DRAFT_AppendixC_Domain_Tasks_March.docx

APPENDIX (C): Detailed Task Descriptions (Tasks 1-12)

All obligations regarding liability, indemnification, insurance, and incident reporting established in the RISER Statement of Work apply to the execution of these tasks and shall be considered incorporated by reference.

Key definitions of programmatic terms (e.g., Integration Lead, EOL, Partial Transition Plan, Surge Activation) are provided in Section XVIII – Definitions.

Proposal Submission Requirement – Cross-Domain Coordination Plan:

Offerors proposing on Task 3 (Establish, Maintain, and Operate the RISER Catalog) and/or Task 8 (Receive Reagent Orders and Manage Shipping Logistics) shall include a domain-specific coordination plan in their proposals. This plan shall describe how handoffs between Domains will be executed, documented, and monitored to maintain chain-of-custody and quality from final quality release through shipping.

Cross-Domain Personnel Compliance Requirements All contractors and subcontractor personnel assigned to the RISER program shall comply with personnel integrity and conflict-of-interest safeguards applicable across all Domains (A–D).

Conflict-of-Interest (COI) Screening Requirements All new contractors and subcontractor personnel assigned to the RISER program shall undergo COI screening. To ensure objectivity and program integrity:

· The contractor shall develop and maintain a standard-alone COI SOP or integrate these procedures within the Human Resources (HR)/training SOP series;

· COI screening shall use a CDC-approved form (if provided) or a contractor-developed template that collects disclosures related to financial, professional, or personal interests that could impair impartiality or create the appearance of bias;

· Screening must be completed prior to task assignment and re-administered annually, or upon reassignment to sensitive roles (e.g., QA, procurement, system administration);

· All screening records must be retained for audit and submitted to CDC upon request;

· SOPs that reference staff roles or system access must include cross-references to applicable COI screening and role-based access protocols.

Task 1: Develop Standard Operating Procedures (SOPs) This task corresponds to Task A.1 in Section V of the RISER Statement of Work.

1. Purpose and Scope The contractor shall develop, implement, and maintain comprehensive Standard Operating Procedures (SOPs) that govern the execution of all technical and administrative functions performed under this contract. These SOPs will ensure consistency, quality, and compliance in all RISER-supported activities. SOPs may also cover operational areas executed by other Domains (e.g., shipping, warehousing), even if the contractor is not the performing entity, to support cross-domain continuity and COR oversight. SOPs shall cover core and optional task requirements and must align with CDC quality system protocols and applicable international, federal, state, and local laws and regulations, including FDA Quality Management System Regulations, including ISO 13485.

2. SOP Development Timeline and Requirements Prior to initiating any contract task, the contractor must submit draft SOPs that correspond to the technical methodology and organizational approach proposed in their offer. These SOPs must outline how the contractor and any subcontractors will handle CDC-furnished viruses, bacteria, and other surveillance and research reagents and materials, as well as perform each of the designated contract tasks.

Each SOP shall include, at minimum:

· A statement of purpose;

· Scope of application;

· Step-by-step procedures;

· Responsible roles and titles;

· Safety and quality controls;

· References to applicable regulatory requirements;

· Recordkeeping and documentation processes;

· Version control and revision history Draft SOPs shall be submitted on a rolling basis, grouped by task, to facilitate government review and avoid delays in program implementation. The first set of SOPs must be submitted to the CDC Contracting Officer Representative (COR) within 60 days of contract award, with subsequent SOPs submitted according to a COR-approved submission calendar. Contractor may begin preparatory activities (e.g., personnel onboarding, facility preparation, initial reagent acquisition) in parallel with SOP development and review however, no technical execution of contract tasks (e.g., reagent production, QC, or distribution) shall occur until relevant SOPs receive final government approval.

The Domain A contractor shall establish, maintain, and update a centralized RISER SOP Compendium serving as the authoritative repository for all SOPs developed under this contract, including SOPs applicable to Domains A-D. The Compendium shall:

· Include all current COR-approved SOPs;

· Maintain version histories and effective dates;

· Identify superseded versions;

· Provide cross-domain traceability where applicable;

· Be maintained in audit-ready format;

· Be accessible to CDC upon request.

3. Technical SOP Requirements Separate SOPs shall be developed for:

· Production and Quality Control (QC) of each CDC-identified pathogen or reagent category listed in Task 3 (RISER Catalog) and Appendix A – Deliverables;

· Procedures for in-house and subcontractor manufacturing, including material receipt, propagation, aliquoting, vialing, labeling, and traceability;

· Quality Assurance (QA)/QC procedures aligned with Appendix B – Quality Specifications, with specific SOPs for each assay or functional verification test;

· Risk management, corrective/preventative actions, and documentation requirements in accordance with CDC QA oversight All SOPs associated with pathogen handling must be compliant with Biosafety in Microbiological and Biomedical Laboratories (Biosafety in Microbiological and Biomedical Laboratories [BMBL], current Edition) and Select Agent Program requirements where applicable.

4. QA Review and Government Approval Process All SOPs must first be reviewed and approved internally by the contractor’s institutional Quality Assurance (QA) Office. Once QA approval is granted, SOPs shall be submitted to the CDC COR for review.

The government will provide written comments within 30 calendar days of receipt. The contractor will revise SOPs based on COR feedback and resubmit final versions within timelines established in the COR-approved submission calendar. The COR shall provide final approval or additional comments within 15 calendar days of revised submission.

No contractor activities shall commence on any task until the relevant SOP has received final COR approval in writing. Any changes to SOPs after initial approval must be submitted in advance, along with a justification memo and a proposed implementation date.

Failure to follow approved SOPs that result in measurable declines in QA pass rates, system performance, or order fulfillment timelines may be considered in CDC’s evaluation of contractor performance under incentivized task orders.

5. Regulatory and Quality System Integration All SOPs must be fully compliant with:

· FDA 21 CFR Part 820 – Quality Management System Regulation (Required for product manufactured under FDA cGMP only);

· ISO 9001 standards (where applicable);

· CDC internal policies for reagent quality and distribution;

· National Institutes of Health (NIH) guidelines for recombinant DNA The contractor is required to maintain SOPs in a controlled documentation management system with version control, access logs, and audit trails.

6. Distribution and Communication Finalized SOPs shall be securely archived and accessible by authorized contractor and CDC personnel. All staff, including subcontractors, shall be trained and certified in applicable SOPs before performing any technical task. Training records must be retained in accordance with contract requirements and made available for audit by CDC or designated reviewers. All contractor and subcontractor personnel requiring access to CDC networks, systems, or facilities shall complete all CDC‑mandated training (e.g., cybersecurity, privacy, biosafety, ethics) within the timelines specified by the government. The contractor shall track and maintain records of completion for all such training, including refresher courses, and make available to the COR upon request. Failure to complete required training will not relieve the contractor of performance obligations and may result in suspension of individual user access until compliance is achieved.

Task 2: Facility Requirements This task corresponds to Tasks B.1-B.2 in Section V of the RISER Statement of Work.

1. Purpose and Scope This task outlines the infrastructure, containment, and operational requirements for contractor facilities supporting RISER’s reagent handling, storage, and distribution. These facilities must enable safe, compliant processing of biological agents and ensure material integrity across Biosafety Level (BSL)-1 through BSL-4 activities. The contractor is responsible for providing all required equipment, environmental controls, personnel protection, and system validations necessary to meet the contract’s biosafety, quality, and logistical obligations. These facilities shall support the secure storage and environmental control of RISER reagents produced under Domain A workflows, in accordance with CDC catalog and distribution protocols.

2. Biosafety Level and Accreditation Requirements The contractor shall operate, maintain, and document full compliance for laboratories certified to perform work at the following biosafety levels:

· BSL-1 to BSL-4 for the handling, characterization, or preparation of reference reagents;

· Animal Biosafety Level (ABSL)-2 through ABSL-4 for in vivo studies, if applicable.

Key accreditation and compliance requirements include:

· Federal Select Agent Program (FSAP) registration for any facility handling select agents or highly pathogenic avian influenza;

· Biosafety in Microbiological and Biomedical Laboratories (BMBL) guidelines as the operational baseline;

· Association for Assessment and Accreditation of Laboratory Animal Care (AAALAC) International accreditation and active Institutional Animal Care and Use Committee (IACUC) protocol approval for all animal work;

· Compliance with CDC, Occupational Safety and Health Administration (OSHA), and National Institutes of Health (NIH) laboratory biosafety standards.

Proof of registration, accreditation, and inspection readiness shall be submitted with the contractor’s technical proposal and maintained throughout the contract term.

3. Environmental Controls and Storage Systems Contractor facilities must provide environmental chambers and validated storage zones capable of preserving the biological and chemical integrity of RISER materials. At a minimum, the contractor shall:

· Maintain continuous cold storage at 2–8°C, –20°C, –70°C to –90°C, and liquid nitrogen conditions;

· Employ 24/7 alarmed monitoring systems with tiered escalation protocols;

· Provide emergency backup freezers and generators to maintain function during power outages;

· Ensure alarm logs, deviation reports, and temperature charts are auditable and accessible;

· Immediately (within 24 hours) notify CDC, quarantine, and halt distribution of any reagents stored under non-conforming conditions until further notice.

Corrective Action/Preventive Action (CAPA) documentation must include:

· Affected inventory identification including lot identification and product quantity;

· Alarm records and temperature logs;

· Storage thermal mapping and system validation evidence;

· Current procedures for monitoring temperature/alarm point;

· Status of recovery efforts, post-event testing, and preventative actions.

4. Facility Design and Accessibility Facility design must ensure physical separation between functional areas (e.g., production, QA/QC, storage) and incorporate:

· Adequate floor space for equipment, staging, and large-scale storage;

· Uninterruptible power supply to accommodate the refrigerators/freezers and other critical security and surveillance equipment;

· Central air-conditioning capable of maintaining ambient 66–72°F;

· Secure zones with authorized personnel access only;

· Flexible staging areas for surge support or emergency response deployments;

· Accommodation for routine CDC site inspections and walkthroughs.

Contractors using subcontractor facilities must demonstrate equivalent design, security, and quality control across all locations.

5. Quality System Integration Facilities supporting the manufacture, testing, or storage of FDA regulated reagents must comply with:

· 21 CFR Part 820 (FDA QMSR for medical devices);

· ISO 9001 or ISO 135485 standards, as appropriate;

· CDC-provided Quality Specifications and reagent performance protocols (see Appendix B).

The contractor shall:

· Maintain full documentation of equipment qualification and validation;

· Integrate facility operations into a central Quality Management System (QMS);

· Participate in CDC-led quality audits, with readiness for announced or unannounced visits.

Batch records and biosafety inspection records must be available for review by the COR or designated representatives upon request. All stability testing activities and documentation shall align with Task 4 (Reagent Stability and Shelf-Management Program) and be reported in accordance with the SOW Deliverables.

6. Security and Access Control To ensure biosecurity and inventory integrity, the contractor must implement layered physical and digital security controls, including:

· Dual-factor authentication systems for laboratory entry;

· Video surveillance and intrusion detection systems in all high-containment and storage zones;

· Audit logs of facility access, retained for at least 6 months;

· Limited-access user groups for specific zones based on security clearance or training certification;

· Encrypted reagent tracking systems with role-based system access.

Security infrastructure shall be reviewed and approved by CDC, with provisions for upgrades in response to changes in federal policy or threat levels.

7. Regulatory Documentation and Compliance Audits The contractor must maintain complete documentation to demonstrate regulatory compliance, including:

· FSAP registration certificates;

· FDA compliance inspection results;

· USDA compliance certifications;

· Environmental chamber validations and calibration records;

· IACUC protocols (for in vivo work);

· Health and safety program audits and biosafety inspection records.

All documentation must be current, readily retrievable, and submitted to the government upon request. Contractors must support annual site inspections conducted by CDC or third-party auditors.

8. Health and Safety Requirements The contractor is responsible for ensuring that all RISER-designated facilities operate under comprehensive health and safety protocols. These must include:

· Written biosafety and bloodborne pathogen exposure control plans;

· Regular biosafety training programs with retraining at least annually;

· Use of personal protective equipment (PPE) consistent with containment level and agent risk profile;

· Engineering controls such as biosafety cabinets, High-Efficiency Particulate Air (HEPA) filtration, and hands-free waste disposal;

· Clearly documented emergency response protocols for spills, personnel exposure, or facility incidents.

Personnel must undergo medical surveillance and respirator fit testing (if applicable), and all training records must be retained for audit.

9. Surge Capacity Planning Mock surge drills simulating large-scale reagent production shall only be performed upon written direction from the COR or CO.

10. Insurance Requirements The contractor shall comply with the insurance requirements specified in the SOW and maintain current Certificates of Insurance on file with CDC throughout the period of performance.

Task 3: Establish, Maintain, and Operate the RISER Catalog This task corresponds to Tasks A.2-A.3 in Section V of the RISER Statement of Work.

1. Purpose and Scope The RISER Catalog serves as the definitive inventory and access platform for all CDC-approved surveillance and research reagents produced or distributed under this contract. This task defines contractor responsibilities for the production or procurement, inventory management, quality assurance, and catalog maintenance of RISER reagents. The contractor must ensure that materials are produced, documented, and tracked in accordance with CDC surveillance priorities and public health response needs.

2. Reagent Production and Procurement Authorization All reagents listed in Appendix A – Deliverables, must be produced or procured only upon written authorization by the government. This requirement does not limit the government’s ability to furnish materials directly to the contractor for storage, catalog inclusion, testing, or distribution under this contract. Reagents include viral, bacterial, nucleic acid, antibody, and protein-based materials designed for use in CDC-developed diagnostic assays or surveillance platforms.

Contractor’s responsibilities include:

· Producing materials in accordance with CDC protocols or transferred SOPs;

· Procuring off-the-shelf ancillary reagents only when the optional task is exercised;

· Maintaining and reporting a real-time inventory system to track all authorized and produced items;

· Ensuring production timelines and formats comply with CDC-directed priorities.

3. QA and QC Independence The contractor shall establish and operate a QA/QC program that is fully independent from the manufacturing function. This system must include:

· Defined acceptance criteria for each reagent class, consistent with Appendix B – Quality Specifications;

· Authority to quarantine or reject any lot that does not meet quality standards;

· Documentation of internal test results and external vendor certifications (if applicable);

· Use of validated assays and methods for functional and stability assessments;

· Batch-level documentation that enables traceability from raw material to end user.

The QA/QC function must have organizational authority to delay or halt distribution pending final quality review.

The contractor is accountable for performance metrics related to reagent QA/QC pass rates. QA testing accuracy, timeliness, and documentation integrity shall directly inform contractor performance evaluations under CPIF task orders.

QA/QC Plan:

The contractor shall prepare and maintain a QA/QC Plan, as described in the SOW, that includes batch record documentation, reagent rejection criteria, customer complaint handling procedures, and QA/QC oversight roles. The plan shall be submitted to the COR for approval and updated annually or as requested.

4. CDC Review and Verification CDC reserves the right to perform independent verification testing at any stage of production—bulk, post-fill, and final packaging—to confirm that RISER reagents meet all defined specifications. The contractor shall:

· Provide samples or retains to CDC upon request for side-by-side QC testing;

· Submit full batch records, QA/QC results for CDC-specified deliverables as part of regular reporting;

· Respond to CDC QC feedback within five business days, with CAPA documentation as needed.

All materials distributed under this contract must be released in accordance with the contractor’s COR-approved QA/QC Plan. CDC retains the right to review, verify, or require additional testing prior to distribution as specified in Appendix B – Quality Specifications, or as otherwise directed in writing.

5. Catalog Operations and Format Standardization The contractor is responsible for:

· Maintaining a real-time electronic RISER Catalog of all active, on-hold, and retired/expired reagents;

· Updating catalog entries in real time to reflect changes in inventory state, including production status, quality hold, release approval, availability for distribution, expiration, quarantine, or other CDC0defined lifecycle designations;

· Implementing standardized formats for vialing, labeling, inserts, and Certificates of Analysis (COAs), unless specific exceptions are granted in writing by CDC;

· Ensuring barcoding and digital traceability are embedded across all inventory states (e.g., seed, in-production, quality hold, available for distribution);

· Aligning catalog entries with ordering system data to ensure availability and usage consistency.

The contractor shall comply with CDC's Unified Reagent Presentation Guidance, including naming conventions, label layout, and shipping documentation templates.

6. Production and Inventory Management Plans Within 150 calendar days of contract award, the contractor shall submit two documents for COR and CO approval:

· A Production Plan covering all reagents produced internally or by subcontractors, including itemized timelines, resource requirements, and dependency milestones;

· An Acquisition and Inventory Management Plan outlining how the contractor will source, track, and manage the full lifecycle of cataloged materials. The contractor shall also establish an acquisition plan that allows for surges at 25%, 50%, and 75% above base level.

These plans must be updated annually or more frequently at CDC’s request. The contractor shall provide verbal and written updates on reagent status, deliverables, and pending conflicts during weekly program calls.

7. Inventory System Requirements The contractor must operate a real-time centralized inventory management system capable of:

· Real-time reconciliation of stock levels across all temperature zones;

· Tiered visibility (e.g., internal production view, CDC program-level view);

· Tracking material location, batch history, QA/QC testing status (e.g., pending, passed, failed, on quality hold), stability-testing status, and any CDC-directed validation or distribution restrictions;

· Generating routine and on-demand reports for the COR, including:

· Retains and seed availability;

· Quality-hold items;

· Expiring inventory;

· Usage trends and burn rates by month The inventory system must be fully auditable and securely backed up, with disaster recovery plans in place to avoid data loss.

The inventory management system shall maintain a minimum operational availability of ≥99.95% (excluding scheduled maintenance) to ensure uninterrupted support for CDC operations and emergency response activities. In alignment with the system’s FISMA Moderate designation, the contractor shall implement controls consistent with a Moderate-impact rating for availability as defined in FIPS 199, including redundancy, failover mechanisms, and disaster recovery protocols designed to prevent data loss and minimize operational downtime.

The contractor shall maintain daily backups of the inventory management system with secure off‑site storage to support disaster recovery. Backups shall be retained for at least 90 days on a rolling basis, with one full monthly archive maintained for a minimum of 12 months. Critical inventory data, including batch records, stock levels, lot histories, and audit logs, shall be archived for the life of the contract and transferred to CDC or a successor contractor during transition in accordance with the Data Governance Plan.

All RISER catalog and inventory system interfaces must be developed in alignment with ICDs maintained by Domain C. The contractor shall coordinate with Domain C to ensure that data structures, access controls, and synchronization protocols are interoperable with CDC systems and other RISER contractor platforms. No independent APIs, system endpoints, or data pipeline may be developed or modified without written approval from the COR and coordination with Domain C’s technical lead.

8. Inventory Record Requirements Each reagent in the RISER Catalog must be associated with a complete inventory record, including:

· Source or depositor;

· Description, strain, and origin metadata;

· Risk classification and BSL level;

· Storage conditions and location;

· Lot number, production or manufactured date, and passage history (if applicable);

· QC results and linked documentation (e.g., COA, insert);

· Distribution history, including order number, date, recipient, and shipment confirmation.

These records must be stored both electronically and in physical backup form, with appropriate access controls.

9. Off-the-Shelf Ancillary Reagents Off-the-shelf ancillary reagents, such as buffers or commercially available kits, may only be procured under an activated optional task order. When approved, the contractor shall:

· Replenish ancillary materials in small, trackable increments to reduce waste;

· Monitor expiration dates and stock turnover;

· Notify CDC immediately (within 48 hours) of vendor recalls or quality issues;

· Document the source, lot, and distribution of all ancillary items.

Off-the-shelf materials shall be flagged distinctly in the inventory system and excluded from in-house QC unless otherwise instructed.

10. Data Protection and System Redundancy All data generated or stored under this task are considered government property. The contractor shall:

· Maintain secure backups and mirrored storage systems outside of primary hosting locations;

· Implement secure user authentication and encryption across all catalog platforms;

· Ensure that data associated with reagent quality, storage, and distribution are protected from unauthorized access;

· Develop system documentation that enables full data transfer to the government or a follow-on contractor upon termination or transition.

11. Reporting and Oversight The contractor shall provide the COR with:

· Weekly inventory status reports, including production and QA/QC highlights;

· Notifications of any stockout risks or material delays;

· Immediate alerts (within 48 hours) if any batch is found to be defective or deviating from specifications.

In addition to reagent availability and quality status, the contractor shall maintain and transmit unburdened cost-related metadata for each reagent lot, including direct production cost components (e.g., direct labor, raw materials) and distribution-related direct costs (e.g., packaging, special handling, courier fees). This cost metadata shall exclude indirect rates, overhead allocations, profit margins, and other proprietary pricing elements unless otherwise required under invoicing provisions of the contract. All cost data transmitted under this provision shall be provided to CDC for internal financial reconciliation, analytics, and planning purposes and shall not be shared with other RISER awardees. CDC reserves the right to conduct on-site inspections, virtual audits, and database reviews to verify catalog integrity and compliance.

12. Coordination with Domain B:

All activities related to reagent storage, bulk inventory warehousing, and outbound shipping shall be performed under Domain B (Task 8 – Receive Reagent Orders and Manage Shipping Logistics). The Task 3 contractor shall ensure completed reagents, along with associated Certificates of Analysis (COAs) and documentation, are transferred to Domain B facilities in accordance with CDC-approved timelines and quality protocols. Coordination shall occur through documented transfer logs, shared inventory records, and participation in scheduled cross-domain meetings.

Task 4: Reagent Stability and Shelf-Life Management Program This task corresponds to Task A.4 in Section V of the RISER Statement of Work.

1. Purpose and Scope This task establishes requirements for the contractor to assess and manage the long-term stability of all RISER reagents to ensure their functional integrity throughout their defined shelf life. The program applies to all reagents produced under this contract by the prime or any subcontractor. Stability testing must conform to CDC-approved protocols and support CDC’s quality system for diagnostic and surveillance reagents.

The goal is to ensure that each RISER reagent retains its validated performance characteristics from manufacture through distribution and use. A failure to meet these expectations may result in removal from the catalog, suspension of distribution, or corrective actions determined by CDC.

2. Stability Testing Plan Submission and Updates Within 30 calendar days of the start of each performance period, the contractor shall submit a comprehensive Stability Testing Plan for review and approval by the COR and SMEs. This plan shall include:

· A list of reagents and reagent categories subject to stability testing;

· Number of reserved quantities per lot produced;

· Proposed testing schedules and intervals (e.g., initial, 3-month, 6-month, 12-month time points);

· Environmental conditions and storage formats to be tested;

· Pass/fail criteria consistent with the specifications in Appendix B – Quality Specifications;

· Validation methodology and statistical rationale for sample sizes and shelf-life projections;

· Documentation templates and data retention plans.

The contractor shall revise and re-submit the plan annually or as otherwise directed by CDC based on reagent catalog changes, emergency deployments, or observed performance issues.

QA/QC Plan:

The contractor shall prepare and maintain a QA/QC Plan, as described in the SOW, that includes batch record documentation, reagent rejection criteria, customer complaint handling procedures, and QA/QC oversight roles. The plan shall be submitted to the COR for approval and updated annually or as requested.

3. Reagent Types Included Stability testing may be performed on:

· Live or inactivated viral and bacterial stocks;

· Nucleic acid preparations and synthetic controls;

· Protein-based reagents (e.g., antisera, monoclonal antibodies);

· Detection kits, primers, and probes (if manufactured under this contract);

· Other research-use-only (RUO) reagents or assay components produced under RISER.

Ancillary reagents (i.e., off-the-shelf commercial items) are excluded from this testing requirement unless specified in an optional task order.

CDC-supplied or CDC-manufactured materials are also excluded from contractor-performed testing, unless otherwise directed.

4. Test Parameters and Methodology The contractor’s stability testing shall evaluate the following properties, where applicable:

· Functional activity (e.g., PCR signal strength, antigen binding affinity);

· Physical integrity (e.g., clarity, precipitate formation, degradation);

· Sterility and contamination assessment;

· Storage condition impact (e.g., freeze-thaw tolerance, light sensitivity);

· Packaging integrity and seal quality;

· Lot-to-lot and container-to-container consistency over time.

Testing protocols must:

· Be aligned with international best practices;

· Be aligned to measure the specifications in Appendix B – Quality Specifications;

· Be validated by the contractor and reviewed by CDC before implementation;

· Include the use of appropriate positive and negative controls;

· Be traceable to the reagent’s production batch record.

5. Reagent Retains for Stability Testing For every manufactured lot of RISER reagents, the contractor shall retain representative samples under the same storage conditions as distributed materials. These retains shall:

· Be clearly labeled and segregated from active inventory;

· Be used exclusively for quality verification and stability testing;

· Match the production lot in vialing, labeling, and formulation.

CDC may request additional retains for independent testing at CDC laboratories. The contractor shall promptly provide these samples and associated batch documentation upon request.

6. Reagent Expiry and Shelf-Life Assignment The contractor shall assign initial expiry dates for all new RISER reagents based on real-time stability data or interim results supported by CDC-approved protocols.

Final shelf-life determinations shall be:

· Based on completed testing of a minimum number of lots, unless otherwise directed;

· Reviewed and authorized by CDC;

· Documented in COAs, reagent inserts, and inventory systems.

Shelf-life extensions for existing lots shall only be implemented after submission of new stability data and written approval by CDC.

7. Deviation Reporting and Risk Mitigation If a reagent fails a stability test or exhibits drift outside of pre-established specifications, the contractor must:

· Immediately quarantine the affected lot(s);

· Notify the COR and CDC QA representative within 24 hours;

· Initiate a Root Cause Analysis (RCA) and Corrective and Preventive Action (CAPA) investigation;

· Submit a written report of findings and proposed actions within 10 business days.

CDC will determine whether affected materials must be withdrawn, replaced, or subjected to follow-up testing.

8. Documentation and Reporting Requirements All stability testing must be fully documented and include:

· Sample identifiers, lot numbers, storage conditions, and test date;

· Test method, instrument type and serial number, and technician initials;

· Raw data (e.g., Ct values, absorbance, visual observations);

· Final interpretation of pass/fail status;

· Expiry date assignment or modification recommendations.

The contractor shall:

· Maintain a secure, centralized archive of all stability data;

· Provide quarterly reports to CDC summarizing testing results, trends, and any corrective actions;

· Support CDC audits or reviews of stability documentation and raw data.

Stability testing documentation shall be prepared and submitted in accordance with the SOW Deliverables Table. These reports must include protocols, results, expiry assignments, and any CAPA actions taken, and they must cross-reference reagent lot numbers and inventory records.

The contractor shall provide CDC with an expiration-forecast report identifying reagents expected to reach expiry within sixty (60) days. CDC will review the report and determine whether affected lots will be destroyed, retained for continued use, shipped to CDC, or assigned an extended expiry date based on stability data. The contractor shall document CDC’s decision and update the RISER inventory system, Certificates of Analysis, and related records accordingly. No reagent shall be destroyed or have its expiry date extended without written CDC authorization.

9. Integration with Inventory and Distribution Systems Stability and shelf-life data must be integrated into the RISER inventory management and CRM systems. The contractor shall ensure:

· Expired reagents are automatically flagged as ineligible for distribution;

· COAs and reagent inserts reflect current shelf-life information;

· Ordering restrictions are implemented for materials nearing expiry (e.g., ≤30 days remaining).

CDC may approve continued use of near-expiry reagents for specific scenarios (e.g., training or short-term projects), provided their integrity is verified.

10. External Data Upload and Integration Functionality – Coordination with Domain C To ensure that reagent stability-testing results, validation datasets, and other laboratory-generated outputs are available to CDC for oversight and regulatory review, the contractor shall prepare and transmit such data in CDC-defined formats and in accordance with CDC-approved quality and reporting standards.

The contractor shall:

· Ensure that all stability and validation data are structured using CDC-approved schemas, metadata fields, and documentation conventions;

· Transmit required datasets to CDC through secure, CDC-approved communication channels (e.g., encrypted email, SFTP, CDC-designated repositories, or other mechanisms as directed);

· Coordinate with Domain C where technical formatting or integration assistance is required for compatibility with CDC enterprise systems;

· Maintain audit trails and internal logs documenting data preparation, transmission dates, recipients, and any subsequent corrections or updates;

· Ensure that transmitted data complies with applicable QA/QC standards and regulatory documentation requirements.

Use of the RISER website for upload, ingestion, or public display of stability or validation data is not required unless specifically directed in writing by CDC.

Task 5: Operate and Maintain the RISER Website This task corresponds to Task C.1 in Section V of the RISER Statement of Work.

1. Purpose and Scope The contractor shall host, operate, and maintain the RISER website, which serves as the primary interface for public health laboratories, research partners, and stakeholders to access CDC-authorized reagents, submit orders, obtain registration, and retrieve technical documentation. The website must function as a reliable and secure platform that integrates fully with CDC’s systems to enable seamless and traceable transactions. The contractor will be responsible for ensuring that the website remains operational, secure, compliant, and interoperable with all RISER ecosystem platforms throughout the life of the contract.

In multi-award scenarios, the RISER website may also function as an integration interface supporting structured data exchange, status synchronization, and workflow coordination among RISER Domain contractors, as defined in approved Interface Control Documents (ICDs). The website shall support cross-domain interoperability while maintaining logical separation of contractor systems, role-based access controls, and protection of proprietary or restricted data consistent with contract requirements.

The contractor shall serve as the EPLC lead for all RISER website and CRM integration activities, ensuring full lifecycle documentation, milestone tracking, and reporting through CDC’s EPLC governance process.

2. Hosting, Availability, Performance, and Shared Cost Allocation Documentation The contractor shall:

· Host the RISER website in a high-availability environment that guarantees ≥99.95% uptime, excluding scheduled maintenance;

· Implement system redundancy, load balancing, and failover mechanisms to ensure continuity;

· Provide real-time monitoring and automated alerts for system availability, latency, and intrusion attempts;

· Maintain daily backups with secure off-site storage for rapid disaster recovery. Back-ups shall be retained on a rolling basis for no less than 90 days, with at least one full monthly archive maintained for a minimum of 12 months. Critical system data including configuration files, transaction logs, user activity records, and Interface Control Documents, shall be archived for the life of the contract and transferred to CDC or a successor contractor at contract closeout in accordance with the Data Governance Plan;

· Perform ongoing system maintenance, including troubleshooting, patch implementation, and technical updates to preserve website integrity and availability;

· Validate the software and any modifications Interface Control Documents (ICDs):

The contractor shall develop and maintain Interface Control Documents (ICDs) describing all technical interfaces between the RISER website, CDC enterprise systems, and other RISER contractor platforms. Website-specific ICDs shall address:

· API configurations and data-exchange protocols between the RISER website, CDC’s Customer Relationship Management (CRM) and Enterprise Resource Planning (ERP) systems, and other RISER Domains (e.g., Domain A and Domain B awardees);

· Security architecture boundaries and logical or physical separation of data belonging to different vendors;

· Role-based authentication and access-control pathways for public-facing and administrator functions; and

· Any temporary or emergency interfaces established during declared public-health emergencies.

All ICDs shall be developed, versioned, and maintained in accordance with the standardized ICD Development and Maintenance Plan requirements defined under Task 7, which govern process documentation, version control, and change-management procedures for all RISER IT systems.

The contractor shall submit website-specific ICDs to CDC for review and approval within 60 calendar days of contract award, update them whenever website or integration changes occur, and provide final, approved versions in both Word and searchable PDF formats as part of the contract deliverables.

Shared Cost Allocation Documentation:

The contractor shall prepare a website-specific Shared Cost Allocation Plan (SCAP) identifying shared hosting, software license, and platform costs associated with RISER website operations.

The SCAP shall:

· Describe shared cost elements (e.g., web-hosting environments, software licenses, shared development tools, or collaborative platforms) and the basis for allocation (e.g., usage percentages, transaction volume, user counts);

· Be developed and maintained consistent with the SCAP methodology and documentation standards established under Task 7, which serve as the governing reference for RISER-wide IT cost-allocation practices;

· Be submitted to CDC within 90 calendar days of contract award and updated annually or upon significant operational changes; and

· Include supporting documentation in Word and Excel formats for CDC review and approval.

3. Real-Time System Integration and API Architecture To support dynamic data flow, the contractor shall deploy and maintain a real-time, secure, bidirectional API-based architecture enabling continuous communication between the RISER website, other RISER contractors (e.g., Domain A and Domain B awardees), and CDC Customer Relationship Management (CRM) and Enterprise Resource Planning (ERP) systems.

Legacy Secure File Transfer Protocol (SFTP) or static file exchanges are not acceptable as the primary communication method but to be considered as back-up or secondary plan. Contractors must describe and implement:

· Standards-compliant API integration using secure methods such as OAuth 2.0, JWT, or mutual TLS;

· Reagent-level data syncing including inventory updates, shipment confirmation, user access status, and reporting artifacts;

· Compatibility with CDC’s existing architecture to allow seamless ingestion of data from internal and contractor-hosted systems.

4. Core Functional Requirements The RISER website must perform the following key functions and support integrated management with Microsoft Dynamics 365. Offerors are strongly encouraged to propose a unified service model in which the same team manages both systems to ensure uninterrupted data flow, operational compatibility, and minimized risk of misalignment.

a. User Management

· Allow user registration, identity verification, and dynamic assignment of catalog access tiers;

· Support administrative features for account maintenance, password resets, and access re-validation.

b. Product Display and Reagent Ordering

· Present the full RISER reagent catalog by access level, with detailed descriptions, documentation links, and real-time availability status reflecting current inventory state and distribution eligibility;

· Support intuitive order building, secure checkout, and submission into an integrated order processing system;

· The system shall allow reagent-level cost metadata to be stored (not displayed to the public) and linked to ordering and shipment records for CDC analysis;

· The contractor shall place RISER reagents in “temporarily out-of-stock” status on the RISER website when inventory is depleted or upon written request from the government. Once materials are replenished and available, the contractor shall update the status and assist in notifying RISER registrants through system-enabled alerts or messaging features;

· The RISER website shall include an optional comment field at the time of order submission, allowing registrants to provide contextual details related to specific products or to the entire order. This may include explanations for unusually large requests, urgency due to outbreak response or field deployment timelines, or identification of an intermediary consignee involved in shipment coordination. All submitted comments shall be securely transmitted alongside the order metadata to CDC’s CRM and be viewable by authorized CDC personnel for programmatic review and decision-making. Comments shall be logged with timestamp, order ID, and registrant ID for auditability;

· The RISER website shall include a configurable study portal module that allows CDC to define study‑specific reagent access lists and pre‑set quantity limits. This portal will be fully integrated within the RISER website and access‑controlled through user roles, enabling only approved registrants to view and order study‑specific materials. Portal configurations, including visibility and quantity controls, shall be managed according to COR direction.

c. Order Confirmation and Tracking

· Generate traceable order IDs and provide immediate confirmation to end-users;

· Display status updates based on real-time information received from shipping and inventory systems;

· Implement a visual, real-time order tracking interface for registered laboratories to monitor the status of each order through standardized workflow stages, including Order Submitted, Pending CDC Approval, approved by CDC, Pending Shipment, Shipped, and Received. The interface shall be integrated with the CDC CRM to ensure synchronization and accuracy of status indicators.

d. Document Repository

· Serve as a centralized source of CDC-approved SOPs, Certificates of Analysis (CoAs), Safety Data Sheets, product inserts, technical specifications, and regulatory documents;

· Allow document download and link external references.

e. CDC-Controlled Announcement Board

· Maintain a dynamic page for publishing critical updates, emergency instructions, product recalls, and usage advisories, as approved by the COR;

· Support CDC-directed banner announcements that appear prominently to registered users upon login or while browsing specific reagent catalog items. These may include time-sensitive alerts such as expiration date extensions, new usage instructions, or shipping disruptions;

· Implement tracking of banner creation and expiration dates, with automated or scheduled removal of outdated messages to prevent confusion or misuse;

· Coordinate banner content approval and lifecycle tracking with the CDC COR, ensuring visibility is consistent with regulatory communication practices.

f. Secure Audit Logging

· Track all user logins, order actions, content updates, and API transactions with time stamps and role identifiers;

· Logs must be retained in a secure, exportable format and be accessible to CDC upon request.

Software Validation: All software components, including visualization tools, dashboards, plugins, or custom modules used within the RISER website or associated secure platforms, shall undergo documented software validation before deployment or major updates. Validation shall include functional testing, user acceptance testing, and traceable documentation of requirements, test results, and approvals. Validation artifacts shall be maintained in a controlled repository and made available to CDC for review.

g. Data Upload and CDC-Generated Dashboard Visualization

· Provide secure, role-based upload functionality allowing RISER registrants to submit data (e.g., genomic sequencing files, assay results, proficiency testing outputs) in CDC-approved formats;

e

· Route submitted data securely to CDC enterprise systems for analysis in accordance with approved Interface Control Documents (ICDs);

· Support display of CDC-generated analysis outputs back to authorized users in dashboard formats accessible through the RISER website;

· Ensure dashboards comply with Section 508 standards and support role-based visibility controls (e.g., public-facing registrant view vs internal CDC view);

· Maintain audit logging for all uploads and dashboard interactions.

h. Documentation and Letter Request Module

· Provide a structured mechanism within the RISER website for registrants to request letters of donation, regulatory documentation, certificates of origin, or other supporting documents required for customs clearance or import permits;

· Route documentation requests to appropriate Domain B and Domain D personnel for processing;

· Track request status within the CRM and provide visibility to registrants;

· Maintain audit logs of document generation and issuance.

5. Security, Accessibility, and Compliance The contractor shall maintain the website in full compliance with all applicable federal and U.S. Department of Health and Human Services (HHS) cybersecurity and accessibility requirements:

· Hold and maintain an Authority to Operate (ATO) issued by CDC’s Cyber Security Program Office (CSPO);

· Implement FISMA Moderate controls and meet NIST SP 800-53 Rev. 5 guidelines;

· Enforce TLS 1.2+ encryption, endpoint monitoring, and multi-layer authentication;

· Ensure full Section 508 compliance, including accessible design for screen readers; color contrast, navigation structure, keyboard access; and annual testing with updated HHS VPAT documentation;

· Support compatibility across modern web browsers and responsive mobile layouts;

· In support of continuous system security, the contractor shall:

· Provide continuous monitoring of the RISER website to detect unauthorized access attempts, anomalous behavior, or intruder disruptions;

· Perform weekly automated security scans (e.g., vulnerability assessments, penetration tests) and remediate identified issues within government-specific timelines;

· Submit a monthly summary of all security scans results and actions taken to the COR and CDC Information Security Team;

· Implement and document all website modifications required to address security concerns as soon as feasible after internal…