DRAFT Combined Synopsis Soliciation.docx

Subject: Support Services for Division of Field Studies (DFSE) and the National Institute for Occupational Safety and Health (NIOSH) Industry and Occupation Coding System Solicitation Number: 75D301-26-Q-78814 ISSUANCE DATE: February 6, 2026 QUESTIONS DUE DATE/TIME: NLT 3:00PM EST February 11, 2026 Response DUE Date/time: NLT 3:00PM EST February 16, 2026 Section A – Description This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

The solicitation number for this requirement is 75D301-26-Q-78814 and is hereby issued as a Request for Quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC 2025-06 dated August 27, 2025.

The associated North American Industrial Classification System (NAICS) code for this requirement is 561110 – Office Administrative Services. The size standard is $12.5 Million. The Product Service Code (PSC) is R699 Support-Administrative: Other.

This is an RFQ to procure Support Services for the Division of Field Studies (DFSE) and the National Institute for Occupational Safety and Health (NIOSH) Industry and Occupation Coding System. The Government intends to award a single Firm Fixed Price purchase order as a result of this solicitation, which will include the terms and conditions set forth herein. This requirement is issued as a total set-aside for Small Business concerns under the Service‑Disabled Veteran‑Owned Small Business (SDVOSB) category, in accordance with FAR 19.1405 and FAR 52.219‑27.

The provision at 52.212-1, Instructions to Offerors-Commercial, applies to this acquisition. FAR 52.212-2, Evaluation-Commercial Items, is not included.

Offerors shall include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items, with its offer or indicate if it is available online at SAM.gov. FAR 52.212-4, Contract Terms and Conditions-Commercial Items, applies to this acquisition; there are no addenda to the clause. FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Items, applies to this acquisition and the additional FAR clauses cited in the clause that are applicable have been noted.

Offerors shall acknowledge compliance with the Service Contract Labor Standards by confirming that all service employees will be compensated in accordance with the attached Wage Determination and applicable FAR clauses. Offerors shall identify any conformance requests for labor categories not listed in the WD using SF-1444 within 30 days of contract award.

There are no additional contract requirement(s) or terms and conditions determined by the contracting officer to be necessary for this acquisition and consistent with customary commercial practices. No telephonic quotes will be processed. All responses must be received no later than the date stated above. Contact, Latoya Michel at zrb5@cdc.gov, Contracting Officer, for any questions regarding this solicitation. Questions must be submitted in writing; no telephonic questions permitted.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

CLIN 0001 will be funded at time of award.

Firm Fixed Priced PoP: 03/01/2026 to 02/28/2027

CLINs 1001, 2001, 3001, and 4001 are Optional Priced Line Items, as described in FAR 52.217-5. Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s).

Option Period 1

Firm Fixed Priced

PoP: 03/01/2027 to 02/29/2028

Option Period 2

Firm Fixed Priced

PoP: 03/01/2028 to 02/28/2029

Option Period 3

Firm Fixed Priced PoP: 03/01/2029 to 02/28/2030

Option Period 4

Firm Fixed Priced

PoP: 03/01/2029 to 02/28/2030

Performance Work Statement Title: Support Services for DFSE and the NIOSH Industry and Occupation Coding System

Period of performance of this contract is: March 1, 2026 to February 28, 2031 Base Period: March 1, 2026 to February 28, 2027 Option Period One: March 1, 2027 to February 29, 2028 Option Period Two: March 1, 2028 to February 28, 2029 Option Period Three: March 1, 2029 to February 28, 2030 Option Period Four: March 1, 2030 to February 28,2031

SECTION 1 – BACKGROUND

The National Institute for Occupational Safety and Health (NIOSH) has developed a machine learning tool that enables the assignment of standardized codes for occupation and industry from free-text descriptions. The application provides the ability to analyze surveillance data using the standardized codes. The application is used by both internal and external stakeholders to advance occupational safety and health research. Support services are needed to provide coding and review of entries and outputs for the NIOSH Industry and Occupation Coding System (NIOCCS). Additionally, support is needed for clerical and records management activities in support of health studies within NIOSH’s Division of Field Studies.

SUBSECTION A –

SECTION 2 – PURPOSE/OBJECTIVE

The purpose of this contract is to provide comprehensive data entry, coding, clerical, and records management support for the Division of Field Studies and Engineering (DFSE) within NIOSH. These services are essential to ensure the accurate and timely processing of occupational health and exposure data using the NIOSH Industry and Occupation Coding System (NIOCCS).

The objective is to:

1. Support the application of standardized industry and occupation codes to free-text data collected through health studies and surveillance programs.

2. Ensure high-quality data entry and coding that meets CDC and NIOSH standards for accuracy, completeness, and timeliness.

3. Provide clerical and records management support to facilitate efficient study operations, data validation, and compliance with federal records policies.

4. Enable DFSE to maintain continuity in research and surveillance activities that inform public health policy and occupational safety initiatives.

Contractor performance be monitored through defined metrics and quality assurance procedures to ensure alignment with project goals and federal standards.

SECTION 3 – SCOPE OF WORK

The contractor shall provide necessary personnel to support the following area within NIOSH: Data Entry Support Services, two (2) Data Processing of Clerk I (3,840 hours), a Data Processing Clerk II (1,880 hours), two (2) Data Processing/Quality Control (3,780 hours), and two (2) Data Processing Clerk II Team Leads (3,780 hours). NIOSH conducts occupational health and exposure studies and surveillance. Support is needed for conducting these studies. The Contractor relies on government provided instructions and pre-established guidelines to perform the functions of the job.

The contractor shall provide qualified personnel to support the Division of Field Studies and Engineering (DFSE) within NIOSH in the areas of data entry, coding, quality control, clerical support, and records management. These services are essential to the processing and analysis of occupational health and exposure data collected through NIOSH studies and surveillance programs.

Personnel categories may include, but are not limited to:

· (2) Data Processing Clerk I

· (1) Data Processing Clerk II

· (2) Data Processing Clerk – Quality Control

· (2) Data Processing Clerk II – Team Lead Contractor staff perform tasks such as:

1. Entering and coding data using standardized classification systems (e.g., Census, NAICS, SOC) and NIOSH’s Industry and Occupation Coding System (NIOCCS)

2. Validating and correcting data based on project-specific instructions and edit reports

3. Supporting study operations through clerical tasks including document preparation, survey tracking, and file management

4. Assisting with records management activities in compliance with federal guidelines

5. Participating in training and meetings as required by NIOSH All work shall be performed in accordance with government-provided instructions, established guidelines, and applicable CDC/NIOSH policies. The government furnish necessary workspace, equipment, and access to systems required to perform the services.

SECTION 4 – TASKS TO BE PERFORMED

The contractor shall perform Clerical support tasks as determined within NIOSH, DFSE. Specific tasks may include, but are not limited to:

Data Processing Clerk I (a) – The contractor shall perform Clerical support tasks as determined within NIOSH, DFSE. Specific tasks may include, but are not limited to:

1. Entering occupational health and exposure study data according to a project specific coding guide provided for the activity.

a. Source documents vary by project. They typically include electronic files, pdf documents or microform copies of hardcopy records, such as employment records, death records, or surveys which respondents completed.

b. The data entry activity includes both verbatim entry as well as industry and occupation coding according to established guidelines.

c. Data entry instructions are provided to guide each entry project. Coding decisions are based on these instructions.

d. The data are typically entered into a custom-tailored entry application designed for the specific activity, using a tool such as Microsoft Access, or a branch wide tool the NIOSH Industry and Occupation Computerized Coding System (NIOCCS).

e. Government project leader orients staff to the project and addresses questions and concerns as the project progresses.

2. Validating or correcting study and surveillance data from edit reports. Corrective actions be directed by the data entry instructions or by the project leader.

3. Coding data according to national classification standards. The following are typical examples.

a. Assigning industry and occupation codes to industry and occupational text fields from vital records, surveys and company information forms using Census, NAICS or SOC coding schemes. The coding assignments be done using a data entry program. First level quality control be performed by each clerk for accurate interpretation of industry and occupation narratives.

b. Assigning illness and injury cause codes to narrative descriptions of the cause of workers’ compensation claims using the Bureau of Labor Statistics’ Occupational Injury and Illness Classification System (OIICS) Manual.

Data Processing Clerk I (b) – The contractor be required to perform Clerical support tasks as determined within NIOSH, DFSE. Specific tasks may include, but are not limited to:

1. Providing clerical support for study data collection.

a. Contacting data providers to request information, such as requesting medical records from health care providers, following-up on outstanding survey responses.

b. Assisting researchers with field data collection, such as scanning hardcopy files, and distributing and collecting surveys.

c. Tracking the status of survey responses, forms.

d. Preparing materials for mass mailings.

e. Retrieving and filing study records and associated data according to branch procedures.

f. Performing Freedom of Information Act (FOIA) searches.

2. Providing records management support.

a. Entering information in electronic records information systems such as the Industrywide Studies Information System (ISIS) and Microsoft Office products (e.g., Word, Excel, PowerPoint).

b. Proficient in standard Microsoft Office applications.

• Able to assemble basic PowerPoint presentations and Word documents.

• Able to use Excel to create and edit lists and tables for basic tracking of tasks or items.

• Able to distill several pieces of information (e.g., resources about federal records management rules and procedures) into a summary document (Word or PowerPoint).

c. Successfully search electronic and hardcopy records in response to Freedom of Information Act (FOIA) requests, including searching physical and electronic records, preparing records for electronic transfer to the FOIA office, and filling out FOIA response sheets.

d. Providing quick and easy access to federal records in a usable format (e.g., locating physical records, scanning documents, editing/merging PDFs, managing electronic file storage locations) when requested by branch staff or in response to a FOIA request.

e. Preparing hardcopy and electronic federal records for storage and archiving.

f. Ensuring that all necessary federal records documentation is accurate and complete and is compliant with regulations and/or policies.

g. Answering basic federal records management questions posed by the branch about federal records management rules and procedures (e.g., classifying records schedules, determining records retention and disposal guidelines).

h. Maintaining paper and electronic records and data according to Agency-specific rules and procedures.

3. Attending NIOSH sponsored training and meetings.

Data Processing Clerk II (a) - The contractor shall perform Clerical support tasks as determined within NIOSH, DFSE. Specific tasks may include, but are not limited to:

1. Entering occupational health and exposure study data according to a project specific coding guide provided for the activity.

a. Source documents vary by project. They typically include electronic files, pdf documents or microform copies of hardcopy records, such as employment records, death records, or surveys which respondents completed.

b. The data entry activity includes both verbatim entry as well as industry and occupation coding according to established guidelines.

c. Data entry instructions are provided to guide each entry project. Coding decisions are based on these instructions.

d. The data are typically entered into a custom-tailored entry application designed for the specific activity, using a tool such as Microsoft Access in the NIOSH Industry and Occupation Computerized Coding System (NIOCCS).

e. Government project leader orients staff to the project and addresses questions and concerns as the project progresses.

2. Validating or correcting study and surveillance data from edit reports. Corrective actions be directed by the data entry instructions or by the project leader.

3. Coding data according to national classification standards. The following are typical examples.

a. Assigning industry and occupation codes to industry and occupational text fields from vital records, surveys and company information forms using Census, NAICS or SOC coding schemes. The coding assignments be done using a data entry program. First level quality control be performed by each clerk for accurate interpretation of industry and occupation narratives.

b. Assigning illness and injury cause codes to narrative descriptions of the cause of workers’ compensation claims using the Bureau of Labor Statistics’ Occupational Injury and Illness Classification System (OIICS) Manual.

4. Attending NIOSH sponsored training and meetings.

Data Processing Clerk/Quality Control (b) – The contractor be required to perform Clerical support tasks as determined within NIOSH, DFSE. Specific tasks may include, but are not limited to:

1. Entering occupational health and exposure study data according to a project specific coding guide provided for the activity.

a. Source documents vary by project. They typically include pdf documents or microform copies of hardcopy records, such as employment records, or surveys which respondents completed by hand.

b. The data entry activity includes both verbatim entry as well as minor coding.

c. Data entry instructions are provided to guide each entry project. Coding decisions are based on these instructions.

d. The data are typically entered into a custom-tailored entry application designed for the specific activity, using a tool such as Microsoft Access in the NIOSH Industry and Occupation Computerized Coding System (NIOCCS).

e. Coordinate with project leader to orient staffs to the project and addresses questions and concerns as the project progresses.

2. Validating or correcting study and surveillance data from edit reports. Corrective actions be directed by the data entry instructions or by the project lead.

3. Coding data according to national classification standards. The following are typical examples.

a. Assigning industry and occupation codes to industry and occupational text fields from vital records, surveys and company information forms using Census, NAICS or SOC coding schemes. The coding assignments be done using a data entry program. First level quality control be performed by each clerk for accurate interpretation of industry and occupation narratives.

b. Assigning illness and injury cause codes to narrative descriptions of the cause of workers’ compensation claims using the Bureau of Labor Statistics’ Occupational Injury and Illness Classification System (OIICS) Manual.

4. Providing administrative or final level quality control check for industry and occupation codes. The coded file be reviewed and codes changed based on the knowledge of the coding rules.

5. Providing records management and technical documentation. This may include providing quick and easy access to records in a usable format, ensuring that all necessary documentation is accurate and complete and are compliant with regulations and/or policies, and maintaining paper records and data according to Agency- specific rules and procedures.

6. Assisting with Team Lead duties when needed.

7. Attending NIOSH sponsored training and meetings.

Data Processing Clerk II (Team Lead) - The contractor personnel be required to perform as a Clerical support tasks related to coding within NIOSH, DFSE. Specific tasks may include, but are not limited to:

1. Entering occupational health and exposure study data according to a project specific coding guide provided for the activity.

a. Source documents vary by project. They typically include pdf documents or microform copies of hardcopy records, such as employment records, or surveys which respondents completed by hand.

b. The data entry activity includes both verbatim entry as well as minor coding.

c. Data entry instructions are provided to guide each entry project. Coding decisions are based on these instructions.

d. The data are typically entered into a custom-tailored entry application designed for the specific activity, using a tool such as Microsoft Access in the NIOSH Industry and Occupation Computerized Coding System (NIOCCS).

e. coordinate with project leader to orient staffs to the project and addresses questions and concerns as the project progresses.

2. Validating or correcting study and surveillance data from edit reports. Corrective actions be directed by the data entry instructions or by the project leader.

3. Coding data according to national classification standards. The following are typical examples.

a. Assigning industry and occupation codes to industry and occupational text fields from vital records, surveys and company information forms using Census, NAICS or SOC coding schemes. The coding assignments be done using a data entry program. First level quality control be performed by each clerk for accurate interpretation of industry and occupation narratives. First level quality control may include industry and occupation narratives with a higher number of records flagged for review.

b. Assigning illness and injury cause codes to narrative descriptions of the cause of workers’ compensation claims using the Bureau of Labor Statistics’ Occupational Injury and Illness Classification System (OIICS) Manual.

4. Providing clerical support for study data collection.

a. Contacting data providers to request information, such as requesting medical records from health care providers, following-up on outstanding survey responses.

b. Assisting researchers with field data collection, such as scanning hardcopy files, and distributing and collecting surveys.

c. Tracking the status of survey responses, forms.

d. Preparing materials for mass mailings.

e. Retrieving and filing study records and associated data according to branch procedures.

5. Providing administrative or final level quality control check for industry and occupation codes. The coded file be reviewed and codes changed based on the knowledge of the coding rules.

6. Providing records management and technical documentation. This may include providing quick and easy access to records in a usable format, ensuring that all necessary documentation is accurate and complete and are compliant with regulations and/or policies, and maintaining paper records and data according to Agency- specific rules and procedures.

7. Participating in training related to industry and occupation coding specified by NIOSH project leader.

8. Assisting with system testing and IT team consultations as needed.

9. Completing National Occupational Mortality Surveillanceaa (NOMS )or other project consistency reviews and other computer-generated coding reviews.

10. Assisting with training activities as assigned by NIOSH project leader.

11. Providing training to Data Processing Clerk I (a) and Data Processing Clerk II.

12. Assisting with NIOCCS testing as needed.

13. Participating in training related to industry and occupation coding specified by NIOSH project leader.

14. Attending NIOSH sponsored training and meetings.

SECTION 5 – GOVERNMENT FURNISHED PROPERTY

The Government shall provide computers, access to the CDC network, telephone, for the contractor’s use in performing the required services.

SECTION 6 – PLACE OF PERFORMANCE AND CONTRACT SUPPORT HOURS

SUBSECTION A – PLACE OF PERFORMANCE

Contractor performance for all coders will be off site with the ability to visit CDC campus if necessary. The Data Clerk I shall be onsite at CDC facility three days per week. Telework is permissable as needed with Government provided equipment (laptop) and CDC Citrix or vpn access, provided all security requirements are met. For employees working on site, the CDC’s facility work space is provided below:

Alice Hamilton Laboratory, 5555 Ridge Avenue Hamilton Building Cincinnati, OH 45213 Adequate parking is available on-site.

Telework may be permitted and/or revoked by the Contracting Officer resentative on this contract. All telework and telework schedule must be approved in advance by the Contracting Officer Representative.

SUBSECTION B – CONTRACT SUPPORT HOURS

The duty hours shall consist of 40 hours per week Monday through Friday, 52 weeks per year, excluding federal holidays (listed below) and weekends. The workday shall be completed within the period of 6:00 a.m. and 6:00 p.m., to include a ½ hour lunch period as long as at least 4 hours are worked that day. Contractor staff shall be available for NIOSH meetings when scheduled.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Technical Monitor

SUBSECTION A – PERFORMANCE MATRIX

Performance Objective

Standard Performance Threshold Acceptable Quality Levels (AQLs)

Method of Surveillance

Incentives

Review contractor provided weekly status reports which detail entry and error rates, as appropriate.

Positive or negative rating be reported through CPAR for future award reference

Review of contractor provided weekly status reports.

Positive or negative rating be reported through CPAR for future award reference

SECTION 9 – REFERENCE MATERIALS

https://www.cdc.gov/niosh/topics/coding/nioccs/default.html https://csams.cdc.gov/nioccs/Default.aspx

SECTION 10 – PROPOSED CONTRACT TYPE

The anticipated contract type is a Labor Hour Service Contract.

SECTION 11 – POINT OF CONTACT INFORMATION

Contracting Officers Representative (COR):

Estu Brataningsih Telephone Number: 513-841-4280 E-mail Address: egl3@cdc.gov Preferred method of communication: email

SECTION 12 – ADDITIONAL REQUIREMENTS

Section I: Procurements Requiring Information Security and/or Physical Access Security Baseline Security Requirements Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee have or be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC/NIOSH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and Availability, which means ensuring timely and reliable access to and use of information.

Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

Comply with the Privacy Act requirements and tailor FAR clauses as needed.

Categorize all information owned and/or collected/managed on behalf of HHS/CDC/NIOSH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/CDC/NIOSH regardless of location or purpose.

Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/CDC/NIOSH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/CDC/NIOSH security and/or privacy officials.

Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/CDC/NIOSH privacy policies, and complete all the requirements below:

Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA determine if a full Privacy Impact Assessment (PIA) needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within [OpDiv to insert contract-specific timeline] after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

marked appropriately;

disclosed to authorized personnel on a Need-To-Know basis;

protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

Per NIOSH Security and Privacy requirement, the Contractor (and/or any subcontractor) shall employ a formal sanctions process for individuals failing to comply with established privacy policies and procedures.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

Standard for Encryption. The Contractor (and/or any subcontractor) shall:

Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor shall provide a written copy of the validation documentation to the COR.

Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. Contractors (and/or subcontractors) must a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

Training

1. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

1. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

1. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Rules of Behavior

1. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1. The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/CDC IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

All contractors and subcontractors shall participate in regular training on how to identify and report a breach.

All contractors and subcontractors shall report a suspected or confirmed breach in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay as soon as possible and no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC, incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

c. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

d. Not include any sensitive information in the subject or body of any reporting e-mail; and

e. Encrypt sensitive information in attachments to email, media, etc.

Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/CDC privacy breach response policies when handling PII breaches.

Provide…