Draft SOW Sources Sought.pdf

AWARD_ HHS and OS Digital Accessibility Program Services

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES/SUPPLIES

The OS/OCIO’s office has a requirement to procure Section 508 services.

B.2 TYPE OF CONTRACT

The contractor shall perform the effort required by this task order on Firm Fixed Price (FFP) type basis. The work shall be performed in accordance with all sections of this task order and the contractor’s schedule contract.

B.3 SEVERABLE SERVICES

The FFP services specified in each contract line item (CLIN) have been determined to be severable. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

B.4 CONSIDERATION AND PAYMENT

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN (if exercised). If the options are exercised, funding will be obligated by modification to the contract. The base period and option periods are priced as follows:

Firm Fixed Price In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN (if exercised).

If the options/optional tasks are exercised, funding will be obligated by modification to the contract.

CORE TASKS 1-5

CLINs

Firm- Fixed Price (FFP)

Total (NTE)

CLIN 1: BASE YR

September 30, 2026 through September 29, 2027

• Task 1-Program Management

• Task 2- Web Crawler Administration

• Task 3- Manage Digital Accessibility Solution Center

• Task 4- Data Analytics and Process Improvement

• Task 5- Remediation and Embedded SME

CLIN 2: OPT YR 1

September 30, 2027 through September 29, 2028

• Task 1-Program Management

• Task 2- Web Crawler Administration

• Task 3- Manage Digital Accessibility Solution Center

CLIN 3: OPT YR 2

September 30, 2028 through September 29, 2029

• Task 1-Program Management

• Task 2- Web Crawler Administration

• Task 3- Manage Digital Accessibility Solution Center

*CLIN 1: Base Year: Core Tasks 1-5 Section B - Pricing Table

Core Objectives 1-3 - Firm Fixed Price Project Position/Role GSA Labor Category

Core Task 1 - Program Management;

Core Task 2 - WebCrawler Administration;

Core Task 3 - Digital Accessibility Solution Center;

Core Task 4 - Data Analytics & Process Improvement;

Core Task 5 - Remediation & Embedded Solutions

Solutions Architect SME III Program Manager Program Manager III Data Analyst Consultant III 508 Tester - Senior Systems Developer II 508 Tester - Intermediate Systems Developer II Program Analyst Consultant III

CLIN 1001: Base Year Optional Task 1: OPDIV

LCAT Blended Hours

Blended Rate

Total

Section 508 – Senior optional

Program Analyst II optional

CLIN 1002: Base Year Optional Task 5: HHS Digital Accessibility Center of Excellence (CoE) Customer Facing Portal

LCAT Hours Rate Total SharePoint Architect

Section 508 - Intermediate

*CLIN 2: Option Year 1: Core Tasks 1-5

Core Task 2 - WebCrawler Administration;

Core Task 3 - Digital Accessibility Solution Center;

Core Task 4 - Data Analytics & Process Improvement;

Core Task 5 - Remediation & Embedded Solutions

Solutions Architect SME III Program Manager Program Manager III Data Analyst Consultant III 508 Tester - Senior Systems Developer II

The following CLINs for the Optional Tasks will be created separately, if exercised:

CLIN 2001: Option Year 1 Optional Task 1:

LCAT Blended Hours

Blended Rate

Total

Section 508 - Senior

Program Analyst II

CLIN 1002: Option Year 1 Optional Task 5: HHS Digital Accessibility Center of Excellence (CoE) Customer Facing Portal

LCAT Hours Rate Total

*CLIN 3: Option Year 2: Core Tasks 1-5

Core Task 2 - WebCrawler Administration;

Core Task 3 - Digital Accessibility Solution Center;

Core Task 4 - Data Analytics & Process Improvement;

Core Task 5 - Remediation & Embedded Solutions

Solutions Architect SME III Program Manager Program Manager III Data Analyst Consultant III 508 Tester - Senior Systems Developer II

The following CLINs for the Optional Tasks will be created separately, if exercised:

CLIN 3001: Option Year 2 Optional Task 1: OPDIV Task LCAT Blended

Hours Blended

Rate Total

Section 508 - Senior

Program Analyst II

CLIN 2002: Option Year 2 Optional Task 5: HHS Digital Accessibility Center of Excellence (CoE) Customer Facing Portal

LCAT Hours Rate Total

The NTE Ceiling Amount represents the maximum amount of the Government’s liability. THE

CONTRACTOR EXCEEDS THE CEILING AT ITS OWN RISK.

B.4 CEILING PRICE

The hours and total price per labor category are for budgeting purposes only. The number of hours actually used for each category may exceed or be less than the estimate by category as long as the ceiling price for the CLIN is not exceeded. The ceiling for each CLIN is identified in Section B. The Government shall not be obligated to pay any amount in excess of this ceiling price nor is the Contractor obligated to continue performance if to do so would exceed this ceiling price. In the event that the Government chooses to exercise optional CLINS, unused funds from a previous CLIN may not be used to fund any services taking place in a subsequent CLIN. The ceiling price may be modified by the Government if it is determined that the estimated hours or estimated materials are insufficient for the work required.

B.5 ADDITIONS AND CHANGES TO LABOR CATEGORIES

It may be necessary to add or change labor categories during performance of this contract in order to carry out the services described in Section C. If new labor categories are added, or existing labor categories revised, the parties will negotiate the labor category(ies) prior to the incorporation into the contract. Any new labor rate proposed, must be in accordance with the IDIQ Contract, and if necessary, will be evaluated for reasonableness in accordance with FAR 15.4.

SECTION C - Description/Specifications/Statement of Work

The U.S. Department of Health and Human Services (HHS), headquartered in Washington, D.C., is required to adhere to the section 508 of the Rehabilitation Act to eliminate barriers to information communications and technology (ICT). Section 508 of the Rehabilitation Act, applies when federal agencies develop, procure, maintain, or use information and communications technology. They must ensure that federal employees with disabilities have access to ICT that is comparable to the access enjoyed by federal employees without disabilities unless doing so would impose an undue burden on the agency. The statute also makes the same requirement with respect to members of the public with disabilities seeking information or services. HHS must ensure that digital content is “perceivable, operable, understandable, and robust.” HHS’ Office of the Chief Information Officer (OCIO) is responsible for providing services to the Operating and Staff Divisions (Op/StaffDivs), which comprise HHS. The HHS Section 508 Operations Board mandated all ICT conform to the most current WCAG AA success criteria. The overall objective is for HHS/ASA/OCIO to obtain services to support the HHS and OS Section 508 Program.

The following legislative mandates, instructions, and policies form the basis from which HHS works to remain compliant with requirements for digital products and services.

1. Overarching Policies

1.1. Connected Government Act

1.2. OMB M-17-06, Policies for Federal Agency Public Websites and Digital Services

1.3. OMB Circular A-130

1.4. Digital Government Strategy (May 2012)

1.5. E-Government Act of 2002

1.6. Accessibility/Section 508

2. Accessibility for Teams

2.1. 18F Accessibility Guide

2.2. Section 508 Law and Technical Standards

2.3. Web Content Accessibility Guidelines (WCAG)

2.4. WCAG Quick Reference and WCAG Web tutorials

2.5. Technology Accessibility Playbook

2.6. Federal CIO Council Accessibility Best Practices

2.7. Governmentwide Section 508 Strategic Plan (2013)

C.1 Core TASKS 1-5 (Base Year CLIN 1, Option Year 1 CLIN 2, Option Year 2 CLIN 3)

The Contractor must provide solutions to meet the following objectives. In addition, it is expected the contractor will matrix the resources to prevent single point of failure. The contractor must collaborate with necessary stakeholders to ensure the best solution is recommended. Furthermore, the contractor must escalate issues in a timely manner to avoid delays in delivery. The contractor must provide parameters for federal review time to ensure deliverables are met on time. The federal staff must provide feedback in a reasonable timeframe to optimize contractor time and resources.

How the contractor resources the firm-fixed price requirements is determined by the contractor’s PM, if the minimum requirements for the objectives are met and delivered on-time and of high quality. The following activities shall be performed by the team as a whole and should be rotated between team members on a need basis.

• Action item tracking

• Stakeholder tracker maintenance

• Records management administration

• WBS maintenance

• Backlog administration

• SharePoint tracker updates

• Routine KPI data collection and reporting

• User account provisioning and deactivation

• License issuance tracking

• User onboarding

• Role-based user training

• User technical support

• Customer inquiries and ticket response

• User guide development

• Accessibility validation of scan findings

• Detailed calibration execution

• Helpdesk operations

• Routine access management administration

C.1.1 Core Task 1: Program Management

The HHS and OS Digital Accessibility Programs support a diverse set of stakeholders, initiatives, and service offerings. The purpose of Program Management is to provide strategic oversight, governance, performance monitoring, stakeholder engagement, and risk management to ensure successful contract execution and delivery of program objectives.

The Contractor shall provide a part-time Program Manager responsible for contract oversight and coordination activities. Administrative support functions shall be performed by supporting contractor staff.

Program Management Requirements:

The Contractor shall provide

Program Governance

• Develop and maintain a Project Management Plan (PMP) that governs execution, monitoring, and control of contract activities.

• Develop and maintain Risk Management, Communications Management, Scope Management, Change Management, and Quality Management Plans.

• Monitor contract performance and ensure alignment with HHS Digital Accessibility Program objectives.

• Ensure deliverables are completed on schedule and meet quality expectations.

Stakeholder Engagement

• Coordinate with Government stakeholders regarding priorities, risks, dependencies, and strategic objectives.

Facilitate executive-level communications and decision-making activities.

Escalate program risks and issues requiring Government attention.

Performance Monitoring

• Collaborate with the Government to establish Key Performance Indicators (KPIs).

• Monitor performance against approved KPIs.

• Review program trends and recommend corrective actions where necessary.

• Conduct Quarterly Program Management Reviews (PMRs) or Quarterly Business

Reviews (QBRs).

Resource Management

• Ensure contractor resources are appropriately assigned to contract activities.

• Coordinate resource allocation to prevent single points of failure.

• Ensure workload prioritization aligns with Government priorities.

Continuous Improvement

Review program performance trends and recommend process improvements.

Identify opportunities to improve operational efficiency and service delivery.

C.1.2 Deliverables o Project Management Plan o Communications Plan o Risk Management Plan o Scope Management Plan o Change Management Plan o Quality Management Plan o KPI Dashboard and Quarterly Review o Strategic Program Roadmap o Quarterly Program Management Review Briefing

C.1.3

Additional deliverables can be provided based on the recommendations of the program management teams; however, the primary list of deliverables related to this core objective:

Deliverable Initial Due Review

Recurrence Format

Full and complete PIV paperwork for all staff

At the kick off meeting upon award

Within 2 weeks of on-boarding

Various

WBS with Backlog 1 month after award

Monthly (serves as a monthly report)

MS Project (initial) or MS Planner SharePoint Project (within 1 month after network access is granted)

Risk Register and Issue Log

1 month after award

Monthly MS Excel (initial) SharePoint Tracker (within 1 month after network access is granted)

Project Management Plan (living document)

1 month after award

Monthly MS word

HHS Communication Plan (includes stakeholder matrix)

1 months after award

Monthly MS Word

Risk Management Plan

1 month after award

Monthly

Key Performance Indicators

1 month after award

Quarterly MS Word

Change Management Plan

1 months after award

Monthly MS Word

Scope Management Plan

1 month after award

Monthly MS Word

Quality Management Plan

1 month after award

Monthly MS Word

Program Records Management File Plan

1 month after award

Annual MS Excel

Deliverable Initial Due Review Recurrence

Format

Meeting Agendas 1 business day prior to meeting

On-going MS Word

Meeting Minutes 1 week post meeting

On-going MS Word

Action Items 1 week post meeting

On-going MS Excel (initial) SharePoint Tracker (within 1 month after network access is granted)

Strategic Plan 2 months after award

On-going MS Word

Maturity Model 6 months after

On-going MS Word

C.1.4 Core Task 2: Web Crawler Administration

The Contractor shall provide parttime oversight and administration of the HHS Digital Accessibility web crawler solution to support the monitoring of website accessibility conformance across HHS internet and intranet environments.

To meet this objective, the Contractor shall:

Tool Administration

• Maintain overall administration and configuration of the web crawler platform.

• Coordinate software licensing and vendor support activities.

• Establish and maintain scan schedules for OS and approved OpDiv websites.

• Ensure crawler configurations align with HHS accessibility monitoring objectives.

Scan Management

• Oversee execution of automated accessibility scans.

• Review scan outputs for completeness and consistency.

• Coordinate scan calibration activities with accessibility testing personnel.

• Monitor crawler performance and identify opportunities for improvement.

Reporting

• Review and provide monthly accessibility scan reports.

• Identify recurring accessibility trends and provide recommendations for remediation priorities.

• Support Government leadership with summary reporting regarding website accessibility posture.

Governance and Oversight

• Maintain tool governance procedures and operational guidance.

• Coordinate with Government stakeholders regarding scan priorities and coverage.

• Escalate tool-related risks, issues, or service disruptions.

Deliverables

• Web Crawler Tool Administration Plan

• Annual Scan Schedule

• Monthly Accessibility Scan Reports

• Tool Governance Procedures

• Monthly Risk and Issue Summary

Deliverable Initial Due Recurrence Format Web crawler tool 1 month after award On-going Software License Tracker 1 month after award On-going MS Excel (initial)

SharePoint Tracker (within 1 month after network access is granted)

User Guide 1 month after award On-going Adobe PDF or online Schedule of OpDiv Scans and Calibration

1 month after award Annual MS Excel (initial) Integrated into WBS

Initial Scans 1 week after award On-going Online and MS Excel Export Progress of Calibration

1 week after award On-going MS Excel (initial) SharePoint Tracker (within 1 month after network access is granted)

Monthly Report 1 month after award On-going Online and MS Excel Export

C.1.5 Core Task 3: Manage Accessibility Solution Center

The Digital Accessibility Solution Center is the most vital service offering to customers. This service is the primary customer facing activity and is the best measurement of conformance for systems and documents. To minimally meet the requirements of this objective, the Contractor must provide ICT testing, defect reviews, and limited remediation services to OS Digital Accessibility customers. In addition to the standard services for OS customers, there is an agency need to ensure Secretary, White House, congressional reporting, FITARA, and IT Acquisition Review (ITAR) documents are remediated, and training is provided to the teams to increase their ability to develop conformant content for future iterations. This work must be prioritized and approved by the HHS or OS Digital Accessibility Program Managers and should not exceed 20 resource hours per month.

The contractor must:

• Conduct all activities associated with providing services to OS or prioritized customers

• Maintain an accurate tracker for all service requests and knowledge sessions

• Maintain an update version of the Solution Center Operations Guide

• Create technical guidance based on trends identified through service fulfillment

• Apply all approved criteria, communications templates, and processes as identified in the

Solution Center Operations Guide

• Provide evaluations back to customers within two weeks, unless approved by the HHS or

OS Digital Accessibility PMs. Note: this is excluding content that meets the immediate assign criteria. It is understood there will be times in which the Digital Accessibility Solution Center will experience a surge in requests that can vary in complexity. During these periods, it is expected there might be an impact to the two-week service level agreement (SLA). However, the HHS and OS Digital Accessibility PMs must be notified, and the delays approved.

Service Tracker 1 month after award

On-going MS Excel (initial) SharePoint Tracker (within 1 month after network access is granted)

Solution Center Operations Guide

1 month after award

On-going MS Word

Prioritized Backlog of Technical Guidance

1 month after award

On-going MS Excel (initial) Integrated into WBS

Technical Guidance 2 months after award

On-going Various

Conformance Report 1 week after award

Accompany all tested or remediated ICT

MS Excel Note: format can change based on maturity of program

Communications Templates

1 week after

On-going MS Word

C.1.6 Core Task 4: Provide Data Analytics and Process Improvement Services

For digital accessibility programs to continue maturing, it is imperative to incorporate data analytics and process improvement activities. Although the core tasks include consistent evaluation of program metrics and continuous process improvements, this optional task provides dedicated resources to assist OpDivs in their maturity. To conduct process analysis and implement improvements, the contractor must follow and accept frameworks for conducting process improvement activities. This task can be applied to individual OpDivs, or to support the entire department.

The contractor must:

• Determine the appropriate metrics required to conduct the data analytics activities

• Determine what data is available and recommend a plan to obtain any additional data required for a full analysis

• The contractor shall determine a mechanism for collecting and analyzing data from all program activities to mature the HHS Digital Accessibility Program. The contractor shall apply knowledge of data analytics and Artifical Intelligence (AI) / Machine Learning (ML) models to present factual representations and predictive insights that allow the government to make informed, data-driven decisions. This includes, but is not limited to: Developing AI-driven predictive models to identify patterns in service requests and testing results, forecasting future demand and pinpointing recurring accessibility barriers across the agency.

Identify and follow a process improvement framework

• Utilizing natural language processing (NLP) to analyze user feedback and helpdesk requests (from Core Task 3) to automatically categorize issues and recommend targeted process improvements or training interventions.

management teams; however, the primary list of deliverables related to this task:

Deliverable Initial Due Recurrence Format Data Analytics Plan 1 month after

Monthly MS Word

Process Improvement Plan

2 months after award

Monthly MS Word

C.1.7 Core Task 5: Provide ICT Remediation and Embedded SME

Provide ICT remediation (variety of formats and complexity), embedded SME support, and governance recommendations. The contractor will conduct the following activities to meet this requirement:

• Conduct intake of service requests

• Fulfill service request

• Track burn rate

Conformance Report

2 weeks after content is received or as determined by SLA

Accompany all remediated ICT

Excel

Remediated Content

As determined by SLA On-going Varies

Burn Rate Tracker

2 weeks after award On-going SharePoint and Excel

C.2 Optional Tasks

Optional tasks are executed when funding permits. Furthermore, optional tasks can be funded incrementally to meet the immediate customer needs and can be combined depending on the service request of the customer. The HHS and OS Digital Accessibility Program contractor resources must be matrixed across core objectives and optional tasks. How the contractor resources the firm-fixed price requirements is determined by the contractor’s PM, as long as the minimum requirements for the objectives are met and delivered on-time and of high quality;

however, the contractor’s PM must submit qualifications task resources to ensure the most qualified individuals are performing the requirements and minimize rework.

C.2.1 Optional Task 1: Digital Accessibility Program for OPDIVs Base Year CLIN 1001, Option Year 1 CLIN 2001, Option Year 2 CLIN 3001 Firm Fixed Price Level of Effort (LoE)

Provide ICT testing (various formats and complexity), minimal remediation, embedded SME support, and governance recommendations. The contractor will conduct the following activities to meet this requirement:

• Conduct intake of service requests

• Fulfill service request

• Track burn rate

Conformance Report

2 weeks after content is received or as determined by SLA

Accompany all remediated ICT

Excel

Remediated Content

As determined by SLA On-going Varies

Burn Rate Tracker

2 weeks after award On-going SharePoint and Excel

C.2.5 Optional Task 2: HHS Digital Accessibility Center of Excellence (CoE) Customer Facing Portal For Base and 2 OYs

The customer facing portal must use Microsoft 365, and provide customers with access to all services, tools, resources, FAQ, and service requests capabilities. In addition, the portal must link and automate all program data and produce dashboards. This optional task will be exercised as a part time clin based on availability of resources.

The contractor must:

• Implement a customer facing and administrative portal using Microsoft suite

• Implement communications regarding tools and service offerings and how to obtain them

• Engage stakeholders to continue maturing, improving, and proposing new tools and service offerings

• Develop and Host a Video Training Library. The contractor shall create and maintain a library of on-demand video training modules to be hosted on the customer-facing portal. These modules will serve as a core resource for educating HHS employees and contractors on digital accessibility best practices. The initial library shall consist of no fewer than ten (10) short-form videos (3-7 minutes each) covering high-priority topics identified in collaboration with the government, such as but not limited to : "Creating Accessible Word Documents," "Making PowerPoint Presentations 508 Compliant," "Understanding Alt Text for Images," and "Introduction to WCAG Principles." All videos must be fully Section 508 compliant, including, at a minimum, accurate closed captions and a complete, time-stamped transcript. Videos shall be delivered in a standard web-friendly format (e.g., MP4) and integrated seamlessly into the CoE portal

• Implement AI-Powered Portal Enhancements. Develop and deploy an intelligent chatbot to provide instant, 24/7 answers to frequently asked questions regarding accessibility policies, tools, and service requests. The chatbot shall be capable of guiding users to the appropriate resources within the portal, including but not limited to the video training library.

• Create and facilitate a board of advisors consisting of HHS leaders to continue providing the best tools and solutions available in the accessibility space management teams; however, the primary list of deliverables related to this optional objective:

CoE Portal User Stories

1 month after award On-going SharePoint Project

CoE Portal Prototype 3 months after award Prior to each iteration or functional release

Microsoft Suite

HHS and OS Digital Accessibility CoE Portal

6 months after award Final portal due 11 months after award

Microsoft Suite

Communications Plan 2 months after award Bi-Annual MS Word Stakeholder Matrix 2 months after award Quarterly SharePoint Tracker

C. 2 Kick-Off Meeting

The contractor shall meet with the Contracting Officer (CO), the Contracting Officer’s Representative (COR), and the HHS and OS Digital Accessibility Program Managers, within five (5) business days of EDOC for a program kickoff meeting.

The objectives of the kickoff meeting are to:

• Conduct introductions of federal and contractor personnel (provide biographies and contact information – to include office and mobile telephone numbers and e-mail addresses - for key contractor personnel) and identify respective roles and responsibilities

• Review existing program documentation

• Articulate strategic direction and scope of the challenge by the HHS and OS Digital

Accessibility Program Managers

• Discuss and ensure mutual understanding of the statement of objectives, the processes for which the software must be configured, and roster of personnel

• Gain agreement on all expectations for the HHS and OS Digital Accessibility Program

C. 3 Description of Labor Categories and Skill Expectations

The labor categories used for the IGCE are based on the skillsets listed. It is understood there is a varying degree of applicable degrees, years of experience, and comparable certifications. The descriptions below should be used as general guidelines for; years of experience and demonstrated history of producing high quality work products are priorities when evaluating personnel. One exception is the Digital Accessibility SME(s) must maintain the latest Department of Homeland Security (DHS) Trusted Tester certification, or industry equivalent

C. 5 Solution Center Hours of Operations

The Solution Center resources shall be available between the hours of Monday-Friday 8:00 AM to 4:30 PM (EST) (8 hours a day with a 30-minute lunch break, 5 days a week basis) except Federal holidays and weekends.

C. 6 Confidentiality and Non-Disclosure of Information

Any information provided to the Offeror (and/or any subcontractor) by HHS or collected by the Offeror on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Offeror assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Offeror. Each Offeror employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Offeror that information disclosed to such employee or sub-Offeror can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS policies.

C.7 Requirements

Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the

Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X ] Low [ ] Moderate [ ] High Integrity: [ X ] Low [ ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Risk Level: [ X ] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII Complete this section using the information obtained from the Security and Privacy Checklist in mailto:fisma@hhs.gov http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ X ] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06- 16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Appendix A, parts A and B.

• See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and OS policies. Unauthorized disclosure of information will be subject to the HHS/OS sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents OS specify which documents/forms will be provided to contractor] to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2.

The Contractor shall provide a written copy of the validation documentation to the

COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the OpDiv non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The

Contractor shall assist the OpDiv Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the

OpDiv SOP or designee with completing a PIA for the system or information within after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the OS SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/OS Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete OS Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of

Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/OS IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response, further defines a breach as “a suspected or confirmed incident involving PII” .

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send OS approved notifications to affected individuals.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT), COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as SOWn as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail;

and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information HHS/OS HHS and OS incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

This may also involve physical access to contractor facilities during a breach/incident investigation.

Position Sensitivity Designations

• All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

C.8 Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within one week of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within one week of the change. The COR will notify the Contractor of the

The requiring activity representative, in conjunction with Personnel Security, shall use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12) https://www.opm.gov/investigations/ https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

2) to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within one week before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR.

Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned…