; and/or for meetings.

10. BPA Governance

Contractor personnel shall properly notify and obtain approval from the BPA Government Contracting Officer (CO) and the BPA Contracting Officer’s Representative (COR) regarding BPA contractual and administrative issues (e.g., BPA key personnel changes, inclement weather questions, and as specified). Contractor personnel shall seek technical guidance and direction from his/her assigned BPA Order COR and Technical lead, regarding daily operations (i.e. Task Area 5).

11. Organization Conflicts of Interest

As a regulatory agency charged with protection of public health, the Food and Drug Administration (FDA) must maintain public confidence in the integrity of its decisions. The Center for Tobacco Products (CTP) oversees the implementation of the Family Smoking Prevention and Tobacco Control Act. Some of the Agency’s responsibilities under the law include setting performance standards, reviewing premarket applications for new and modified risk tobacco products, requiring new warning labels, and establishing and enforcing advertising and promotion restrictions.

The FDA has policies and procedures that safeguard against actual and apparent conflict of interest on the part of its employees. It is critical that the FDA be assured that there is no actual or apparent conflict of interest on the part of the individual contractor. Offers performing work under this contract must assure the protection of information and data they receive under this contract from unauthorized use or disclosure, and must avoid actions that would cause a reasonable person to question the impartiality of the contractor.

a) The purpose of this section is to ensure that the contractor and its subcontractors:

(1) Are not biased because of their financial, contractual, organizational, or other interests which relate to the work under this contract, and

(2) Do not obtain any unfair competitive advantage over other parties by virtue of their performance of this contract.

(b) Scope. The language of this section applies to performance or participation by the contractor, its parents, affiliates, divisions and subsidiaries, and successors in interest (hereinafter collectively referred to as “contractor”) in the performance of this contract as a prime contractor, subcontractor, co- sponsor, joint venture, consultant, or in any similar capacity.

(c) Definition of Conflict of Interest

Conflict of interest means that because of other activities or relationships with other persons or organizations, a person is unable or potentially unable to render impartial assistance or advice to the Government, that the person's objectivity in performing the contract is or might be otherwise impaired, or that the person has or might acquire an unfair competitive advantage (see FAR 9.501).

(d) Contractor’s Conflict of Interest Responsibilities

The individual contractor must be free of interest prior to performing under this contract. Any time prior to or during the performance of the contract the individual contractor believes that a potential or actual conflict exists, the individual should notify the contract officer and project officer. The contract officer will determine whether or not a conflict of interest exists and how to resolve or mitigate it. The contractor should not commence or continue working on the contract until directed by the contract officer.

(e) Warrant and Disclosure. The warrant and disclosure requirements apply to both the contractor and all subcontractors. The contractor warrants that, to the best of the contractor's knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, and that the contractor has disclosed all relevant information regarding any actual or potential conflict. The contractor agrees it shall make an immediate and full disclosure, in writing, to the Contracting Officer of any potential or actual organizational conflict of interest or the existence of any facts that may cause a reasonably prudent person to question the contractor's impartiality because of the appearance or existence of bias or an unfair competitive advantage. Such disclosure shall include a description of the actions the contractor has taken or proposes to take in order to avoid, neutralize, or mitigate any resulting conflict of interest.

The contractor will be performing scientific/economic analysis of regulation and policy impacts that affect entities, such as tobacco manufacturers, distributors, importers, retailers, and growers or other entities and populations potentially subject to regulatory actions. Financial relationships with these entities will create the potential for bias of that analysis. If such financial relationships exist, the contractor shall provide a statement as to whether it believes the relationships present a potential or actual conflict of interest and the basis for that determination. If the contractor has identified a potential or actual conflict of interest, a plan for mitigating the conflict of interest must be submitted prior to award.

Prior to award, contractors that disclose potential or actual conflicts of interest shall submit a mitigation of conflicts of interest plan along with their technical and business proposals.

(f) Remedies. The Contracting Officer may terminate this contract for convenience, in whole or in part, if the Contracting Officer deems such termination necessary to avoid, neutralize or mitigate an actual or apparent organizational conflict of interest. If the contractor fails to disclose facts pertaining to the existence of a potential or actual organizational conflict of interest or misrepresents relevant information to the Contracting Officer, the Government may terminate the contract for default, suspend or debar the contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(g) Subcontracts. The contractor shall include a clause substantially similar to this clause, including paragraphs (f) and (g), in any subcontract or consultant agreement.

(h) Prime Contractor Responsibilities.– The contractor shall identify and avoid, neutralize, or mitigate any subcontractor organizational conflict prior to award of the contract to the satisfaction of the Contracting Officer. If the subcontractor's organizational conflict cannot be avoided, neutralized, or mitigated, the contractor must obtain the written approval of the Contracting Officer prior to entering into the subcontract. If the contractor becomes aware of a subcontractor's potential or actual organizational conflict of interest after contract award, the contractor agrees that the Contractor may be required to eliminate the subcontractor from its team, at the contractor's own risk. The contractor shall obtain from its subcontractors or consultants the disclosure required in FAR Part 9.507

(i) Waiver. The contractor may seek a waiver from the Head of the Contracting Activity by submitting such waiver request to the Contracting Officer, including a full written description of the requested waiver and the reasons in support thereof.

12. Observance of Federal Holidays

The Government will not require support at the Government facility on Saturdays, Sundays, or the Federal holidays shown below, or days of government closure due to inclement weather or additional holidays granted to federal employees:

13. Non-Personal Services

The Government and the Contractor understand and agree that the services delivered by the Contractor to the Government are non-personal services. The parties also recognize and agree that no employer- employee relationship will exist between the Government and the Contractor. The Contractor and the Contractor’s employees are not employees of the Federal Government and are not eligible for entitlement and benefits given Federal employees.

Contractor personnel under this order shall not:

· Be placed in a position where there is an appearance that they are employed by a Federal Officer, or are under the supervision, direction, or evaluation of a Federal Officer.

· Be placed in a position of command, supervision, administration or control over personnel or personnel of other Government contractors, or become a part of the Government organization.

· Be used in administration or supervision of procurement activities.

14. Personnel Security Clearance Requirements

Unless otherwise specified, the Position Risk is Level 2. The Contractor shall comply with FDA Personnel Security Requirements.

15. Security

The Contractor shall ensure compliance with IT security requirements, including the following:

DHHS Information Security and Privacy Program http://www.hhs.gov/ocio/securityprivacy/index.html Federal Information Security Management Act (FISMA) http://www.whitehouse.gov/sites/default/files/omb/memoranda/m03-19.pdf National Institute of Standards and Technology (NIST) SP800-53 http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01- 2010.pdf FDA Security Authorization process, which closely resembles NIST SP800-37 http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

Format and Media: The Contractor shall furnish deliverables in a manner consistent with the FISMA and NIST security requirements of the information provided. For example, the Contractor shall not send Sensitive Personal Identifying Information via e-mail across the internet.

16. 508 Standard Requirements

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites (including text, audio or video) must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All Contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS- funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Section 508 Standards apply to this acquisition:

· Must meet WCAG 2.0 A and AA

· E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

· E203 Access to Functionality (Appendix A, Application and Scoping Requirements)

· E204 Functional Performance Criteria (Appendix A, Application and Scoping Requirements)

· E205 Electronic Content (Appendix A, Application and Scoping Requirements)

· 302 Functional Performance Criteria (Appendix C, Functional Performance Criteria and Technical Requirements)

· Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Appropriate Scoping Requirement from Appendix A

· E208 Support Documentation and Services (Appendix A, Application and Scoping Requirements) Appropriate Technical Performance and Technical Requirement from Appendix C

· Chapter 6 Support Documentation and Services (Appendix C, Functional Performance Criteria and Technical Requirements)

17. Travel

Any travel undertaken under this order shall be in accordance with the Federal Travel Regulations (FTR) and the underlying terms of the Contractor’s GSA Schedule. Approval from the COR shall be required prior to any travel. Local travel within the Washington, DC, metropolitan area will not be reimbursed.

18. Inspection and Acceptance

In accordance with the inspection and acceptance clauses in the Contractor’s underlying GSA FSS contract, all work under this Task Order is subject to inspection and final acceptance by the Contracting Officer or the duly authorized representative of the Government. The Government’s Contracting Officer’s Representative (COR) is a duly authorized representative of the government and is responsible for inspection and acceptance of all items to be delivered under this order. Unless otherwise specified by the COR, the general quality measures, as set forth below, will be applied to each work product received from the Contractor under this order.

· Accuracy: Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

· Technical Soundness: Work products, especially digital work products, shall exhibit no technical flaws.

· Comprehensiveness: Work products, especially qualitative and quantitative research, shall have sufficient strength to make the research sufficiently measurable and therefore meaningful.

· Clarity: Work products shall be clear and concise. Diagrams shall be easy to understand and be relevant to the supporting narrative.

· Creative: Work products shall exhibit fresh, new ideas and innovative tools and materials that effectively reach and engage target audiences.

· Consistency to Requirements: All work products must satisfy the requirements of this statement of work.

· Timeliness: Work products shall be submitted by the due date specified in this statement of work or submitted in accordance with a later scheduled date determined by the Government.

· File Editing: All text and diagrammatic files shall be editable by the Government.

· Format: Work products shall be submitted in hard copy (where applicable) and in media mutually agreed upon prior to submission.

All services delivered to the COR will be deemed to have been accepted 30 calendar days after date of delivery, except as otherwise specified in this order, if written approval or disapproval has not been given within such period. The COR’s approval or revision to the services delivered shall be within the general scope of work stated in this order.

19. Information Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

Note to the Requiring Activity Representative: Complete this section using the information obtained from the Information Security and Privacy Certification Checklist. This information may be included after award in the event it is not yet available at the time of acquisition.

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

· If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

· The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries. FDA personnel must also request loaner GFE from the FDA Foreign Travel program for official travel to any foreign country. Please see the FDA IS2P, Appendix T Government Furnished Equipment for Foreign Travel.

h. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS and FDA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

i. Internet…