D7 Terms and Conditions.pdf

OTHER TERMS AND CONDITIONS

The following provisions apply to this acquisition and is incorporated in full text:

SMALL BUSINESS SUBCONTRACTING PLAN

If the proposed contract exceeds a total estimated cost of $750,000 for the entire period of performance, the offeror shall be required to submit an acceptable subcontracting plan in accordance with the terms of the clause entitled "Small Business Subcontracting Plan," FAR Clause No. 52.219-9, incorporated herein by reference in the Solicitation. In accordance with FAR 19.704 and FAR Clause 52.219-9, the submission of a subcontracting plan by other than small business offeror(s) is a requirement as a part of the proposal submission process and is to be submitted separately from the technical and cost proposals. An offeror’s subcontracting plan must be determined to be acceptable, by the Contracting Officer, prior to the contract award.

1. An offeror is to submit their respective subcontracting plan electronically using the U.S.

Department of Health and Human Services (HHS) Small Business Customer Experience (SBCX) system at https://osdbu.hhs.gov. The offeror must follow the instructions outlined in the SBCX Industry Guide instructions outlined in the SBCX Industry Guide at:

https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j to successfully submit their subcontracting plan by the proposal submission deadline.

2. The official point of receipt for determining timely submission of an offeror’s subcontracting plan is the SBCX system and/or email notification. Once the subcontracting plan is successfully submitted in the SBCX system the offeror should receive an email notification and confirmation message of completion upon submission.

3. If an offeror’s subcontracting plan is not confirmed as received within the SBCX system by the proposal submission date specified in the solicitation, it will be considered late in accordance with subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offeror— Competition Acquisition. Disposition of late submittals of a subcontracting plan by an offeror via the SBCX system is at the discretion of the Contracting Officer.

4. Any technical questions regarding the use of the SBCX system may be submitted via email message to the SBCX help desk at client.support@apexlogic.com. The client support hours of operation are Monday – Friday, 6:00 a.m. – 8:00 p.m. Eastern Standard Time (EST). Note: help desk tickets can be submitted 24 hours a day / 7 days a week and a representative will respond within the presented client support hours of operation for assistance.

a. THIS PROVISION DOES NOT APPLY TO SMALL BUSINESS CONCERNS.

b. The term "subcontract" means any agreement (other than one involving an employer-employee relationship) entered into by a Federal Government prime Contractor or subcontractor calling for supplies or services required for the performance of the original contract or subcontract. This includes, but is not limited to, agreements/purchase orders for supplies and services such as equipment purchase, copying services, and travel services.

c. The offeror understands that:

https://osdbu.hhs.gov/ https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j

i. No contract will be awarded unless and until an acceptable plan is negotiated with the Contracting Officer which plan will be incorporated into the contract, as a material part thereof.

ii. An acceptable plan must, in the determination of the Contracting Officer, provide the maximum practicable opportunity for Small Businesses, Small Disadvantaged Businesses, Women-Owned Small businesses, HUBZone Small Businesses, Veteran-Owned Small Businesses, and Service Disabled Veteran-Owned Small Businesses to participate in the performance of the contract.

iii. If a subcontracting plan acceptable to the Contracting Officer is not negotiated within the time limits prescribed by the contracting activity and such failure arises out of causes within the control and with the fault or negligence of the offeror, the offeror shall be ineligible for an award.

The Contracting Officer shall notify the Contractor in writing of the reasons for determining a subcontracting plan unacceptable early enough in the negotiation process to allow the Contractor to modify the plan within the time limits prescribed.

iv. Prior compliance of the offeror with other such subcontracting plans under previous contracts will be considered by the Contracting Officer in determining the responsibility of the offeror for award of the contract.

v. It is the offeror's responsibility to develop a satisfactory subcontracting plan with respect to Small Business Concerns, Small Disadvantaged Business Concerns, Women-Owned Small Business Concerns, HUBZone Small Business Concerns, Veteran-Owned Small Business Concerns, and Service Disabled Veteran-Owned Small Business Concerns that each such aspect of the offeror's plan will be judged independent of the other.

vi. The offeror will submit, as required by the Contracting Officer, subcontracting reports in accordance with the instructions thereon, and as further directed by the Contracting Officer. Subcontractors will also submit these reports to the Government's Contracting Officer or as otherwise directed, with a copy to the prime Contractor's designated small and disadvantaged business liaison.

d. Each plan must contain the following:

i. Goals, expressed in terms of percentages of total planned subcontracting dollars, for the use of Small, Small Disadvantaged, Women-Owned, HUBZone, Veteran-Owned, and Service Disabled Veteran-Owned Small Business Concerns as subcontractors.

ii. A statement of total dollars planned to be subcontracted. A statement of total dollars to be subcontracted to each of the following type of small business concerns: Small, Small Disadvantaged, Women-Owned, HUBZone, Veteran-Owned, and Service Disabled Veteran-Owned Small Businesses.

iii. A description of the principal types of supplies and services to be subcontracted with an identification of which supplies and services are expected to be subcontracted to Small, Small Disadvantaged, Women- Owned, HUBZone, Veteran-Owned and/or Service Disabled Veteran- Owned Small Business Concerns.

iv. A description of the method used to develop the subcontracting goals.

v. A description of the method used to identify potential sources for solicitation purposes.

vi. A statement as to whether or not indirect costs were included in establishing subcontracting goals. If they were, a description of the method used to determine the proportionate share of indirect costs to be incurred with Small, Small Disadvantaged, Women-Owned, HUBZone, Veteran-Owned, and Service Disabled Veteran-Owned Small Businesses.

vii. The name of the individual employed by the offeror who will administer the offeror's subcontracting program and a description of his/her duties.

viii. A description of the efforts the offeror will make to assure that Small, Small Disadvantaged, Women-Owned, HUBZone, Veteran-Owned, and Service Disabled Veteran-Owned Small Businesses have an equitable chance to compete for subcontracts.

ix. Assurances that the offeror will include in all subcontracts the contract clause "Utilization of Small Business Concerns." Assure that all subcontractors, other than small businesses, in excess of $750,000 adopt a plan similar to the plan agreed upon by the offeror.

x. Assurances that the offeror (and any required subcontractors) will cooperate in studies or surveys as required and submit required reports (Individual Subcontract Reports (ISRs) and Summary Subcontract Reports (SSRs) to the Government.

xi. List the types of records the offeror will maintain to demonstrate procedures that have been adopted to comply with the requirement and goals in the plan, including establishing source lists. Also, the offeror shall describe its efforts to locate Small, Small Disadvantaged, Women- Owned, HUBZone, Veteran-Owned, and Service Disabled Veteran-Owned Small Businesses and award subcontracts to them.

For additional information about each of the above elements required to be contained in the subcontracting plan, see FAR Clause 52.219-9, Small Business Subcontracting Plan.

HHS expects each procuring activity to establish minimum subcontracting goals for all procurements. The anticipated minimum goals for this RFQ are as follows:

32.5% for Small Business; 5% for Small Disadvantaged Business; 5% for Women-Owned Small Business; 3% for HUBZone Small Business;

and 3% for Veteran-Owned Small Business and Service-Disabled Veteran-Owned Small Business.

MENTOR-PROTÉGÉ PROGRAM, HHSAR 352.219-70 (DECEMBER) 2015.

a. Large business prime Contractors serving as mentors in the HHS Mentor- Protege Program are eligible for HHS subcontracting plan credit and shall submit a copy of their HHS Office of Small and Disadvantaged Business Utilization (OSDBU) approved mentor-protege agreements as part of their offers. The amount of credit provided by the Contracting Officer to a mentor firm for protege firm developmental assistance costs shall be calculated on a dollar for dollar basis and reported by the mentor firm in the Summary Subcontract Report via the Electronic Subcontracting Reporting System (eSRS) at https://www.esrs.gov/ . The mentor firm and protege firm shall submit to the Contracting Officer a signed joint statement agreeing on the dollar value of the developmental assistance the mentor firm provided. (For example, a mentor firm would report a $10,000 subcontract awarded to a protege firm and provision of $5,000 of developmental assistance as $15,000 of subcontracting plan credit.) The mentor firm may use this additional credit towards attaining its subcontracting plan participation goal under this contract.

b. The program consists of--

1. Mentor firms--large businesses that:

(i) Demonstrate the interest, commitment, and capability to provide developmental assistance to small business protégé firms; and

(ii) Have a Mentor-Protege agreement approved by

HHS' OSDBU;

2. Protege firms--firms that:

(i) Seek developmental assistance;

(ii) Qualify as small businesses, veteran-owned small businesses, service-disabled veteran-owned small businesses, HUBZone small businesses, small disadvantaged businesses, or woman-owned small businesses; and

(iii) Have a Mentor-Protege agreement approved by HHS' OSDBU; and

3. Mentor-Protege agreements--joint agreements, approved by HHS' OSDBU, which detail the specific terms, conditions, and responsibilities of the mentor-protégé relationship.

(End of provision).

The following clause applies to this acquisition and is incorporated in full text:

FAR 52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within the current period of performance; provided that the Government gives the Contractor a preliminary written notice of its intent to extend before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 2 years.

(End of clause) https://www.esrs.gov/ https://www.esrs.gov/

The following terms and conditions apply to this acquisition and are incorporated in full text:

CONTRACT ADMINISTRATION DATA

CONTRACTING OFFICER REPRESENTATIVE (COR)

The following Contracting Officer Representative (COR) will represent the Government for the purpose of this contract:

[to be determined at time of award]

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in the contract

The Government may unilaterally change its COR designation.

KEY PERSONNEL, HHSAR 352.237-75 (December 2015).

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days' notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of clause).

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

INVOICE SUBMISSION

Invoice and Payment Provisions with and without IPP (Apr 2022) is attached

POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

https://www.cpars.gov

SECTION 508

This language is applicable to the Statements of Work (SOW) generated by the Department of Health and Human Services (HHS) that require a contractor or consultant to (a) produce content in any format that could be placed on a Department-owned or Department-funded Web site; or

(b) write, create or produce any communications materials intended for public or internal use;

to include reports, documents, charts, posters, presentations (such as Microsoft PowerPoint) or video material that could be placed on a Department-owned or Department-funded Web site.

The Contractor shall produce and deliver the content in compliance with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) which requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

https://www.cpars.gov/

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS- managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

• 36 CFR 1194.21 (all)

• 36 CFR 1194.22 (all)

References:

HHS Policy for Section 508 and Accessibility Technology:

https://www.hhs.gov/ocio/policy/508_policy.html HHS Section 508 Web site:

https://webstandards.hhs.gov/guidelines/28

HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/section- 508/index.html US General Services Administration (GSA) Section 508 Web site:

https://www.section508.gov/

SPECIAL CONTRACT REQUIREMENTS

SUBCONTRACTING PROVISIONS

a. Small Business Subcontracting Plan

1. In accordance with FAR 19.704 and FAR Clause 52.219-9, the submission of a subcontracting plan by other than small business offeror(s) is a requirement as a part of the proposal submission process and is to be submitted separately from the technical and cost proposals. An offeror's subcontracting plan must be determined to be acceptable, by the Contracting Officer, prior to the contract award.

2. The failure of any Contractor or subcontractor to comply in good faith with FAR Clause 52.219-8, entitled " Utilization of Small Business Concerns" incorporated in this contract and the attached Subcontracting Plan, will be a material breach of such contract or subcontract and subject to the remedies reserved to the Government under FAR Clause 52.219-16 entitled, "Liquidated Damages- Subcontracting Plan."

b. Subcontracting Reports

1. An offeror is to submit their respective subcontracting plan electronically using the U.S.

Department of Health and Human Services (HHS) Small Business Customer Experience (SBCX) system at https://osdbu.hhs.gov . The offeror shall follow the instructions outlined in the SBCX Industry Guide at: https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j to successfully submit their subcontracting plan by the proposal submission deadline.

2. The official point of receipt for determining timely submission of an offeror's subcontracting plan is the SBCX system and/or email notification. Once the subcontracting plan is successfully submitted in the SBCX system the offeror should receive an email notification and confirmation message of completion upon submission.

3. If an offeror's subcontracting plan is not confirmed as received within the SBCX system by the proposal submission date specified in the solicitation, it will be considered late in accordance with subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offeror-Competition Acquisition. Disposition of late submittals of a subcontracting plan by an offeror via the SBCX system is at the discretion of the Contracting Officer.

4. Any technical questions regarding the use of the SBCX system may be submitted via email message to the SBCX help desk at client.support@apexlogic.com. The client support hours of operation are Monday - Friday, 6:00 a.m. - 8:00 p.m. Eastern Standard Time (EST). Note: help desk tickets can be submitted 24 hours a day / 7 days a week and a representative will respond within the presented client support hours of operation for assistance.

5. Individual Subcontract Reports (ISR)

Regardless of the effective date of this contract, the Report shall be due on the following dates for the entire life of this contract:

April 30th October 30th Expiration Date of Contract

6. Summary Subcontract Report (SSR) Regardless of the effective date of this contract, the Summary Subcontract Report must be submitted annually on the following date for the entire life of this contract:

October 30th

For both the Individual and Summary Subcontract Reports, the Contracting Officer and Contract Specialist must be included as a contact for notification purposes.

INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements https://osdbu.hhs.gov/ https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j mailto:client.support@apexlogic.com

1. Applicability. The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

▪ Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

▪ Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

▪ Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories . Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

▪ Confidentiality: [X] Low [ ] Moderate [ ] High

▪ Integrity: [ ] Low [X] Moderate [ ] High

▪ Availability: [X] Low [ ] Moderate [ ] High

▪ Overall Risk Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

3. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

4. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, system/ data owner, or other security or privacy representative, it has been determined that this solicitation/ contract involves:

[X] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis ( PTA) for the information system and/ or information handled under this contract to determine whether or not a full Privacy Impact Assessment ( PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

5. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

6. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

7. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 days of the validation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/ . Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

8. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement, https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

B. Training Requirements

1. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role- based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role- Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-http://csrc.nist.gov/publications/ http://csrc.nist.gov/publications/ https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf http://irtsectraining.nih.gov/ http://irtsectraining.nih.gov/ based Training at: https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html .

3. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

GOVERNMENT INFORMATION PROCESSED ON GOCO OR COCO SYSTEMS

A. SECURITY REQUIREMENTS FOR GOVERNMENT-OWNED/CONTRACTOR-OPERATED (GOCO) AND

CONTRACTOR-OWNED/CONTRACTOR-OPERATED (COCO) RESOURCES

1. A&A Package Deliverables - The Contractor (and/or any subcontractor) shall provide an A&A package within 30 days of contract award to the CO and/or COR. The following SA&A deliverables are required to complete the SA&A package. The NIH Assessment and Authorization Process is found at: https://wiki.ocio.nih.gov/wiki/index.php/NIH_Assessment_and_Authorization_(A%26A)_Pro cess .

• System Security Plan (SSP) - due within 30 days after contract award. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800- 53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and NIH policies and other guidance. The SSP shall be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

• E-Authentication Questionnaire - The Contractor (and/or any subcontractor) shall collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods shall follow OMB 04-04 and NIST SP 800-63, Rev. 2, Electronic Authentication Guidelines.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

2. Information Security Continuous Monitoring - Upon the government issuance of an Authority to Operate (ATO), the Contractor (and/or subcontractor)-owned/operated systems that input, store, process, output, and/ or transmit government information, shall meet or exceed the Information Security Continuous Monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800- 137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations , and HHS IS2P. The following are the minimum requirements for ISCM:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://wiki.ocio.nih.gov/wiki/index.php/NIH_Assessment_and_Authorization_(A%26A)_Process https://wiki.ocio.nih.gov/wiki/index.php/NIH_Assessment_and_Authorization_(A%26A)_Process

i. Asset Management - Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS- owned information/ data. It is anticipated that this inventory information will be required to be produced at least 60 days after contract award. IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The Contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

ii. Configuration Management - Use available SCAP- compliant automated tools, per NIST IR 7511, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard HHS and government configuration baselines at least within 60 days. The Contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

iii. Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST- specified SCAP standards for vulnerability identification and management. The Contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP- compliant automated tools and report to the agency at least within 30 days of the contract award.

iv. Patching and Vulnerability Remediation - Install vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within vendor and agency specified timeframes.

v. Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

3. End of Life Compliance- The Contractor (and/or any subcontractor) must use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software need to be within one major version of the current version; deviation from this requirement will only be allowed via the HHS waiver process (approved by HHS CISO).

The Contractor shall retire and/or upgrade all software/systems that have reached end-of-life in accordance with HHS End-of-Life Operating Systems, Software, and Applications Policy.

CLOUD SERVICES

A. Protection of Information in a Cloud Environment

1. If Contractor (and/or any subcontractor) personnel must remove any information from the primary work area, they shall protect it to the same extent they would the proprietary data and/ or company trade secrets and in accordance with HHS/ NIH policies.

2. HHS will retain unrestricted rights to federal data handled under this contract. Specifically, HHS retains ownership of any user created/ loaded data and applications collected, maintained, used, or operated on behalf of HHS and hosted on Contractor's infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data must be available to HHS within one (1) business day from request date or within the timeframe specified otherwise. In addition, the data shall be provided at no additional cost to HHS.

3. The Contractor (and/or any subcontractor) must ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with FedRAMP requirements and HHS policies.

4. The Contractor must support a system of records in accordance with NARA-approved records schedule(s) and protection requirements for federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to the following:

a. Maintenance of links between records and metadata, and

b. Categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA- approved retention schedules.

5. The disposition of all HHS data must be at the written direction of HHS/ NIH. This may include documents returned to HHS control; destroyed; or held as specified until otherwise directed.

Items returned to the Government must be hand carried or sent by certified mail to the COR.

a. If the system involves the design, development, or operation of a system of records on individuals, the Contractor shall comply with the Privacy Act requirements.

B. Reporting and Continuous Monitoring

1. Following the initial ATOs, the Contractor (and/or any subcontractor) must perform the minimum ongoing continuous monitoring activities specified below, submit required deliverables by the specified due dates, and meet with the system/ service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities.

2. At a minimum, the Contractor must provide the following artifacts/deliverables on a monthly basis as directed by the Contracting Officer/Contracting Officer Representative:

vi. Operating system, database, Web application, and network vulnerability scan results.

vii. Updated POA&Ms;

viii. Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the NIH System Owner or AO; and

ix. Any configuration changes to the system and/or system components or CSP's cloud environment, that may impact HHS/NIH's security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency.

C. Incident Reporting

1. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within one (1) hour of the discovery of the loss/theft, whether the response is positive or negative. FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cyber security and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as "a suspected or confirmed incident involving PII" .

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-3 validated encryption.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send NIH approved notifications to affected individuals in accordance with https://wiki.ocio.nih.gov/wiki/index.php/US- CERT_Federal_Incident_Notification_Guidelines .

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT) IRT@nih.gov , COR, CO, the NIH Office of the SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour of the discovery of the loss/theft, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

• Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

• Not include any sensitive information in the subject or body of any reporting e-mail; and

• Encrypt sensitive information in attachments to email, media, etc.

9. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information HHS and NIH incident response policies when handling PII breaches.

10. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to Contractor facilities during a breach/incident investigation.

https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines mailto:IRT@nih.gov

11. The Contractor (and/or any subcontractor) must provide an Incident and Breach Response Plan (IRP) in accordance with HHS/NIH, OMB, and US-CERT requirements and obtain approval from the NIH. In addition, the Contractor must follow the incident response and US-CERT reporting guidance contained in the FedRAMP Incident Communications.

12. The Contractor (and/or any subcontractor) must implement a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of federal data, afford HHS access to its facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The program of inspection must include, but is not limited to:

a. Conduct authenticated and unauthenticated operating system/network/database/Web application vulnerability scans. Automated scans can be performed by HHS/NIH personnel, or agents acting on behalf of HHS/NIH, using agency-operated equipment and/or specified tools. The Contractor may choose to run its own automated scans or audits, provided the scanning tools and configuration settings are compliant with NIST Security Content Automation Protocol (SCAP) standards and have been approved by the agency. The agency may request the Contractor's scanning results and, at the agency discretion, accept those in lieu of agency performed vulnerability scans.

b. In the event an incident involving sensitive information occurs, cooperate on all required activities determined by the agency to ensure an effective incident or breach response and provide all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. In addition, the Contractor must follow the agency reporting procedures and document the steps it takes to contain and eradicate the incident, recover from the incident, and provide a post-incident report that includes at a minimum the following:

• Company and point of contact name;

• Contract information;

• Impact classifications/threat vector;

• Type of information compromised;

• A summary of lessons learned; and

• Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future.

OTHER IT PROCUREMENTS

NON-COMMERC…