DRAFT_SOW_RISER_March.docx

Section C - Description/Specification/Work Statement

STATEMENT OF WORK

CDC’s Resources for Improvement of Surveillance and Emergency Response (RISER)

I. BACKGROUND AND NEED

The Centers for Disease Control and Prevention (CDC) is undergoing transformation under the FY2026 President’s Budget, which reforms the agency to focus on its core mission: supporting infectious disease surveillance, outbreak investigations, preparedness and response, and maintaining the Nation’s public health infrastructure. This realignment ensures that CDC’s resources are directed toward early detection of public health threats, timely intervention, and prevention of disease escalation, ultimately strengthening the health and safety of Americans.

CDC’s public health surveillance systems form the foundation of the nation’s defense against health threats. These systems provide vital insights into disease trends and are critical to proactively identifying and addressing public health challenges. National and state-based surveillance platforms, supported by robust laboratory networks, enable CDC to detect risk factors, guide interventions, and prevent outbreaks from becoming epidemics or pandemics.

To support this mission, CDC’s laboratory scientists operate across 200 laboratories in the United States. The CDC’s Resources for Improvement of Surveillance and Emergency Response (RISER) contract is designed to support two of CDC’s infectious disease-focused national Centers:

1. the National Center for Immunization and Respiratory Diseases (NCIRD), and

2. the National Center for Emerging and Zoonotic Infectious Diseases (NCEZID).

These Centers lead laboratory-based surveillance, deploy diagnostic assays, and conduct applied research to understand disease distribution, determinants, and burden across diverse populations.

The RISER contract builds upon the success of the CDC Influenza Reagent Resource (CDC-IRR) and its impact during responses to outbreaks such as the 2009 influenza A(H1N1) pdm09, Zika (2015), SARS-CoV-2 (2020), Mpox (2022), Ebola (2022), and the influenza A(H5N1) (2022-2025), to name a few. In 2019, the program’s scope was expanded beyond influenza to encompass bacterial and non-influenza viral pathogens of public health significance. This expansion enabled the rapid deployment of critical reagents and materials to public health laboratories and research partners during health emergencies.

Today, RISER will be a cornerstone of CDC’s modernized surveillance infrastructure. It will support core agency priorities by ensuring the availability of quality reagents, supporting early detection and facilitating rapid response to domestic and international health threats, helping fulfill CDC’s mission under the President’s FY2026 vision for a stronger, more responsive public health agency.

Additional Program Participation:

While the primary scope of RISER is to support NCIRD and NCEZID, RISER may, upon CDC approval, be used to support additional CDC programs for limited-scope activities during public health emergencies or to address emerging surveillance needs.

Such participation will only occur through issued task orders, with clearly defined deliverables, cost ceilings, and timelines. Contributions from these programs may include direct funding or cost-sharing arrangements to support authorized activities.

Period of Performance Duration:

In accordance with FAR 17.204, the base and option periods for this contract are intentionally structured with varying durations. This approach allows CDC to align contract performance with program phases, fiscal year budget cycles, and operational priorities, providing the flexibility needed to meet evolving public health requirements.

II. PROJECT OBJECTIVES

The primary core objectives of this contract are:

1. to produce or acquire high-quality stocks of reference pathogens, positive controls, detection kits, genomic sequencing components, proficiency panels, and other similar types of surveillance and research reagents in direct support of CDC-developed assays and surveillance platforms;

2. to ensure that these reagents, and any other materials critical to the performance of public health laboratory surveillance activities, are reliably available to CDC, its public health laboratory partners, and approved research collaborators for the characterization of circulating and novel pathogens;

3. to sustain the operational capacity to rapidly scale reagent acquisition, production, and distribution in support of domestic and global public health emergencies;

4. to establish and maintain secure infrastructure for real-time data exchange across contractors and with CDC, including the ability to receive and process data uploads from external partners (e.g., genomic sequencing files, proficiency panel results), and to transmit validated data to appropriate CDC programs for analysis or regulatory action;

5. to enable visualization of CDC-generated analysis outputs derived from RISER-submitted laboratory data in dashboard formats, accessible through the RISER website or associated secure platforms. This includes incorporation of historical data dashboards developed by CDC, as well as future analytic summaries tied to genomic surveillance, reagent validation, and/or proficiency testing results submitted by RISER registrants. The contractor shall ensure secure integration and display functionality, in coordination with CDC-led analysis pipelines. All software, tools, and modules used for the visualization, processing, or display of CDC-generated analysis outputs shall undergo documented validation prior to deployment, consistent with CDC’s Quality Management System (QMS) requirements and, where applicable, FDA 21 CFR Part 11 or 21 CFR Part 820 validation standards. The contractor shall maintain validation records and make them available to CDC upon request.

The optional objectives of this contract are:

1. to develop and validate scientific workflows and technology transfer protocols in support of new diagnostic assay design and platform advancement for characterization of pathogens;

2. to procure and manage ancillary reagents required for the performance of CDC-developed diagnostic kits and platforms. Routine procurement of off-the-shelf commercial reagents by the contractor shall not be included in base contract operations. Recipient laboratories are expected to source these materials independently, except when the optional task is exercised. For selected laboratories, CDC or its designated agent may procure and maintain a small cache of emergency-use ancillary reagents for distribution.

III. SCOPE OF WORK

The contractor shall produce or otherwise acquire, characterize, store, and distribute CDC-furnished pathogens and other reagents essential to the performance of CDC-developed diagnostic assays that directly support the agency’s mission of infectious disease surveillance, outbreak response, and public health infrastructure. Materials covered under this contract include live and inactivated viruses, bacteria, vector-borne pathogens, nucleic acids, antisera, proteins, cell lines, hybridomas, and monoclonal antibodies, as detailed in Appendix A – Deliverables.

To support molecular diagnostic testing efforts, the government may authorize the contractor to work with government pre-qualified subcontractors under multiple award task order mechanisms. Unless otherwise directed, task orders issued for molecular test production must comply with the quality specifications outlined in Appendix B – Quality Specifications.

RISER may be activated to support emergency operations initiated at the Division, Center, or CDC Emergency Operations Center (EOC) level. Activation authority may be exercised by the Contracting Officer (CO) upon written directions from authorized CDC officials at any of these levels. The contractor shall maintain readiness to scale operations consistent with the level of activation and CDC direction.

All reagents produced under this contract shall comply with the quality specifications listed in Appendix B – Quality Specifications and be manufactured in accordance with recognized national or international standards, such as International Organization for Standardization (ISO) 9001, ISO 13485 and U.S. current good manufacturing practices (cGMP), or equivalent frameworks. Detailed batch records must be retained and made available to CDC upon request. Deliverables may include Food and Drug Administration (FDA) -regulated materials such as in vitro diagnostic kits. CDC reserves the right to conduct annual site reviews to verify contractor compliance with FDA Quality Management System Regulations and 21 CFR Part 820. CDC also reserves the right to review contractor corrective and preventive actions (CAPAs), and to conduct evaluations of contractor processes and performance related to quality management, manufacturing, testing, storage, distribution, or data integrity as necessary to ensure compliance with contract requirements.

Upon approval by CDC, RISER reagents that meet all defined quality requirements shall be made available to registered users via a secure, contractor-managed RISER website. This website must remain fully integrated with CDC’s Customer Relationship Management (CRM) system to enable order submission, track logistics, and generate required reporting. The contractor shall make all distribution-related data, including reagent-level material and shipping costs, delivery metrics, and associated customer service resolutions, available to CDC in accordance with contract-defined data delivery formats and schedules. This data shall be maintained in audit-ready systems with secure user access and formatted for regular ingestion by CDC’s CRM and analytics platforms.

To support end-to-end surveillance and public health response, the contractor shall also enable secure, real-time ingestion of laboratory-generated data from RISER registrants and surveillance partners. This includes the ability to receive genomic sequencing files, assay performance results (e.g., proficiency testing data), and post-distribution reagent validation outputs. These data shall be securely processed, logged, and made accessible to CDC programs for analysis, regulatory evaluation, or outbreak response coordination. The contractor shall establish Application Programming Interface (APIs) and/or secure web upload mechanisms for real-time submission and shall support metadata tagging, system integration, and audit trails in accordance with CDC-defined formats.

The government retains the authority to reallocate surge responsibilities between contractors when surge capacity limits are reached to ensure continuity of RISER operations during declared emergencies.

The period of performance for the base and each option period is defined in Section ( ). These periods are of varying lengths to meet programmatic and operational requirements and will be evaluated and priced at the time of award in accordance with FAR 17.207.

Contract Structure:

This contract is structured as a hybrid Indefinite Delivery/Indefinite Quantity (IDIQ) to provide the flexibility necessary to meet CDC’s evolving operational needs. Task orders under this contract may include:

· Firm-Fixed-Price (FFP) task orders for predictable, routine functions such as warehousing, inventory tracking, website operation, customer service, standard reporting, and procurement of a limited cache of ancillary reagents;

· Cost-Plus-Incentive-Fee (CPIF) task orders for complex, surge-related, or technically advanced tasks, including high-priority pathogen production, rapid assay development, and surge activities associated with emergency responses, where performance outcomes such as delivery time, efficiency, or quality will be incentivized;

Award-term incentives are optional government-issued extensions or pricing benefits tied to exceptional contractor performance. Incentives may be offered based on:

· Responsiveness during public health emergencies;

· Efficient surge activation and inventory management;

· Quality control compliance and first-pass rates;

· Cross-domain coordination and minimized transition risks.

· Time-and-Materials (T&M) task orders for urgent labor-based activities, particularly in response scenarios where scope and deliverables are not yet fully defined;

· Optional award-term incentives for outstanding contractor performance in areas such as surge responsiveness, cost management, operational continuity, and mission alignment.

Award‑term incentives will be applied through a formal annual performance review process led by the Contracting Officer (CO), Contracting Officer’s Representative (COR), and Subject Matter Experts (SMEs). Contractors will be evaluated against specific Key Performance Indicators (KPIs) (Appendix D – Key Performance Indicators) established in this Statement of Work, including but not limited to:

· ≥95% of orders shipped within CDC‑mandated timelines;

· ≥98% first‑pass Quality Control (QC) pass rates;

· Demonstrated surge activation within 10 business days of government notice;

· ≥99.95% availability for RISER IT systems;

· Timely and complete reporting (Weekly, Monthly, and Annual Reports) with <2% material error rate;

· Documented participation in cross‑Domain coordination activities (e.g., PMRs, Interface Control Documents [ICDs] updates, emergency exercises).

Annual reviews will score contractor performance on each KPI using a government‑approved scoring rubric. Incentives, which may include award‑term extensions or pricing benefits, will be granted to contractors achieving an overall performance rating of ‘Excellent’ or higher across at least 90% of the KPIs. The government reserves the right to withhold incentives if significant deficiencies are observed or if corrective actions remain unresolved. Repeated temperature excursions, storage failures, or other material breaches attributable to contractor negligence or non-compliance may result in reductions to performance-based payments, disqualification from award-term incentives, or other contractual remedies as determined by the government.

IV. DOMAIN-BASED PERFORMANCE AREAS - OVERVIEW

Offerors may propose for one or more Domains listed below. Offerors proposing for multiple Domains must demonstrate distinct capabilities, cost structures, and organizational segregation as required. CDC reserves the right to award Domains to combined or separate contractors. Submissions must include:

1. A complete technical proposal and cost proposal per Domain proposed;

2. Acknowledgement of any interdependencies or shared infrastructure between Domains proposed; and;

3. Affirmation of ability to integrate with other awardees should partial award occur.

Offerors proposing on multiple Domains must identify any shared infrastructure (e.g., facilities, data centers, personnel, logistics systems) across their submissions. Proposals must explain how infrastructure will be integrated to avoid duplicative costs and ensure operational efficiency. The government reserves the right to adjust or disallow overhead charges if shared resources are not clearly justified or if they considered duplicative charges. Note that each awardee is expected to designate a coordination liaison and participate in weekly integration meetings to ensure cross-Domain alignment and prevent gaps.

To ensure seamless coordination across awarded Domains, the CDC reserves the right to conduct integration reviews prior to task order execution and may designate a centralized Program Integrator to support inter-domain continuity and reduce transition risk.

Independently and not as an agent of the government, the contractor shall provide all management, labor, facilities, materials, supplies, and equipment necessary to operate and maintain the “Resources for Improvement of Surveillance and Emergency Response (RISER)” as set forth below. Each Domain (A–D) shall include Optional Contract Line-Item Numbers (CLINs) to enable activation of surge task orders in accordance with the Surge Scaling Option described in this Statement of Work. These optional CLINs provide the government with flexibility to rapidly increase production, logistics, IT, or customer support capacity in response to emergency or high-priority operational needs, without modifying the baseline scope of core activities.

During government-directed surge activations or at the conclusion of the contract period, all Domain A–D contractors shall coordinate to ensure continuity of RISER operations. Each contractor is responsible for executing its respective surge and transition activities in alignment with CDC-approved plans, while maintaining real-time data synchronization, inventory visibility, and communication across Domains. Contractors shall participate in joint planning sessions, integration meetings, and transition reviews as required to support unified response, minimize operational disruption, and enable orderly handoff of materials, data, and systems to successor entities or other RISER awardees.

The scope of work includes these Domains, some of which may not be funded in all performance periods:

1. Domain A: Core Reagent Production and Catalog Management (FFP and CPIF Eligible)

a. Reagent acquisition, characterization, Quality Assurance (QA)/ Quality Control (QC);

b. Production planning, inventory, surge capability;

c. Establishing and maintaining Standard Operating Procedures (SOPs) and batch records;

d. Operating and updating the RISER reagent catalog;

e. Conduct stability testing and shelf-life assessments for all RISER reagents produced or acquired under this contract, in accordance with CDC-approved protocols and quality specifications (Appendix B). Stability testing applies to both routine catalog reagents and emergency response products, with results integrated into inventory management systems.

NOTE: 1) One vendor must own all aspects of SOPs, QA/QC, and production flow to ensure accountability; 2) Domain A shall focus exclusively on reagent manufacturing and catalog management. Storage, inventory warehousing and shipping responsibilities shall reside under Domain B to ensure modularity and cost containment.

Coordination with Domain B:

All activities related to reagent storage, bulk inventory warehousing, and outbound shipping shall be performed under Domain B. The Domain A contractor shall ensure completed reagents, along with associated Certificates of Analysis (COAs) and documentation, are transferred to Domain B facilities in accordance with CDC-approved timelines and quality protocols. Coordination shall occur through documented transfer logs, shared inventory records, and participation in scheduled cross-domain meetings.

2. Domain B: Facility Operations and Logistics (FFP Eligible)

a. Facility management, Select Agent registration, FDA compliance;

b. Climate-controlled storage, equipment, backup systems;

c. Domestic/international shipping logistics;

d. Compliance with International Air Transport Association/International Civil Aviation Organization Dangerous Goods Regulations (IATA) and National/International regulatory shipping requirements;

e. Management of the emergency ancillary cache.

NOTE: 1) This Domain ensures physical infrastructure and cold-chain resilience. Procurement of ancillary reagents is not a core contract requirement and may only be exercised by the government through a separately issued task order. Offerors shall not assume procurement of ancillary reagents as part of baseline technical or cost proposals. If such a task order is exercised, any associated storage or distribution activities will be performed only in accordance with the scope and terms of that task order. Core production, storage, and shipping of CDC-supplied reagents do not depend on activation of the ancillary procurement task; 2) This Domain supports repository functions including physical storage, inventory control, and shipment execution, but not manufacturing or catalog oversight. Contractors proposing on this domain must coordinate with Domain A manufacturers to ensure real-time material handoff and traceability. In addition, contractors shall coordinate with Domain C to ensure that all distribution, inventory, and material handoff data are captured within the integrated data systems to support decision-making, auditability, and reporting requirements across CDC programs.

Coordination with Domain A:

Domain B contractors shall receive finished reagents from Domain A in accordance with CDC timelines and shall manage all subsequent storage, inventory control, packaging, and distribution. The Domain B contractor shall confirm receipt, document storage conditions, and report any discrepancies or quality concerns back to the Domain A contractor and CDC within 24 hours.

3. Domain C: Information Technology (IT) and Data Systems (T&M or FFP Eligible)

a. RISER website hosting, support and integration with CDC CRM (Microsoft Dynamics 365 or comparable CDC-approved system);

b. Cybersecurity, 508 compliance, real-time messaging;

c. Reagent status syncing, real-time data transmission or batched data transmissions (e.g., XML data feeds), IT modernization projects;

d. Development of secure data upload and validation pipelines that allow RISER users to submit surveillance results, sequencing files, and other critical data to CDC in real-time via authenticated user interfaces or APIs;

e. Serve as primary lead for Enterprise Performance Life Cycle (EPLC) compliance and reporting across all RISER IT systems.

NOTE: 1) This Domain is discrete and modular; can be bid separately by IT firms. Offerors proposing only on Domain C must demonstrate technical capability to integrate in real-time with external RISER awardees and government systems. Proposals must include a description of planned interface tools, coordination protocols, and past performance handling external API or secure data feed connections; 2) Support for the RISER website and CDC CRM shall be combined under this domain to maximize system integration and minimize interface risk. For the purposes of this contract, CDC’s current CRM, which is a Microsoft Dynamics 365 platform, is considered part of the CDC CRM ecosystem and thus terms may be used interchangeably throughout the document. References to CRM in this Statement of Work (SOW) may include Dynamics functionality unless otherwise stated. Offerors are encouraged to demonstrate capability to manage both components as a unified service, ensuring uninterrupted data flow and system compatibility. Orders must be submitted through the RISER website, with all order, registrant, and cost data securely ingested into the CRM back-end for processing, reconciliation, and reporting.

Domain C shall serve as the designated lead for RISER-wide IT system interoperability, including all secure data pipelines, API integration, and user authentication infrastructure. While other Domains may interact with these systems, Domain C shall be the primary point of accountability for functionality, system uptime, and security compliance.

All contractor-managed RISER IT systems, including the website, CRM, and inventory management platforms, shall maintain a minimum operational availability of ≥99.95% (excluding scheduled maintenance). This requirement aligns with the systems’ FISMA Moderate designation and the availability criteria for Moderate-impact systems defined in FIPS 199. Contractors must implement redundancy, continuous monitoring, and failover mechanisms to ensure continuity of operations and minimize disruptions to public health response activities.

The RISER website and associated data systems shall support secure, role-based uploads of laboratory and field-generated surveillance data from domestic and international partners. This includes, but is not limited to, genomic sequencing files, proficiency testing results, field investigation datasets, and other surveillance outputs tied to RISER reagents or CDC-directed activities

All custom‑developed code, configurations, and scripts for RISER IT systems (including the website, CRM, and inventory management tools) shall be maintained in a CDC‑approved source code repository (e.g., GitHub Enterprise or other CDC‑designated secure platform). The contractor shall provide the COR and designated CDC staff with continuous read‑only access to these repositories, including full version histories. Similarly, the contractor shall provide real‑time, role‑based access for the COR and designated CDC staff to any bug tracking or change control systems used for managing RISER IT development activities.

All contractor‑managed RISER IT systems—including the website, CRM, and inventory management platforms—shall maintain daily backups with secure off‑site storage for rapid disaster recovery. Backups must be retained for at least 90 days on a rolling basis, with one full monthly archive preserved for a minimum of 12 months. Critical data (e.g., configuration files, registrant data, transaction logs, Interface Control Documents) shall be archived for the life of the contract and provided to CDC or a successor contractor during transition in accordance with the Data Governance Plan.

Data Governance Plan:

The contractor shall develop and maintain a comprehensive Data Governance Plan, submitted to the COR for approval within 90 calendar days of contract award and updated annually or upon CDC request. This plan shall explicitly integrate and reference the Data Modernization Initiative (DMI) Alignment Addendum (Deliverable #62), ensuring that all metadata standards, data-exchange schemas, and interoperability requirements described in the Addendum are incorporated within the Data Governance Plan and maintained in synchronization with its annual updates.

The plan shall include:

a. Data architecture maps showing system components, interfaces, and data flows;

b. Access control measures, including role-based permissions and authentication protocols;

c. Designation of primary and backup data storage sites;

d. Backup, archival, and disaster recovery processes;

e. Digital transition protocols for data transfer to CDC or a successor contractor at contract closeout.

The contractor shall implement all measures in accordance with CDC security policies and applicable federal regulations.

The contractor shall:

a. Coordinate with CDC’s Data Governance Board and DMI program staff to ensure RISER data structures are interoperable with enterprise data exchange platforms;

b. Implement metadata standards supporting pathogen classification, geolocation, and temporal tagging for all RISER data submissions;

c. Maintain documentation of data lineage, version control, and provenance for all datasets transmitted to CDC;

d. Participate in DMI-led reviews and provide technical documentation necessary for integration of RISER data into CDC’s enterprise analytics environments.

Updates to the RISER Data Governance Plan shall include a section titled “DMI Compliance and Integration” outlining how RISER data flows, APIs, and data models conform to CDC’s modernization architecture. See also Deliverables #50 (Data Governance Plan) for integration of compliance elements and joint update requirements.

4. Domain D: Customer Service and Stakeholder Support (FFP Eligible)

a. Operate the RISER customer-service hotline, email, and ticketing system; triage and route all inquiries related to registration, ordering, shipment status, and website access;

b. Perform first-line vetting of new laboratory registrations submitted through the RISER website for completeness, legitimacy, and restricted-party screening, and forward vetted records to CDC for approval;

c. Coordinate with Domain B to collect and verify shipping permits, customs documentation, and delivery confirmations prior to and after shipment;

d. Provide website and portal user support in coordination with Domain C, including account access, upload troubleshooting, and dashboard viewing issues;

e. Maintain documentation of all customer interactions and complaint records within the CDC CRM to ensure full traceability across Domains.

NOTE: This Domain may be awarded separately or bundled with Domain B. The contractor shall maintain a formal complaint-handling process compliant with FDA 21 CFR Part 820 and ISO 13485. All customer complaints or critical communications shall be documented in the CDC CRM and reported to the CDC COR and QA representatives within twenty-four (24) business hours of receipt. Complaint logs and resolutions shall be maintained in audit-ready format and made available to CDC upon request. Domain D personnel are embedded within the workflows of Domains A–C to provide coordinated customer communication while those Domains retain operational execution authority.

Standard IT Integration Clause (Applicable to all Domains):

All IT-related tasks-including order processing, CRM synchronization, website registration, reagent status updates, and external data submission-shall follow interface control protocols established by Domain C. Any system integration must be coordinated through Domain C to maintain cybersecurity, version control, and auditability. Offerors shall reference this clause in lieu of restating IT dependencies within individual domain proposals.

Cross-Domain Surge Responsibilities (Applicable to Domains A-D):

The government reserves the right to issue optional task orders under any Domain (A–D) to address emergency surge scaling, continuity of operations, or transition activities. When activated, the contractor shall demonstrate the ability to scale its assigned functions: production, logistics, information systems, or customer service, by 25 to 75 percent above baseline capacity within ten (10) business days of written direction from the Contracting Officer. Each contractor shall maintain contingency procedures sufficient to enable rapid surge activation, including staffing plans, facility readiness, and data-system scalability.

Public–Private Partnership and Rapid Vendor Onboarding:

To enhance CDC’s national preparedness and ensure uninterrupted reagent supply and data continuity during public health emergencies, the contractor shall maintain capabilities to establish and support public–private partnerships under the RISER program. The contractor(s) shall:

· Maintain and implement a Rapid Vendor Onboarding Protocol approved by CDC that enables qualification of new subcontractors, manufacturers, couriers, or technology partners within ten (10) business days of CDC direction, ensuring full compliance with applicable biosafety, QA/QC, cybersecurity, and data-governance requirements;

· Maintain a pre-vetted library of templates for Non-Disclosure Agreements (NDAs), Data-Sharing and Confidentiality Agreements, and Quality Assurance Addenda to accelerate onboarding during emergency activations;

· Provide CDC with a current list of potential industry, academic, and logistics partners capable of supporting surge production, reagent packaging, IT integration, or international distribution;

· Participate in joint exercises or CDC-led workshops, when requested, to validate readiness for partner onboarding and information-sharing;

· Document all onboarding actions, vetting results, and partner approvals in the RISER CRM or designated CDC system of record to ensure auditability;

· Ensure that all private-sector partners engaged under RISER operate under the same data-protection, confidentiality, and regulatory compliance standards required of the prime contractor.

The Rapid Vendor Onboarding Protocol shall be referenced in the contractor’s QA/QC Plan and Transition Plan and cross-linked to the Data Governance Plan to ensure consistency of quality, security, and accountability across all partner engagements. The Rapid Vendor Onboarding Protocol (Deliverable #21) shall document the contractor’s process for qualifying new partners and shall be updated annually or whenever partner-vetting criteria or regulatory requirements change

Performance Measurement During Surge:

Contractor performance under surge activation will be evaluated against the Key Performance Indicators (KPIs) identified in Appendix D – Key Performance Indicators. At a minimum, CDC will assess:

· Timeliness of surge activation: demonstrated scale-up of 25–75% within ten (10) business days of written direction;

· RISER IT availability: website/CRM/inventory systems sustain ≥99.95% availability during surge;

· Logistics timeliness: orders shipped within CDC-mandated timelines (target ≥95%); and

· Quality yield: first-pass QC rates ≥98% where applicable to surge production. CDC may incorporate these results into award-term incentive evaluations.

Supply Chain Risk Management and Critical Material Substitution (Domain A Lead; Applicable to Domains A-B):

To ensure uninterrupted RISER operations and national readiness during public-health emergencies, the Domain A contractor shall establish and maintain a comprehensive Supply Chain Risk Management (SCRM) Plan integrated across Domains. The plan shall identify critical materials, evaluate supply-chain vulnerabilities, and define validated substitution strategies that preserve reagent quality, regulatory compliance, and delivery timelines. The contractor(s) shall:

· Maintain real-time visibility of all critical inputs and suppliers supporting reagent production, storage, and shipment;

· Identify single-source or high-risk components and establish at least one qualified alternate supplier or validated substitute for each where feasible;

· Develop documented substitution and equivalency protocols consistent with CDC’s Quality Specifications (Appendix B) and FDA 21 CFR 820 requirements;

· Coordinate with CDC prior to implementing any critical-material substitution, providing supporting validation data, Certificates of Analysis, and impact assessments;

· Incorporate SCRM monitoring and substitution status into the Monthly Technical Report, including supply-chain disruptions, mitigation actions, and substitutions implemented;

· Update the SCRM Plan annually, or upon major supplier, geopolitical, or regulatory changes, and provide it to the COR for review and approval.

Domain B contractor shall support execution of the SCRM Plan within their scope of responsibility, including storage, inventory management, and shipment-related risk mitigation, and shall coordinate with the Domain A contractor and CDC on identified risks and substitution actions. The SCRM Plan shall align with CDC’s enterprise continuity and domestic manufacturing initiatives, ensuring consistency with HHS and federal directives on supply-chain security.

Transition Responsibilities (Applicable to Domains A-D):

All Domain (A–D) contractors shall also support transition and continuity activities at the conclusion of this contract or any subsequent re-competition. Contractors shall prepare and maintain Domain-specific Partial Transition Plans describing how technical data, inventory, documentation, and government-furnished property will be securely transferred to a successor contractor or to the government. Each awardee shall participate in joint transition meetings and coordinate with CDC’s designated Integration Lead to ensure seamless hand-off of responsibilities.

Summary of Contract Tasks by Domain and Classification

Domain B: Facility Operations and Logistics;

Domain C: IT and Data Systems;

Domain D: Customer Service and Stakeholder Support Optional

Domain B: Facility Operations and Logistics;

Domain C: IT and Data Systems;

Domain D: Customer Service and Stakeholder Support Optional

*Optional objectives shall only be exercised by the government through the issuance of a distinct task order with a defined period of performance and deliverables, and cost ceiling. Optional tasks shall not be presumed as part of baseline scope.

TASKS TO BE PERFORMED:

The contractor shall complete the tasks within Domains outlined below in accordance with any applicable delivery dates reflected in Section XV - Deliverables / Reporting Schedule:

Offerors may propose on one or more Domains; however, award decisions may be made per Domain based on technical merit, cost realism, and performance risk.

All offerors are subject to a pre-award on-site audit by CDC or its designated representatives to verify compliance with FDA current Good Manufacturing Practice (cGMP) requirements (21 CFR Part 820), ISO 9001/13485 standards, and other applicable regulatory obligations. This audit is part of CDC’s supplier qualification process and must be successfully completed before the contract award. Offerors shall provide access to relevant facilities, quality documentation, and personnel during this pre-award audit.

Domain A: Core Reagent Production and Catalog Management

· Produce, acquire, characterize, and manage RISER reagents in alignment with CDC surveillance priorities;

· Maintain quality systems, including SOPs, QA/QC programs, stability testing, and surge readiness;

Support continuity of operations, including surge response and transition activities, as directed by CDC.

Domain B: Facility Operations and Logistics

· Provide and operate compliant facilities and infrastructure to support secure storage and distribution of RISER reagents;

· Manage domestic and international logistics, regulatory compliance, and cold-chain integrity;

· Support surge operations and transition activities within the Domain B scope.

Domain C: IT and Data Systems

· Operate and maintain RISER IT systems, including the website, data-exchange interfaces, and integration with CDC systems;

· Ensure system security, availability, and scalability to support routine operations and emergency response;

· Support continuity, surge operations, and transition of RISER IT systems as required.

Domain D: Customer Service and Stakeholder Support

· Manage laboratory registration and User Agreement (Appendix E) processing, including first-line vetting of applications submitted through the RISER website for completeness, authorized signatory, and restricted-party screening prior to CDC review and approval;

· Manage customer communications across all RISER Domains;

· Operate the RISER Help Desk during standard business hours (Monday-Friday, 8:00 a.m.–5:00 p.m. Eastern Standard Time (EST), fixed year-round regardless of daylight-savings adjustments) with the capability to escalate urgent issues outside these hours during public-health emergencies or elevated operational tempo;

· Maintain customer-service operations, complaint handling, and transition support in coordination with other Domains.

Time Calculation Standard Unless expressly stated otherwise, all time-based requirements under this contract shall be measured in business days, defined as Monday through Friday, excluding Federal holidays.

Timeframes associated with declared public health emergencies, surge activation, or urgent public health protection measures shall be measured in calendar hours or immediate response standards as specified in the applicable task or written direction from the Government.

V. DOMAIN-BASED TECHNICAL TASK DETAILS

This section provides a summary of the technical tasks associated with Domains [A–E]. Offerors are required to consult the task detailed information requirements in (Appendix C - Detailed Task Descriptions (Tasks 1-11)), for full descriptions of task-level deliverables, SOP expectations, performance standards, reporting schedules, and regulatory compliance requirements applicable to these Domains. All proposal responses must demonstrate clear understanding of, and capacity to meet, the specifications and benchmarks outlined in the referenced appendix.

In the event of multi-vendor awards across separate Domains, each contractor shall identify a dedicated liaison responsible for inter-domain coordination. Weekly integration checkpoints shall be held among awardees to reconcile task dependencies, especially between reagent production (Domain A), logistics (Domain B), and IT systems (Domain C). For clarity in multi-award scenarios, each task below uses the phrasing “Domain [X] contractor” to reflect the lead performer responsible for that Domain. Where multiple domains intersect, coordination requirements are noted in each task description.

Domain A: Core Reagent Production and Catalog Management

Task A.1: SOP Development Domain A contractor shall develop SOPs for all technical functions under Domain A, including reagent receipt, handling, QA/QC, and SOP preparation related to shipping and inventory management, even though operational execution of those functions resides under Domain B. SOPs must comply with CDC quality system protocols and be approved by the COR before implementation. The government may provide examples of existing CDC-approved workflows, algorithms, templates, or reference materials, as available, to inform SOP structure and sequencing. Such materials are provided for reference only and do not relieve the contractor of responsibility for developing, validating, and maintaining contract-specific SOPs. If SOPs are transferred from CDC-developed methods, the Domain A contractor may receive assay training from CDC staff to support proper implementation.

The first set of draft SOPs must be submitted within 60 calendar days of contract award, as described in the deliverables schedule. SOP development shall continue on a rolling basis, aligned with task-specific timelines approved by the COR.

SOPs must cover all activities performed directly by the Domain A contractor or its subcontractors. Where appropriate, SOPs shall also address coordination and interface points with other Domains, such as procedures for shipment and storage (Domain B), registration workflows (Domain D), IT/data handling dependencies (Domain C), and transition continuity requirements (across all Domains) to ensure cross-Domain alignment and operational consistency across the RISER program.

The Domain A contractor shall also establish and maintain a centralized RISER SOP compendium that serves as the authoritative repository for all SOPs developed under this contract, including SOPs applicable to Domains A–D. The compendium shall reflect current COR-approved versions, identify superseded SOPs, and support audit readiness.

Task A.2: Reagent Production and QC Domain A contractor shall acquire or produce RISER reagents listed in Appendix A – Deliverables, using qualified facilities and staff. All lots shall be tested per the specifications in Appendix B – Quality Specifications. QA and QC must be independent of production to allow rejection of non-conforming materials.

QA/QC Plan:

The contractor shall develop and maintain a comprehensive QA/QC Plan, submitted to the COR within 60 calendar days of contract award and updated annually or upon CDC request. The plan shall cover:

· QA/QC processes for reagent production, validation, and catalog management;

· Batch record documentation requirements, including retention periods and accessibility for audit;

· Reagent rejection criteria and procedures for disposition of nonconforming materials;

· Procedures for recording, investigating, and resolving customer complaints;

· Roles and responsibilities for QA/QC oversight.

Task A.3: Catalog Operations and Surge Planning Domain A contractor shall maintain the RISER reagent catalog, including a virtual inventory tracker for display and planning purposes; physical warehousing and distribution records shall be maintained under Domain B. The virtual inventory tracker must support real-time display of reagent status, historical batch data, and CDC-program level visibility. The system must be auditable, regularly backed up, and interoperable with CDC data platforms. Inventory states may include: ‘seed stock’, ‘in production’, ‘on quality hold’, ‘available for distribution’, or ‘retired’. Terminology shall follow CDC catalog conventions.

The RISER catalog system shall align with ICDs maintained by Domain C. Any data structure changes, catalog schema updates, or API development must be coordinated with the Domain C technical lead and approved by the COR to ensure interoperability across RISER platforms. Domain A shall provide catalog updates in formats specified by Domain C to enable consistent integration with CDC’s CRM tools.

Domain A contractor shall develop an acquisition and contingency plan for surge capacity up to 75% above baseline. A comprehensive production and surge capacity plan must be submitted within 150 calendar days of contract award and updated annually or as directed by CDC.

Domain A contractor shall record and transmit per-batch production costs (labor, materials) to support CDC financial reconciliation and cost-effectiveness analysis. Shipment history, shipment-level cost data, and delivery confirmation records shall be generated and maintained by Domain B. Domain A shall coordinate with Domain B and Domain C to ensure that lot-level production data, shipment history, cost metadata, and catalog availability remain synchronized across RISER systems to preserve end-to-end traceability and data integrity.

Task A.4: Reagent Stability and Shelf-Life Management Program Domain A contractor shall perform all stability testing and shelf-life management for RISER reagents in accordance with CDC-approved protocols and quality requirements. Prior to production (or re-manufacture) of each reagent category, CDC will determine the number of kits/vials to be reserved exclusively for stability studies and the required testing cadence (e.g., initial, 3, 6, 12, 24 months), as needed. These parameters shall be documented in a Stability Testing Plan and reflected in batch planning and inventory reservations.

The contractor shall maintain automated tracking of reagent expiration dates within the RISER inventory system and shall generate monthly notifications to the CDC COR and SMEs identifying reagents scheduled to reach expiry within 60 days. For each reagent lot approaching expiry, the contractor shall request written CDC direction regarding one of the following actions: (a) extension of the expiration date based on updated stability data; (b) redistribution of repurposing for training or non-critical use; (c) shipping of all expired material back to CDC; or (d) authorization for destruction and documentation of disposal. No reagent shall be destroyed or have its expiration date extended without written CDC approval.

Optional Task A.5: Surge Support Upon CDC direction, the government may activate an optional task requiring the Domain A contractor to scale reagent-production, QA/QC, and catalog management activities by 25–75 percent above baseline within ten (10) business days.

Performance during this surge activation will be measured against the KPIs in Appendix D, including timely activation within ten (10) business days, domain-relevant on-time service levels, and (as applicable) system availability of ≥99.95% and/or ≥98% first-pass QC.

Optional Task A.6: Transition Support Upon contract completion, the contractor shall support orderly transfer of production data, batch records, QA documentation, and related technical materials to a successor contractor or to CDC, as directed.

Domain A contractor shall adopt standardized formats for vialing, labeling, product inserts, and Certificates of Analysis across all reagent’s classes unless technical justification for exception is provided.