DHHS-NIHAO2012066 - Amendment 1.pdf

AMENDMENT OF SOLICITATION / MODIFICATION OF

CONTRACT

1. CONTRACT ID CODE

PAGE OF PAGES

1 2

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

08/13/2012

4. REQUISITION/PURCHASE REQ. NO

5. PROJECT NO.

(If applicable)

6. ISSUED BY

National Institutes of Health, NIAID, AMOB

CODE

7. ADMINISTERED BY

10401 Fernwood Road, MSC 4813 Bethesda, MD 20817

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP code)

All Potential Offerors

9A. AMENDMENT OF SOLICITATION NO.

DHHS-NIHAO2012066

9B. DATED (SEE ITEM 11)

August 15, 2007

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

FACILITY CODE

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended is not extended.

Offerors must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing Items 8 and 15, and returning 1 copy of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify Authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET

FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copy to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

This amendment provides for the following with respect to the subject RFP.

1. Attachment 1 – Packaging and Delivery of the Proposal

2. Attachment 2 - Proposal Intent Sheet. This item which was erroneously noted as Attachment 1 should be regarded as Attachment 2 to the RFP. A copy of the previously omitted Proposal Intent Sheet is attached to this amendment

3. Provide copies of Attachments referenced in Part III - Section J

4. Correct the link contained at Part IV - Representations and Instructions

The response due date for submission of offerors is extended.

Offeror is hereby directed that:

Proposals for furnishing the supplies and/or services in THE SCHEDULE of subject RFP DHHS-NIHAO2012066 will be received at the place specified in, and in the number of copies specified, until 10:00 am local time on September 14, 2012.

Offers will be valid for 120 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043” provided with the RFP.

Please review the Federal Business Opportunities website (www.fedbizopps.gov) for additional information.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Daniel J. Hartinger, Contracting Officer

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED

16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

16C. DATE SIGNED

NSN 7540-01-152-8070

PREVIOUS EDITION UNUSABLE

30-105

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

http://www.fedbizopps.gov/

RFP DHHS-NIHAO2012066 Amendment 1

1. Attachment 1 – Packaging and Delivery of the Proposal - Erroneously referenced single-sided and double sided print. The Offeror’s proposal shall be printed double sided with both sides counting towards the page limit.

Attachment 1 – Packaging and Delivery of the Proposal referenced “type-spacing.” This element is removed from the attachment and proposal requirements. A revised Attachment 1 is attached to this amendment.

2. Attachment 2 - Proposal Intent Sheet. This item which was erroneously noted as Attachment 1 should be regarded as Attachment 2 to the RFP. A copy of the previously omitted Proposal Intent Sheet is attached to this amendment

3. Copies of the following documents are provided with this amendment to replace broken links noted in Part III - Section J

Solicitation Attachments:

i. Attachment 9 - Adjunct Security Documents

Business Proposal Attachments:

i. Attachment 15 - Disclosure of Lobbying Activities, OMB Form SF-LLL

Informational Attachments:

i. Attachment 19 - Commitment to Protect Non-Public Informational Contractor Agreement

ii. Attachment 20 - Roster of Employees Requiring Suitability Investigations

iii. Attachment 21 - Employee Separation Checklist

4. Part IV - Representations and Instructions is corrected as follows:

The link to Online Representations and Certifications Application (ORCA) is no longer valid.

Offeror(s) should reference the Online Representations and Certification Application (ORCA) at the System for Acquisition Management located at www.SAM.gov http://www.sam.gov/

Attachment 2

PROPOSAL INTENT RESPONSE SHEET

RFP No.: DHHS-NIHAO2012066 RFP Title: Maintenance of a Specific Pathogen Free Indian-Origin Rhesus Macaque Breeding Program

Please review the attached Request for Proposal. Furnish the information requested below and return this page by email by August 29, 2012. Your expression of intent is not binding but will greatly assist us in planning for proposal evaluation.

[ ] DO INTEND TO SUBMIT A PROPOSAL

[ ] DO NOT INTEND TO SUBMIT A PROPOSAL FOR THE FOLLOWING

REASONS: ______________________________________________

Company/Institution Name (print): _____________________________________ Address (print): _____________________________________________________

Project Director's Name (print): ________________________________________ Title (print): _________________________________________________________ Signature/Date: ______________________________________________________ Telephone Number and E-mail Address (print clearly):

Names of Collaborating Institutions and Investigators (include Subcontractors and Consultants) (print):

(Continue list on a separate page if necessary)

RETURN VIA E-MAIL TO:

LaDonna Stewart Contract Specialist Acquisitions Management Operations Branch, OA Bethesda, MD 20892-4813 Attn: RFP DHHS-NIHAO2012066 Email: lstewart@niaid.nih.gov

Attachment 1

Page 1of 2

PACKAGING AND DELIVERY OF THE PROPOSAL

PAPER SUBMISSION: The paper copy is the official copy for recording timely receipt of proposals.

SUBMISSION OF PROPOSALS BY FACSIMILE OR E-MAIL IS NOT ACCEPTABLE.

A. EXTERNAL PACKAGE MARKING:

In addition to the address cited below, mark each package as follows:

"RFP NO. DHHS-NIHAO2012066

TO BE OPENED BY AUTHORIZED GOVERNMENT PERSONNEL ONLY"

B. PAPER COPIES and CD-Rom to:

If Hand Delivery or Express Service If using U.S. Postal Service LaDonna Stewart Contract Specialist Office of Acquisitions, AMOB, NIAID, NIH 10401 Fernwood Road, Room 2NE70 MSC 4813 Bethesda, Maryland 20817

LaDonna Stewart Contract Specialist Office of Acquisitions, AMOB, NIAID, NIH 10401 Fernwood Road, 2NE70 MSC 4813 Bethesda, Maryland 20892-4813

NOTE: All material sent to this office by Federal Express should be sent to the Hand Carried Address.

NOTE: The U.S. Postal Service's "Express Mail" does not deliver to the hand delivered (20817 zip code) address. Any package sent to this address via this service will be held at a local post office for pick-up. THE GOVERNMENT IS NOT RESPONSIBLE FOR PICKING UP ANY MAIL AT A LOCAL POST OFFICE. If a proposal is not received at the place, date, and time specified herein, it will be considered a "late proposal," in accordance with HHSAR 352.215-70, Late Proposals and Revisions (NOV 1986).

Note: The delivery address (Suite 2NE70) is located within a secured facility. PLEASE ALLOW

ADEQUATE TIME TO GET YOUR PACKAGE THROUGH THE SECURITY POINT AND TO

THE CONTRACTING OFFICER OR DESIGNEE BEFORE THE SPECIFIED DUE DATE AND

TIME.

C. NUMBER OF COPIES:

PROPOSALS ARE SUBJECT TO A PAGE LIMITATION. THE TOTAL PAGE COUNT DOES

NOT INCLUDE: Title and Back Page; NIH-2043; Table of Contents; Section Dividers that do not contain information other than title of Section; or other attachments as indicated below.

PROPOSALS SHALL NOT INCLUDE LINKS TO INTERNET WEB SITE ADDRESSES (URLs) OR

OTHERWISE DIRECT READERS TO ALTERNATE SOURCES OF INFORMATION.

PROPOSALS ARE REQUIRED TO BE SUBMITTED DOUBLE-SIDED. DOUBLE-SIDED PAGES

COUNT AS 2 PAGES.

FORMATTING AND LAYOUT:

Use your usual word processing and spreadsheet programs to prepare and format the technical and business proposals.

Documents submitted using Adobe .pdf shall be submitted using a .pdf searchable format.

• Type size must be no smaller than 11 point Times New Roman font or 10 point Arial (including any

Executive Summaries, Attachments, and Appendices). This total does not include attachments required in

Attachment 1

Page 2of 2

Section J, Tables of Contents, the IT Security Plan (5 page limit), or Resumes of Key Personnel.

Resumes of Key Personnel are limited to three (3) pages per individual.

• Print margins must be at least one inch on each edge of the paper.

• Print setup should be double-sided on standard, letter-size recycled paper (8.5 x 11" in the U.S., A4 in

Europe).

CREATING AND NAMING ELECTRONIC FILES:

1. A single CD should be submitted with the Technical Proposal and Business Proposal information.

2. It is requested that the Technical Proposal be submitted as one document.

Note: If multiple files are submitted for the either proposal, please include the name of the section in the file name.

EXAMPLE: XYX Company-07-16-Technical-Approach-3-6-06

3. CDs should be named using the following format:

Company name-RFP number-technical and business-date

THE NUMBER OF COPIES AND APPLICABLE PAGE LIMITATIONS REQUIRED OF EACH

PART OF YOUR PROPOSAL ARE AS SPECIFIED BELOW.

PAGES IN EXCESS OF THIS LIMITATION WILL BE REMOVED FROM THE PROPOSAL AND

WILL NOT BE PROVIDED TO THE REVIEWERS TO BE READ OR EVALUATED.

OFFERORS MUST CERTIFY THAT THE INFORMATION IN THE PAPER AND ELECTRONIC

COPIES IS EXACTLY THE SAME.

Document Number of Copies

Page Limits

Technical Proposal and all Appendices

PAPER

One (1) unbound SIGNED ORIGINAL.

Six (6) unbound COPIES

Not to Exceed 40 pages (inclusive of all Attachments and Appendices) with the exception of the following:

attachments required in Section J, Tables of Contents, the IT Security Plan, or Resumes of Key Personnel.

Resumes of key personnel are limited to 3 pages per individual)

Business Proposal

PAPER

One (1) unbound SIGNED ORIGINAL.

Five (5) unbound COPIES

N/A

1 Electronic CD containing the Offerors Technical and Business Proposal N/A

National Institutes of Health (NIH) E-Authentication Risk Assessment (ERA)

System Name: _____________________________________________ (Include IC)

1. Potential Impact of Authentication Errors:

Indicate the potential impact of the authentication error based on the explanation provided for low, moderate, and high impact below. Please note that a system may have multiple types of transactions (e.g., create, update, delete, read), in which case a separate analysis should be done of the potential impact of each transaction.

Potential Impact Categories for Authentication

Errors

Questions Transaction N/A Low Moderate High

Determine Potential Impact of Authentication Errors

1. Potential impact of inconvenience, distress, or damage to standing or reputation:

Low: At worst, limited, short-term inconvenience, distress or embarrassment to any party.

Moderate: At worst, serious short term or limited long-term inconvenience, distress or damage to the standing or reputation of any party.

High: Severe or serious long-term inconvenience, distress or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals).

Create

Update

Delete

Read

Highest Impact

2. Potential impact of financial loss:

Low: At worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, an insignificant or inconsequential agency liability.

Moderate: At worst, a serious unrecoverable financial loss to any party, or a serious agency liability.

High: Severe or catastrophic unrecoverable financial loss to any party; or severe or catastrophic agency liability.

Create

Update

Delete

Read stewartl Typewritten Text Attachment 9a stewartl Typewritten Text

Questions Transaction N/A Low Moderate High

Determine Potential Impact of Authentication Errors

3. Potential impact of harm to agency programs or public interests:

Low: At worst, a limited adverse effect on organizational operations or assets, or public interests. Examples of limited adverse effects are: (i) mission capability degradation to the extent and duration that the organization is able to perform its primary functions with noticeably reduced effectiveness, or (ii) minor damage to organizational assets or public interests.

Moderate: At worst, a serious adverse effect on organizational operations or assets, or public interests. Examples of serious adverse effects are: (i) significant mission capability degradation to the extent and duration that the organization is able to perform its primary functions with significantly reduced effectiveness; or (ii) significant damage to organizational assets or public interests.

High: A severe or catastrophic adverse effect on organizational operations or assets, or public interests. Examples of severe or catastrophic effects are: (i) severe mission capability degradation or loss of to the extent and duration that the organization is unable to perform one or more of its primary functions; or (ii) major damage to organizational assets or public interests.

Create

Update

Delete

Read

4. Potential impact of unauthorized release of sensitive information:

Low: At worst, a limited release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS 199.

Moderate: At worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a moderate impact as defined in FIPS 199.

High: A release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a high impact as defined in

FIPS 199.

Create

Update

Delete

Read

5. Potential impact to personal safety:

Low: At worst, minor injury not requiring medical treatment.

Moderate: At worst, moderate risk of minor injury or limited risk of injury requiring medical treatment.

High: A risk of serious injury or death.

Create

Update

Delete

Read

Attachment 9a

Questions Transaction N/A Low Moderate High

Determine Potential Impact of Authentication Errors

6. The potential impact of civil or criminal violations is:

Low: At worst, a risk of civil or criminal violations of a nature that would not ordinarily be subject to enforcement efforts.

Moderate: At worst, a risk of civil or criminal violations that may be subject to enforcement efforts.

High: A risk of civil or criminal violations that are of special importance to enforcement programs.

Create

Update

Delete

Read

2. E-Authentication Assurance Level:

Compare the values listed in the “Potential Impact Categories for Authentication Errors” table to the “Maximum Potential Impacts for Each Assurance Level” (below) for each type of transaction.

Assurance Level Impact Profiles

Maximum Potential Impacts for Each Assurance Level 1 2 3 4

Determine E-Authentication Assurance Level

1. Potential impact of inconvenience, distress, or damage to standing or reputation:

Low Moderate Moderate High

2. Potential impact of financial loss Low Moderate Moderate High

3. Potential impact of harm to agency programs or public interests N/A Low Moderate High

4. Potential impact of unauthorized release of sensitive information N/A Low Moderate High

5. Potential impact to personal safety N/A N/A Low Moderate, High

6. The potential impact of civil or criminal violations is N/A Low Moderate High

Select the Assurance Level Impact Profile Number (e.g., 1, 2, 3, or 4) for each potential impact that is most closely aligned to the corresponding responses in the "Potential Impact Categories for Authentication Errors” table. In some cases, impact may correspond to multiple assurance levels. For example, a moderate risk of financial loss corresponds to assurance levels 2 and 3.

ICs should use the context to determine the appropriate assurance level.

The overall, final assurance level requirement for the information system is the dominant, recurring assurance level for each maximum potential impact.

After the assurance level was determined, follow NIST SP 800-63 to select appropriate technology that, at a minimum, meets the technical requirements for the required level of assurance.

stewartl

Attachment 9a

The OVERALL, FINAL ASSURANCE Level is _____________________________

I agree that the above evaluation is correct.

System Owner: _________________________________________Date__________________

System Owner printed name_______________________________________________

ISSO: ________________________________________________Date__________________

ISSO printed name_______________________________________________________

DAA: ________________________________________________ Date__________________

DAA printed name_______________________________________________________

Typewritten Text stewartl

Attachment 9a

E-Authentication Threshold Analysis (ETA) As system documentation is developed for a particular system, an ETA is required to determine if a full E-Authentication Risk Assessment (ERA) is necessary.

The following process guides a System Owner or ISSO through ETA/ERA and documentation, in accordance with OMB M-04-04 and NIST SP 800-63, Electronic Authentication Guideline.

Each NIH system (including minor children) must have a signed ETA completed and archived in the NIH Certification and Accreditation Tool (NCAT) as part of the C&A process. If an ERA is required, that document must be signed and archived in NCAT, also.

Questions Yes No

1. Does the information system require authentication for users to access its data/functionality?

2. Is the system browser based?

3. Is the system external facing? (i.e., is this an information system with users that are connected only to the public Internet?)

Any system that has a “no” response to any one of the three questions does not need an ERA.

Only those systems with a “yes” response to all three of the preceding questions need an ERA:

Requiring authentication

Being browser based

Being external facing (with external users that require authentication)

System:________________________________________________________________

Based on the information above, an E-Authentication is required.

Based on the information above, an E-Authentication is not required.

I agree that the above evaluation is correct.

System Owner: _________________________________________Date__________________

System Owner printed name_______________________________________________

ISSO: ________________________________________________Date__________________

ISSO printed name__Kenneth L. Grossman__________________________________

DAA: ________________________________________________ Date__________________

DAA printed name___Michael Tartakovsky_________________________________

Typewritten Text Attachment 9b

FIPS 199/NIST 800-60 SYSTEM CATEGORIZATION

SYSTEM INFORMATION

System Name

IC

System Type

General Support System Major Application Application Date

Overall System Security Category Low Moderate High Status:

Overall Impact Levels (High Water Mark)

Confidentiality Integrity Availability

System Description

Signature of DAA: Date:

Impact Level Determination and Review performed by:

Name Company Role (System Owner, ISSO, DAA, CA, etc.)

ISSO

DAA

System Owner

INFORMATION TYPE(S), PROVISIONAL IMPACT LEVEL(S), ADJUSTED IMPACT LEVEL(S), RATIONALE

Category of Information (800-60) Provisional Impact Levels Adjusted Impact Levels

Confidentiality Integrity Availability Confidentiality Integrity Availability

Rationale

Attachment 9d

SYSTEM INFORMATION

System Name

IC

System Type

General Support System Major Application Application Date

Overall System Security Category Low Moderate High Status:

Overall Impact Levels (High Water Mark)

Confidentiality Integrity Availability

Attachment 9c

06.1 HHS Privacy Impact Assessment (Form) / 01 OpDiv Information Systems (Portfolio) ProSight

PIA SUMMARY

The following required questions represent the information necessary to complete the PIA Summary for transmission to the Office of Management and Budget.

Note: If a question or its response is not applicable, please answer “No” to that question.

2 Summary of PIA Required Questions

*Is this a new PIA?

If this is an existing PIA, please provide a reason for revision:

*1. Date of this Submission:

*2. OPDIV Name:

*3. Unique Project Identifier (UPI) Number:

Note: If the system does not have a UPI, please explain why it does not:

*4. Privacy Act System of Records (SOR) Number:

*5. OMB Information Collection Approval Number:

OMB Collection Approval Number Expiration Date:

*6. Other Identifying Number(s):

*7. System Name:

*9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:

Point of Contact Information

POC Name

*10. Provide an overview of the system:

*13. Indicate if the system is new or an existing one being modified:

*17. Does/Will the system collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system?

Note: This question seeks to identify any, and all, personal information associated with the system. This includes any IIF, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation

Note: If no IIF is contained in the system, please answer questions 21, 23, 30, 31, 37, 50 and 54, then promote the PIA to the Sr. Privacy Official who will authorize the PIA.

If this system contains IIF, all remaining questions on the PIA Form Tabs must be completed prior to signature and promotion.

*21. Is the system subject to the Privacy Act?

*23. If the system shares or discloses IIF please specify with whom and for what purpose(s):

*30. Please describe in detail the information the agency will collect, maintain, or disseminate and why and for what purpose the agency will use the information. In this description, indicate whether the information contains IIF and whether submission of personal information is voluntary or mandatory:

*31. Please describe in detail any processes in place to:

• notify and obtain consent from the individuals whose IIF is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection)

• notify and obtain consent from individuals regarding what IIF is being collected from them and how the information will be used or shared:

*32. Does the system host a website?

*37. Does the website have any information or pages directed at children under the age of thirteen?

*50. Are there policies or guidelines in place with regard to the retention and destruction of IIF?

*54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.

PIA REQUIRED INFORMATION

1 HHS Privacy Impact Assessment (PIA)

The PIA determines if information in identifiable form (IIF) is contained within a system, what kind of IIF, what is done with that information, and how that information is protected. Systems with IIF are subject to an extensive list of requirements based on privacy laws, regulations, and guidance. The HHS Privacy Act Officer, for issues related to Freedom of Information Act (FOIA) and the Privacy Act, and respective Operating Division (OPDIV) Privacy Contacts, for issues related to the Privacy Act, can all be used as a resource for questions related to the technicalities of privacy law. The Office of the Chief Information Officer (OCIO) can be used as a resource for questions related to the administrative, technical, and physical controls of the system. Please note that answers to questions with an asterisk (*) will be submitted to the Office of Management and Budget (OMB) and made publicly available in accordance with OMB Memorandum (M) 03-22.

Note: If a question or its response is not applicable, please answer “No” to that question.

2 General Information

*Is this a new PIA?

If this is an existing PIA, please provide a reason for revision:

*1. Date of this Submission:

*2. OPDIV Name:

*3. Unique Project Identifier (UPI) Number:

Note: If the system does not have a UPI, please explain why it does not:

*4. Privacy Act System of Records (SOR) Number:

*5. OMB Information Collection Approval Number:

OMB Collection Approval Number Expiration Date:

*6. Other Identifying Number(s):

*7. System Name:

8. System Location: (OPDIV or contractor office building, room, city, and state)

System Location:

OPDIV or contractor office building

Room

City

State

*9. System Point of Contact (POC) (name, title, organization, phone, email). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:

Point of Contact Information

POC Name

The following information will not be made publicly available:

POC Title

POC Organization

POC Phone

POC Email

*10. Provide an overview of the system:

SYSTEM CHARACTERIZATION AND DATA CATEGORIZATION

1 System Characterization and Data Configuration

11. Does HHS own the system?

If no, identify the system owner:

12. Does HHS operate the system?

If no, identify the system operator:

*13. Indicate if the system is new or an existing one being modified:

14. Identify the life-cycle phase of this system:

Phase: Yes/No

Initiation

Development/Acquisition

Implementation

Operations/Maintenance

Disposal

Mixed Life Cycle

15. Have any of the following major changes occurred to the system since the PIA was last submitted?

If yes, please check each major change that has occurred: Yes/No

Conversions

Anonymous to Non-Anonymous

Significant System Management Changes

Significant Merging

New Public Access

Commercial Sources

New Interagency Uses

Internal Flow or Collection

Alteration in Character of Data

16. Is the system a General Support System (GSS) or a Major Application (MA)?

*17. Does/Will the system collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system?

Note: This question seeks to identify any, and all, personal information associated with the system. This includes any IIF, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or whether it is personal information about business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation.

Note: If no IIF is contained in the system, please answer questions 21, 23, 30, 31, 32, 37, 50 and 54, then promote the PIA to the OPDIV Senior Official for Privacy who will authorize the PIA.

If this system contains IIF, all remaining questions on the PIA Form Tabs must be completed prior to signature and promotion.

Please select "Yes" for all applicable IIF categories. If the applicable IIF category is not listed, please use the Other field to identify the appropriate category of IIF:

Check all that Apply: Yes/No

Date of Birth

Social Security Number (SSN)

Photographic Identifiers

Driver’s License

Biometric Identifiers

Mother’s Maiden Name

Vehicle Identifiers

Mailing Address

Phone Numbers

Medical Records Numbers

Medical Notes

Financial Account Information

Certificates

Legal Documents

Device Identifiers

Web Uniform Resource Locator(s) (URL)

Email Address

Education Records

Military Status

Employment Status

Foreign Activities

Other

18. Please indicate the categories of individuals about whom IIF is collected, maintained, disseminated and/or passed through. Note: If the applicable IIF category is not listed, please use the Other field to identify the appropriate category of IIF.

Categories: Yes/No

Employees

Public Citizen

Patients

Business partners/contacts (Federal, state, local agencies)

Vendors/Suppliers/Contractors

19. Are records on the system retrieved by one or more data elements?

If yes, please select all applicable IIF categories. If the applicable IIF category is not listed, please use the Other field to identify the appropriate category of IIF.

Please specify what data elements are or will be used in retrieving the records:

Yes/No

Name

Date of Birth

SSN

Photographic Identifiers

Driver’s License

Biometric Identifiers

Mother’s Maiden Name

Vehicle Identifiers

Mailing Address

Phone Numbers

Medical Records Numbers

Medical Notes

Financial Account Information

Certificates

Legal Documents

Device Identifiers

Web URLs

Email Address

Education Records

Military Status

Employment Status

20. Are 10 or more records containing IIF maintained, stored or transmitted/passed through this system?

*21. Is the system subject to the Privacy Act?

21 A. If yes, but a SOR has not been created, please provide an explanation:

INFORMATION SHARING PRACTICES

1 Information Sharing Practices

22. Does the system share or disclose IIF with other divisions within this agency, external agencies, or other people or organizations outside the agency?

If yes, please identify the category of IIF shared or disclosed. If the category of personal information is not listed, please check Other and identify the category.

Date of Birth

SSN

Photographic Identifiers

Driver’s License

Biometric Identifiers

Mother’s Maiden Name

Vehicle Identifiers

Mailing Address

Phone Numbers

Medical Records Numbers

Medical Notes

Financial Account Information

Certificates

Legal Documents

Device Identifiers

Web URLs

Email Address

Education Records

Military Status

Employment Status

*23. If the system shares or discloses IIF please specify with whom and for what purpose(s):

24. If the IIF in the system is matched against IIF in one or more other computer systems, are computer data matching agreement(s) in place?

25. Is there a process in place to notify organizations or systems that are dependent upon the IIF contained in this system when major changes occur (i.e., revisions to IIF, or when the system is replaced)?

26. Are individuals notified how their IIF is going to be used?

If yes, please describe the process for allowing individuals to have a choice:

27. Is there a complaint process in place for individuals who believe their IIF has been inappropriately obtained, used, or disclosed, or that the IIF is inaccurate?

If yes, please describe briefly the notification process:

28. Are there processes in place for periodic reviews of IIF contained in the system to ensure the data’s integrity, availability, accuracy and relevancy?

If yes, please describe briefly the review process:

29. Are there rules of conduct in place for access to IIF on the system?

If yes, identify all users with access to IIF on the system and briefly state the purpose for each user to have access:

Users with access to IIF Yes/No Purpose

User

Administrators

Developers

Contractors

*30. Please describe in detail the information the agency will collect, maintain, or disseminate and why and for what purpose the agency will use the information. In this description, indicate whether the information contains IIF and whether submission of personal information is voluntary or mandatory:

*31. Please describe in detail any processes in place to:

• notify and obtain consent from the individuals whose IIF is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection)

• notify and obtain consent from individuals regarding what IIF is being collected from them and how the information will be used or shared:

Note: Please describe in what format individuals will be given notice of consent (e.g., written notice, electronic notice, etc.).

WEBSITE HOSTING PRACTICES

1 Website Hosting Practices

32. Does the system host a website?

If yes, please indicate what type of site the system hosts: Yes/ No

Internet

Intranet

Both

33. Is the website accessible by the public or other entities (i.e., Federal, state, and/or local agencies, contractors, third party administrators, etc.)?

34. Is a website privacy policy statement (consistent with OMB M-03-22 and Title II and III of the E-Government Act) posted on the website?

35. Is the website’s privacy policy in machine-readable format, such as Platform for Privacy Preferences (P3P)?

If no, please indicate when the website will be P3P compliant:

36. Does the website employ persistent tracking technologies?

If yes, identify the type(s) of cookies in use: Yes/No

Web Bugs

Web Beacons

Session Cookies

Persistent Cookies

*37. Does the website have any information or pages directed at children under the age of thirteen?

If yes, is there a unique privacy policy for the site, and does the unique privacy policy address the process for obtaining parental consent if any information is collected?

38. Does the website collect IIF from individuals?

If yes, please indicate the category of IIF: Yes/No

Date of Birth

SSN

Photographic Identifiers

Driver's License

Biometric Identifiers

Mother's Maiden Name

Vehicle Identifiers

Mailing Address

Phone Numbers

Medical Records Numbers

Medical Notes

Financial Account Information

Certificates

Legal Documents

Device Identifiers

Web URLs

Email Address

Education Records

Military Status

Employment Status

39. Are rules of conduct in place for access to IIF on the website?

40. Does the website contain links to sites external to the OPDIV that owns and/or operates the system?

If yes, note whether the system provides a disclaimer notice for users that follow external links to websites not owned or operated by the OPDIV.

ADMINISTRATIVE CONTROLS

1 Administrative Controls

Note: This PIA uses the terms “Administrative,” “Technical” and “Physical” to refer to security control questions— terms that are used in several Federal laws when referencing security requirements.

41. Has the system been certified and accredited (C&A)?

If the system requires a C&A and one has not been completed, please indicate when the C&A is scheduled for completion.

42. Is there a system security plan for this system?

43. Is there a contingency (or backup) plan for the system?

44. Are files backed up regularly?

45. Are backup files stored offsite?

46. Are there user manuals for the system?

47. Have personnel (system owners, managers, operators, contractors and/or program managers) using the system been trained and made aware of their responsibilities for protecting the information being collected and maintained?

48. If contractors operate or use the system, do the contracts include clauses ensuring adherence to privacy provisions and practices?

49. Are methods in place to ensure least privilege (i.e., “need to know” and accountability)?

If yes, please specify method(s).

*50. Are there policies or guidelines in place with regard to the retention and destruction of IIF?

If yes, please provide some detail about these policies/practices.

TECHNICAL CONTROLS

1 Technical Controls

51. Are technical controls in place to minimize the possibility of unauthorized access, use, or dissemination of the data in the system?

If yes, check all technical controls that are currently in place: Yes/No

User Identification

Passwords

Firewall

Virtual Private Network (VPN)

Encryption

Intrusion Detection System (IDS)

Common Access Cards (CAC)

Smart Cards

Biometrics

Public Key Infrastructure (PKI)

52. Is there a process in place to monitor and respond to privacy and/or security incidents?

If yes, please briefly describe the process:

PHYSICAL ACCESS

1 Physical Access

53. Are physical access controls in place?

If yes, check all physical controls that are currently on the system. Yes/No

Guards

Identification Badges

Key Cards

Cipher Locks

Biometrics

Closed Circuit TV (CCTV)

*54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.

APPROVAL/DEMOTION

1 PIA Reviewer Approval/Promotion or Demotion

Promotion/Demotion:

Comments:

Approval/Demotion Point of Contact:

2 Senior Official for Privacy Approval/Promotion or Demotion

Promotion/Demotion:

Comments:

3 OPDIV Senior Official for Privacy or Designee Approval

Please print the PIA and obtain the endorsement of the reviewing official below. Once the signature has been collected, retain a hard copy for the OPDIV's records. Submitting the PIA will indicate the reviewing official has endorsed it

This PIA has been reviewed and endorsed by the OPDIV Senior Official for Privacy or Designee (Name and Date):

Name: __________________________________ Date: __________________________________

Name:

Date:

4 Department Approval to Publish to the Web

Approved for web publishing

Date Published:

DISCLOSURE OF LOBBYING ACTIVITIES Approved by OMB

Complete this form to disclose lobbying activities pursuant to 31 U.S.C. 1352 0348-0046

(See reverse for public burden disclosure.)

1. Type of Federal Action: 2. Status of Federal Action: 3. Report Type:

a. contract a. bid/offer/application a. initial filing

b. grant b. initial award b. material change

c. cooperative agreement c. post-award For Material Change Only:

d. loan year _________ quarter _________

e. loan guarantee date of last report ______________

f. loan insurance

4. Name and Address of Reporting Entity: 5. If Reporting Entity in No. 4 is a Subawardee, Enter Name and Address of Prime:

Tier ______, if known :

Congressional District, if known : Congressional District, if known :

6. Federal Department/Agency: 7. Federal Program Name/Description:

CFDA Number, if applicable: _____________

8. Federal Action Number, if known : 9. Award Amount, if known :

10. a. Name and Address of Lobbying Registrant b. Individuals Performing Services (including address if ( if individual, last name, first name, MI): different from No. 10a )

(last name, first name, MI ):

11. Signature:

Print Name:

Title:

Telephone No.: _______________________

Authorized for Local Reproduction

Standard Form LLL (Rev. 7-97)

Information requested through this form is authorized by title 31 U.S.C. section 1352. This disclosure of lobbying activities is a material representation of fact upon which reliance was placed by the tier above when this transaction was made or entered into. This disclosure is required pursuant to 31 U.S.C. 1352. This information will be available for public inspection.

required disclosure shall be subject to a not more than $100,000 for each such failure.

Prime Subawardee

Federal Use Only:

Date:

who fails to file the Any person $10,000 and than civil penalty of not less

INSTRUCTIONS FOR COMPLETION OF SF-LLL, DISCLOSURE OF LOBBYING ACTIVITIES

This disclosure form shall be completed by the reporting entity, whether subawardee or prime Federal recipient, at the initiation or receipt of a covered Federal action, or a material change to a previous filing, pursuant to title 31 U.S.C. section 1352. The filing of a form is required for each payment or agreement to make payment to any lobbying entity for influencing or attempting to influence an officer or employeeof any agency, a Member of Congress, an officer or employeeof Congress, or an employeeof a Member of Congress in connectionwith a coveredFederalaction. Completeall items that apply for both the initial filing and material change report. Refer to the implementing guidance published by the Office of Management and Budget for additional information.

1. Identify the type of covered Federal action for which lobbying activity is and/or has been secured to influence the outcome of a covered Federal action.

2. Identify the status of the covered Federal action.

3. Identify the appropriateclassification of this report. If this is a followup report caused by a material change to the information previously reported, enter the year and quarter in which the change occurred. Enter the date of the last previously submitted report by this reporting entity for this covered Federal action.

4. Enter the full name, address, city, State and zip code of the reporting entity. Include CongressionalDistrict, if known. Check the appropriateclassification of the reporting entity that designates if it is, or expects to be, a prime or subaward recipient. Identify the tier of the subawardee,e.g., the first subawardee of the prime is the 1st tier. Subawards include but are not limited to subcontracts, subgrants and contract awards under grants.

5. If the organization filing the report in item 4 checks "Subawardee," then enter the full name, address, city, State and zip code of the prime Federal recipient. Include Congressional District, if known.

6. Enter the name of the Federal agency making the award or loan commitment. Include at least one organizationallevel below agency name, if known. For example, Department of Transportation, United States Coast Guard.

7. Enter the Federal program name or description for the covered Federal action (item 1). If known, enter the full Catalog of Federal Domestic Assistance

(CFDA) number for grants, cooperative agreements, loans, and loan commitments.

8. Enter the most appropriate Federal identifying number available for the Federal action identified in item 1 (e.g., Request for Proposal (RFP) number;

Invitation for Bid (IFB) number; grant announcement number; the contract, grant, or loan award number; the application/proposal control number assigned by the Federal agency). Include prefixes, e.g., "RFP-DE-90-001."

9. For a covered Federal action where there has been an award or loan commitment by the Federal agency, enter the Federal amount of the award/loan commitment for the prime entity identified in item 4 or 5.

10. (a) Enter the full name, address, city, State and zip code of the lobbying registrant under the Lobbying Disclosure Act of 1995 engaged by the reporting entity identified in item 4 to influence the covered Federal action.

(b) Enter the full names of the individual(s) performing services, and include full address if different from 10 (a). Enter Last Name, First Name, and Middle Initial (MI).

11. The certifying official shall sign and date the form, print his/her name, title, and telephone number.

According to the Paperwork Reduction Act, as amended, no persons are required to respond to a collection of information unless it displays a valid OMB Control Number. The valid OMB control number for this information collection is OMB No. 0348-0046. Public reporting burden for this collection of information is estimated to average 10 minutes per response, including time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding the burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to the Office of Management and Budget, Paperwork Reduction Project (0348-0046), Washington, DC 20503.

CONTRACTOR NON-DISCLOSURE AGREEMENT

Separate Agreements are required for each Contract

Each contractor/subcontractor who may have access to non-public information under their contract shall complete the form: Commitment to Protect Non-Public, Sensitive Information

– Contractor Agreement.1 The agreement is on the next page of this document.

A copy of each Agreement shall be submitted to the Project Officer prior to performing any work under the contract. Other copies are retained/submitted as stated in the Agreement.

Contractors with NIH network accounts must also upload a scanned copy of the signed Agreement into the NIH Security Awareness Tracking System. If you perform work under more than one contract, you must have a signed and for each contract. scanned Agreement

Carefully read the following directions.

To Complete the NDA Form using a DIGITAL Signature

1. Fill out the online form.

2. Using your digital signature, sign the Agreement form. [If unsure how to do this, fill the form out manually]

3. Save the file.

4. Once the file has been saved, remove the directions page and save it again (only retaining the Agreement portion of the form).

5. You are now ready to upload the signed Agreement form into the Security Awareness

Tracking System. Refer to the directions below. Keep the original Agreement for your records, and distribute a copy to your NIH Project Officer and your Employer’s Contract Management Office.

To Complete the NDA Form using a MANUAL Signature

1. Print the NDA form and fill it out.

2. Sign the Agreement in front of a witness and have the witness sign it.

3. Scan only the Agreement page of the form so that you can get a digital copy of it.

Make a note of where you save the file. [Some scanners send it as an attachment to an email; others will scan directly to your computer.]

4. You are now ready to upload the signed Agreement form into the Security Awareness Tracking System. Refer to the directions below. Keep the original Agreement for your records, and distribute a copy to your NIH Project Officer and your Employer’s Contract Management Office.

To Upload the NDA Form into the Security Awareness Tracking System:

1. Log into http://irtsectraining.nih.gov/ using your NIH ID.

2. Scroll down to “CONTRACTORS ONLY: NON-DISCLOSURE AGREEMENTS” and click on

UPLOAD NDA FORM.

3. Type in the contract-specific information related to the Agreement.

4. Follow directions for uploading the Agreement using the BROWSE button.

5. Click SUBMIT

1 HHS Contractor Oversight Guide http://intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf

COMMITMENT TO PROTECT NON-PUBLIC, SENSITIVE INFORMATION

CONTRACTOR AGREEMENT

Access to non-public, sensitive information may be required in the performance of my official duties, under contract number _________________________________ between ________________________________ and my employer ______________________________ (NIH I/C Name or Component) (Employer’s Name)

Should I have access to non-public sensitive information, I agree that I shall not release, publish, or disclose such information to unauthorized personnel. I shall protect such information and will employ all reasonable efforts to maintain the confidentiality of such information. These efforts shall be no less than the degree of care employed by ______________________________ to preserve and safeguard its own sensitive information.

(Employer’s Name)

I agree that I shall immediately notify the NIH IT Service Desk of any suspected or confirmed unauthorized disclosure and/or misuse of sensitive information.

[ 301-496-4357 (local), 866-319-4357 (toll free), 301-496-8294 (TTY) or http://ithelpdesk.nih.gov ].

I understand that there are laws and regulations which provide for criminal and/or civil penalties for improper disclosure, including but not limited to:

a) 18 U.S.C. 641 (Public Money, Property or Records)

b) 18 U.S.C. 1832 (Trade Secrets)

b) 18 U.S.C. 1905 (Disclosure of Confidential Information)

c) 5 U.S.C. 552a (Privacy Act)

I affirm that I have received a written and/or verbal briefing by my company concerning my responsibilities under this agreement. I understand that violation of this agreement may subject me to criminal and civil penalties.

Select one of the two options for signing this form:

1) Digital Signature

Insert Digital Signature

2) Manual Signature (requires Witness)

Type or Print Your Name: ____________________________ Signature: ________________________________________

Date: ________________

Type or Print Witness Name: ________________________ Signature: _______________________________________

Date: _______________

Retain this original signed form for your records.

Submit copies to:

1) Your NIH IC Project Officer, and

2) Your Employer’s Contract Management Office

Page 1 http://ocio.nih.gov/docs/public/Suitability-roster.xls

CAN: Contractor:

RFP/Contract #: Contractor Contact:

Contract Title: Contractor E-mail:

Project Officer:

Contract Specialist:

Suitability Level

Questionaire Required

Last Name First Name e-mail Position

Non-Disclosure Agreement Submitted

(mm/dd/yyyy)

Security Awareness Training Completed

(mm/dd/yyyy) 1, 5, 6

NACI,

NACIC,

MBI, LBI, BI

Estimated

Cost SF85 or SF85P Agency

Clearance Level Date Comment

ROSTER OF EMPLOYEES REQUIRING SUITABILITY INVESTIGATIONS

TO BE FILLED IN BY CONTRACTOR:

TO BE FILLED OUT BY CONTRACTOR:

Questionaire Submitted

(mm/dd/yyyy)

HHS Credit Release

Submitted (mm/dd/yyyy)

OF 306

Submitted

(mm/dd/yyyy)

Fingerprinting Completed

(mm/dd/yyyy)

Existing Clearance or ApplicationInvestigation Type

TO BE FILLED OUT BY

PROJECT OFFICER and ISSO:

stewartl Typewritten Text stewartl

Attachment 20

EMPLOYEE SEPARATION CHECKLIST

Contractor: _________________________________________________ Contract No: __________________________

Departing Staff Member’s Name: ________________________________ Separation Date: _______________________

Check and complete one of the columns below as appropriate:

I. FRIENDLY SEPARATION II. UNFRIENDLY SEPARATION

Date (Mandatory) Action

Date (Mandatory) Action

Remove all network and system access privileges.

Disable system access as quickly as possible–preferably just before the individual is notified of his or her dismissal.

Collect any authentication tokens.