DRAFT SOW for RFI -- LIMS Service_Maintenance.docx

STATEMENT OF WORK

Contents

STATEMENT OF WORK (SOW)

Title: Laboratory Information Management System (LIMS) Service and Maintenance Requiring Activity Name: Walter Reed Army Institute of Research (WRAIR), Center for Enabling Capabilities (CEC), Pilot Bioproduction Facility (PBF)

1. INTRODUCTION

The Walter Reed Army Institute of Research (WRAIR) provides unique research capabilities and innovative medical solutions to a range of Force Health Protection and Readiness challenges currently facing U.S. Service Members, along with threats anticipated during future operations.

Through both times of peace and war, infectious diseases have killed, sickened, and disabled far more Service Members than bombs and bullets. WRAIR has created a model of vaccine and therapeutic development that is unique, nimble, and responsive to dynamically evolving infectious disease threats of military importance. WRAIR, with its unparalleled expertise, facilities, and international network, has developed many vaccines and drugs in use today by military and civilian medicine around the globe.

In addition to protecting against infectious disease threats, WRAIR conducts basic and applied research that promotes psychological resilience, enhances neurological functioning, and improves operational readiness among U.S. Service Members. By using a continuum of research from basic science to applied field studies, WRAIR creates innovative solutions to enhance Service Members’ resilience and recovery. Research in military psychiatry and neuroscience has been an integral part of WRAIR's portfolio for more than 70 years. WRAIR researchers are recognized leaders in operational medical research for the military in a number of fields, including brain trauma, blast exposure, deployment stressors, and sleep management.

2. PURPOSE AND BACKGROUND

WRAIR’s Center for Enabling Capabilities (CEC) facilitates the execution of innovative military relevant medical research protecting and optimizing performance of the Warfighter. The mission of WRAIR’s CEC is to advance medical capability and countermeasure development through provision of world class, cost efficient, and professional research support.

The Pilot Bioproduction Facility (PBF) within the CEC conducts research, development, production, and testing of vaccines and other biological products. The PBF is a current Good Manufacturing Practice (CGMP)-compliant pharmaceutical manufacturing facility that specializes in developing vaccines and biologics for military-relevant infectious disease threats. PBF capabilities include process development, scale-up, and CGMP drug substance and drug product manufacturing. PBF support has been critical to the Department of Defense’s (DoD’s) development efforts in the advancement of numerous vaccines. These vaccines include those for hepatitis A, meningitis, dengue fever, malaria, adenovirus, Japanese encephalitis, shigellosis, zika, and, most recently Covid-19. Conventional as well as recombinant and other genetically engineered vaccines are undergoing development and production at WRAIR. Other types of biological products (e.g., therapeutics) are also capable of being produced under the right circumstances.

The purpose of this requirement is to provide technical support, maintenance, access to software upgrades, and security fixes for the LabVantage Pharma Laboratory Information Management System (LIMS) without a network connection at the PBF. The PBF owns a perpetual LIMS license for their internal network that currently does not have external connectivity. This software aids in the management of samples and data that results in improved efficiency, better data management, improved accuracy, improved compliance, and improved decision-making.

3. SCOPE

This objective of this requirement is to maintain access to and operation of the LabVantage Pharma v8 LIMS licensed for internal use on the PBF’s non-networked plant infrastructure. Support and maintenance shall include providing Standing Operating Procedures (SOPs), disaster recovery procedures, and data integrity assurance protocols upon initial proposal submission, with updates as needed. It shall also provide software upgrades, security patches and associated fixes required to maintain compliance, and technical support to ensure continued operation of LabVantage Pharma. Software licenses and modules including (but not limited to) J-Boss and Bartender licenses shall be included for PBF personnel with technical support, software updates, security updates, and software maintenance.

4. PERIOD OF PERFORMANCE (PoP)

The period of performance for this contract shall be as follows:

5. WORK SCHEDULE AND LOCATION

The LIMS and hardware location is 501 Robert Grant Avenue, Silver Spring, MD 20910; all Contractor support will be provided virtually. Scheduled calls shall occur during business hours between the hours of 0800 to 1600 Eastern Standard Time (EST), Monday through Friday.

6. PERFORMANCE REQUIREMENTS

6.1 Objectives: The objective of this requirement is to maintain the LabVantage Pharma LIMS software on the internal Plant network at the PBF.

6.2 Specified Tasks:

6.2.1 Maintenance and System Update/Support Services. The Contractor shall provide maintenance on an as needed basis, as described below, to assure optimal performance of the system. The Contractor is required to respond within 24 hours. All work shall be completed in accordance with Occupational Safety and Health Administration (OSHA), Health Insurance Portability and Accountability Act (HIPAA), DoD, Army, and Defense Health Agency (DHA) safety, privacy, and Information Technology (IT) regulations.

6.2.1.1 Security Compliance: Ensure that all software complies with all DoD and WRAIR information security protocols and is compatible with DoD-approved antivirus, antimalware, and intrusion detection systems. The Contractor shall ensure complete accreditation, validation, and adherence to all clauses detailed in Section 8 of this SOW (A.001).

6.2.1.2 Software Updates: The contractor shall ensure all software updates and patches are available within 48 hours of release.

6.2.1.3 Technical Support Services: The Contractor shall maintain a high level of availability, with low wait time, to provide customer technical support that includes interactive telephone support for the purpose of resolving technical support incidents during the Government facility operating hours. The Contractor shall maintain a service log that details the technical support provided, how the requirement was resolved, and recommended actions if the requirement was not resolved. Provide a copy of this log to the COR and the Medical Maintenance Manger on a quarterly basis. (A.002)

6.2.1.4 Emergency Repair Service: The Contractor shall provide emergency bug fixes and repairs with a 24-hour response time. The Contractor shall provide a service report that details the nature of the fix and instructions for application. (A.003)

6.2.1.5 The Contractor shall furnish all software updates/patches issued by the LIMS manufacturer.

6.3 Minimum Essential Characteristics (MECs): In addition to the above tasks, specific product, IT, and security requirements are specified in Attachment 2: MECs.

7. DELIVERABLES

The Contractor shall complete and submit deliverables in accordance with the “Deliverables Table” below. Unless specified in the Statement of Work (SOW) within the description of the deliverable, all deliverables will be made to the COR electronically.

DELIVERABLES TABLE

6.2.3.4

7.1 Inspection and Acceptance. The COR delegated oversight of specific technical, functional, and oversight responsiblities is responsible for inspection and acceptance of all services, incoming shipments, documents, and services. Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the SOW and all terms and conditions of this order, including all modifications.

7.2 Contract Management

7.2.1 Government Management. The COR for this contract will be appointed by the Contracting Officer (CO). The COR will serve as the primary point of contact for all activities and issues that occur under this contract. Only the CO has the authority to enact changes to this award.

COR Information:

Name: Dr. Stasya Zarling Phone number: 301-319-7143 Email: stasya.n.zarlingbejma.civ@health.mil

7.2.2 Contractor Organization. The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The Contractor shall ensure that all Contractor personnel are advised of their chain of command and who they should contact if they have questions.

8. COMPLIANCE DOCUMENTS

8.1 General Compliance

8.1.1 Federal Law. The services provided under this contract shall be conducted in accordance with all Federal, DoD, DHA, and United States Army Medical Research and Development Command (USAMRDC) laws command laws, regulations, policies, and/or procedures.

8.1.2 Applicable Publications:

· The Army Physical Security Program (Army Regulation (AR)) 190-13

· U.S. Army Corps of Engineers Safety and Health Requirements Manual 385-1-1

· Medical Logistics Policies (AR 40-61)

· Antiterrorism Force Protection: Security of Personnel, Information, and Critical Resources (AR 525-13)

· Operations Security (AR 530-1)

· Insider Threat Program (DHA-Administrative Instruction (AI) 097)

· Testing and Calibration Laboratories (International Organization for Standardization (ISO) 17025)

· Cybersecurity, Department of Defense Instruction (DoDI) 8500.01

· Risk Management Framework For DoD Systems, DoDI 8510.01,

· DoD Privacy Program, DoD 5400.11-R

· FDA Guidance on Electronic Records (21 CFR Part 11)

· Good Automated Manufacturing Practices (GAMP 5)

8.2 Personally Identifiable Information (PII) and Protected Health Information (PHI)

The Contractor shall comply with the DHA Procedures, Guides, and Information (PGI) 224 – Protection of Privacy and Freedom of Information. The Contractor may access PII in the course performing the tasks of this contract, and as such, the Contractor shall comply with the document entitled “Personally Identifiable Information (PII), Protected Health Information (PHI) and Federal Information Requirements”.

The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data. The Contractor shall also ensure the confidentiality, integrity, and availability of Government data in compliance with all applicable laws and regulations, including data breach reporting and response requirements, in accordance with Defense Federal Acquisition Regulations Supplement (DFARS) Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference DoDI 5400.11, DoD Privacy and Civil Liberties Programs; DoD 5400.11-R, Department of Defense Privacy Program; and Department of Defense Manual (DoDM) 5400.11, DoD Privacy and Civil Liberties Programs: Breach Preparedness and Response Plan. The Contractor shall also comply with federal laws relating to freedom of information and records management. The Contractor shall comply with all requirements of the HIPAA of 1996 (Pub. L. 104-191), as implemented by the HIPAA Privacy and Security Rules codified at 45 Code of Federal Regulations (CFR) Parts 160 and 164, and as further implemented within the Military Health System (MHS) by DoD 6025.18-R, "DoD Health Information Privacy Regulation" and DoD 8580.02-R, “DoD Health Information Security Regulation.” IT services that collect, maintain, use, or disseminate personally identifiable information must be managed in a manner that protects privacy, in accordance with all privacy laws and regulations.

8.3 Information Technology (IT) Compliance

8.3.1 Software. The Contractor shall permit the Government to perform software vulnerability scans on acquired software to identify potential weaknesses in the code. Collaboration between the Contractor and the Government is required to address any vulnerabilities detected during these scans. Additionally, the Contractor is responsible for providing ongoing support to patch vulnerabilities throughout the software’s lifespan. All Commercial-Off-The-Shelf (COTS) software shall be registered on SAM.gov and have a cage and Data Universal Number System (DUNS) number.

8.3.2 Hardware. Contractors are required to offer IT maintenance warranty support for any purchased hardware until hardware reaches it End of Life (EOL). Furthermore, Contractors shall provide patching support to include firmware and driver updates for any vulnerabilities uncovered during Government vulnerability scanning. All hardware shall be Trade Agreement Act (TAA) compliant and all computers shall be Trusted Platform Module (TPM) 2.0 compliant.

8.3.3 IT Systems. Contractors shall commit to work with and assist the Government agency (purchaser) to obtain an approval to operate on or with the DHA environment. This approval to operate must come from the DHA Authorizing Official (AO) using National Institute of Standards and Technology (NIST) 800-37 and NIST 800-53 controls to obtain approval from DHA AO before the hardware and/or software can be used with the DHA environment on the DHA network or as a standalone in a research lab.

8.3.4 Mitigation of Vulnerabilities.

8.3.4.1 Maintain all equipment/product versions provided pursuant to the construction or other procurement contract, to include the supported operating system, by issuing patches/updates to mitigate vulnerabilities [e.g., Information Assurance Vulnerability Alert (IAVA) or Information Assurance Vulnerability Bulletins (IAVB)] and network security configurations [e.g., Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)]. The Contractor shall adhere to DHA guidance for remediation or mitigation of vulnerabilities associated with the equipment/product.

8.3.4.2 Test all IAVAs, patches, updates, and upgrades in the test/laboratory environment before implementing in a production environment. All production environment IAVAs, patches, updates, and upgrades shall be approved by the Medical Treatment Facility (MTF’s) Change Control Board prior to Contractor implementation. Approved changes shall be implemented on a quarterly basis (A.001).

9. OTHER TERMS, CONDITIONS, AND PROVISIONS

9.1 Invoices. The Contractor shall submit invoices monthly and/or annually to Wide Area Work Flow (WAWF) with sufficient documentation to provide certification of invoice. The Contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and receiving report for payment. Invoices submitted for payment, which do not contain Contract Line Item Number (CLIN) and the Accounting Classification Reference Number (ACRN) information, will be rejected. The WAWF – Receipt and Acceptance application is the required method of submission (A.004).

9.2 Access to Government Facilities: Reserved.

9.3 Service Contract Reporting: Reserved.

9.4 Training.

9.4.2 Threat Awareness Reporting Program (TARP). Per DHA-AI 097, Insider Threat Program, Contractor employees with security clearances shall receive annual Insider Threat Awareness training within 30 days of initial employment, and refresher training annually either through instructor-led or computer-based (A.005).

10. ATTACHMENTS

Attachment 1 - Acronyms List Attachment 2 - MECs

ATTACHMENT 1 – ACRONYMS LIST

ATTACHMENT 2 – MINIMUM ESSENTIAL CHARACTERISTICS (MECs) Specific Product Requirements:

· Shall support LabVantage Pharma v8 Laboratory Information Management System (LIMS) licensed for internal use on the PBF’s non-networked plant infrastructure.

· Shall include software licenses and modules including (but not limited to) J-Boss and Bartender.

· Shall provide annual maintenance including:

· Software updates and patches within 48 hours of release.

· Security updates in compliance with DoD and WRAIR Information Security protocols.

· Emergency bug fixes and repairs with 24-hour response time.

· Shall provide technical support LIMS integration with laboratory instrumentation utilizing existing drivers.

· Shall preserve data integrity and support electronic data reporting without transcription errors from data entry to reports.

· Shall include compatibility with DoD-approved antivirus, anti-malware, and intrusion detection systems.

· Shall include technical support services during standard operating hours (0800–1600 EST, Mon–Fri), with emergency 24/7 support available.

IT and Security Requirements:

· Shall be compliant with:

· NIST SP 800-37 and 800-53

· GAMP 5 guidelines

· DISA STIGs

· DoD and DHA cybersecurity regulations including RMF compliance and ATO requirements

· Shall undergo vulnerability scanning by the Government; contractor must support remediation of all Category I/II findings.

· Shall submit all RMF-related documentation and cybersecurity assessment responses within government timelines.

· Shall use only OEM or OEM-certified refurbished parts for any associated hardware repair or upgrade.

· Shall include access to all necessary diagnostic software for support services.

Maintenance, Calibration, and Reporting Requirements:

· Shall provide full documentation of all service calls, software updates, and calibration activities to COR per SOW guidelines.

· Shall submit completed DD Form 2164 for any calibrations, including equipment used and expiration dates.

· Shall ensure service representatives are factory-trained and certified on LIMS and any associated modules.

Compliance and Delivery:

· All software and services must be Trade Agreement Act (TAA) compliant.

· All COTS software must be registered on SAM.gov with a valid Cage and DUNS number.

· All work must be completed in accordance with OSHA, HIPAA, DoD, Army, and DHA safety, privacy, and IT regulations.