HHS OCIO Vendor Management Support Services

DESCRIPTION/SPECIFICATIONS/PERFORMANCE WORK STATEMENT

C.1 INTRODUCTION

The U.S. Department of Health and Human Services (HHS) is the United States Government's principal agency for protecting the health of all Americans and providing essential human services. The mission of the HHS is to enhance the health and well-being of Americans by providing effective health and human services and by fostering sound, sustained advances in the sciences, underlying medicine, public health, and social services. Integral to these responsibilities is the open sharing of information that is sensitive to the Department. HHS faces the challenge of providing important services and products to the American people while simultaneously reducing costs and protecting sensitive information.

C.2 BACKGROUND

The U.S. Department of Health and Human Services (HHS) is responsible for protecting the health of all Americans and providing essential human services. HHS operates a complex and diverse information technology (IT) environment that supports mission-critical programs across multiple Operating Divisions (OpDivs) and Staff Divisions (StaffDivs). To support its mission, HHS relies on a wide range of commercial software products and enterprise licensing agreements, including Blanket Purchase Agreements (BPAs) and Enterprise License Agreements (ELAs). These agreements enable standardized acquisition, cost efficiency, and enterprise-wide access to critical software capabilities. Given the scale and complexity of software investments across HHS, there is a need for centralized oversight and coordination of vendor relationships, licensing agreements, and software asset management practices.

The Vendor Management Office (VMO) serves as a governance function to improve visibility, ensure compliance, optimize costs, and enhance vendor performance across the Department.

C.3 PURPOSE

The purpose of this requirement is to provide program and project management support to establish, operate, and mature a Vendor Management Office (VMO) focused on the management of software vendors and licensing agreements within HHS.

The VMO will support the Department by:

• Providing centralized oversight of software licensing agreements, including BPAs and ELAs

• Enhancing vendor performance management and accountability

• Improving cost management, transparency, and optimization of software investments

• Ensuring compliance with Federal Acquisition Regulation (FAR), HHS policies, and licensing terms

• Supporting enterprise-wide standardization and strategic sourcing initiatives, including Category

Management

The Contractor shall support HHS in implementing effective governance, processes, and tools necessary to manage software assets and vendor relationships across the enterprise. This includes coordination with key stakeholders across IT, procurement, finance, and cybersecurity organizations

The purpose of this requirement is to procure Vendor Management Office support for HHS OCIO.

Given the continued evolution of these programs and information technologies, OCIO has a critical requirement to obtain the services of a contractor capable of flexible assignments, and ad-hoc staffing support in all areas of IT-related acquisition.

C.4 SCOPE

The Contractor shall provide Administrative Management, Program Management to include a Program/Project Manager, Acquisition Support, Enterprise Software License Management, Financial Oversight, and Customer Engagement support services for the Vendor Management Office at HHS OCIO. The Contractor shall manage the full lifecycle of software licensing activities across HHS Operating Divisions including support for BPAs, ELAs, enterprise ordering processes and any IT related acquisitions.

The Contractor shall provide a multidisciplinary team to support HHS OCIO enterprise software licensing, acquisition, financial management, and program operations. The Contractor shall ensure all personnel are qualified, experienced, and capable of performing the duties described herein.

Program Manager/Project Manager: Key position

The Contractor shall provide a Program Manager/Project Manager to oversee and coordinate all Vendor Management Office (VMO) activities related to software licensing agreements, including Blanket Purchase Agreements (BPAs) and Enterprise License Agreements (ELAs). The Program Manager/Team Lead shall serve as the primary point of contact and be responsible for overall program execution, performance, and stakeholder engagement.

The Contractor shall provide a Program Manager/Project Manager who shall:

• Provide overall program management and leadership for VMO operations supporting BPAs and

ELAs and other purchases.

• Serve as the primary point of contact and coordinate across stakeholders

• Manage schedule, risks, issues, and performance

• Oversee vendor, contract, and licensing lifecycle activities

• Ensure compliance, reporting, and audit readiness

• Support financial management and renewal planning activities

• Serve as the primary point of contact (POC) for all VMO-related activities and provide overall program leadership and direction.

• Plan, coordinate, and oversee execution of all task areas to ensure timely, high-quality delivery in accordance with contract requirements.

• Develop and maintain integrated project plans, schedules, and milestones, and track progress against established objectives.

• Manage and escalate program risks, issues, and dependencies, and implement appropriate mitigation strategies.

• Coordinate and integrate activities across cross-functional teams, including software asset management, procurement, finance, IT, and cybersecurity.

• Oversee management of software licensing agreements, including BPAs and ELAs, ensuring lifecycle activities (e.g., planning, execution, renewals) are effectively performed.

• Provide oversight of vendor management activities, including performance monitoring, issue resolution, and participation in vendor governance forums (e.g., QBRs).

• Ensure adherence to FAR, agency policies, and licensing compliance requirements, and support audit readiness activities.

• Oversee development and delivery of program reports, dashboards, and executive briefings, ensuring accuracy, completeness, and timeliness.

• Monitor and report on Key Performance Indicators (KPIs), including cost, schedule, performance, and licensing utilization metrics.

• Support budget planning, cost tracking, and forecasting activities, and identify cost savings and cost avoidance opportunities.

• Facilitate stakeholder engagement, including meetings, briefings, and decision forums, and ensure effective communication across all stakeholders.

• Oversee and support renewal planning activities, including maintaining a forward-looking renewal schedule and guiding pre-renewal assessments and negotiation strategies.

• Ensure implementation and continuous improvement of processes, standard operating procedures (SOPs), and governance frameworks supporting VMO operations.

Acquisition Specialist

• The Acquisition Specialist shall provide acquisition planning and contract support for BPAs, ELAs, and Task Orders.

• The Acquisition Specialist shall develop acquisition documentation including Statements of Work, IGCEs, and acquisition plans and other documents such as Market Research and evaluation Criteria and any other acquisition related documents.

• The Acquisition Specialist shall ensure compliance with FAR, HHSAR, and applicable federal policies.

• The Acquisition Specialist shall support pre-award and post award activities with the Software Enterprise Agreements, including cost/price and technical analysis.

• The Acquisition Specialist shall coordinate with contracting officers and program staff to support acquisition lifecycle activities.

Finance Specialist

• The Finance Specialist shall manage billing processes for HHS Operating Divisions (OpDivs).

• The Finance Specialist shall enter and track expenditure on the budget tool, manage the HHS wide software purchases, and validate charges.

• The Finance Specialist shall develop financial reports and provide cost analysis.

• The Finance Specialist shall identify cost savings opportunities and support budget planning activities.

• The Finance Specialist shall ensure financial data accuracy and integrity.

• The Finance Specialist shall be responsible for maintaining all HHS wide purchases and ensure all information is accurate in the Vendor Management Office Development Tool.

Program Outreach and Communication Specialist

• The Program Outreach and Communication Specialist shall develop and execute communication strategies and be responsible for maintaining any ELA documents and articles and maintaining any internal or external communication sites.

• The Specialist shall prepare briefings, presentations, and outreach materials including newsletters..

• The Specialist shall coordinate stakeholder engagement and monthly collaboration meetings.

• The Specialist shall conduct surveys to assess demand for potential BPAs and ELAs.

• The Specialist shall analyze survey results and provide recommendations to the Government.

• The Specialist shall work closely with development team to provide any information needed.

Emerging Technology Specialist

• The Emerging Technology Specialist shall evaluate emerging technologies and licensing models.

• The Specialist shall conduct market research and provide recommendations for new technology adoption.

• The Specialist shall advise HHS stakeholders on innovative licensing strategies and solutions.

• The Specialist shall support strategic planning for enterprise technology investments.

• The Specialist shall conduct training or working sessions with HHS customers to advise them on existing and new products and technologies

• The Emerging Technology Specialist shall have thorough knowledge of emerging software products and advise HHS customers on their benefits.

License Specialist

• The License Specialist shall manage the full lifecycle of software licenses, including ordering, tracking, and maintenance.

• The License Specialist shall maintain and administer software license portals.

• The License Specialist shall ensure accuracy of license inventories and entitlements.

• The License Specialist shall develop cost savings reports comparing negotiated pricing against GSA schedules and vendor list prices.

• The License Specialist shall support consolidation of licenses and optimization strategies.

• The License Specialist shall coordinate with vendors and stakeholders to resolve licensing issues.

• The License Specialist shall be responsible for working closely with Vendor Management

Development Team to coordinate all tasks needed for surveys, data calls, forecasts, notifications etc.

• The License Specialist will work with the SAM team to track license usage.

• ADDITIONAL REQUIREMENTS

• The Contractor shall maintain and administer the Vendor Management Office (VMO) application and site.

• The Contractor shall ensure VMO data accuracy, accessibility, and system usability.

• The Contractor shall manage OpDiv software orders and support enterprise ordering processes.

• The Contractor shall support data calls and provide timely, accurate responses.

• The Contractor shall provide monthly reports and program deliverables.

• The Contractor will work on ad hoc assignments as needed related to software licensing and purchases and its management.

• The Contractor will use the knowledge of, and, upon approval of the Government, apply AI in automating activities related to VMO Management and Software Licensing Support activities and help HHS customers with its products and services.

• The contractor team will work closely with SAM (Software asset management) to develop license inventory and utilization report across HHS.

C.5 ADDITIONAL SUPPORT TASKS

C.5.1 TASK 1: PROGRAM SUPPORT

C.5.1.1 ADMINSTRATIVE MANAGEMENT

The Contractor shall provide support for the following tasks:

• Provide day-to-day administration.

• Provide day-to-day management.

• Produce detailed metrics and reports on issues for review prior to new vendor agreements.

• Identify and resolve user support issues.

C.5.1.2 KICK OFF MEETING

The contractor shall participate in a Government-scheduled Kick-Off Meeting after award. Key prime contractors and any subcontractor personnel shall participate in the Kick-Off Meeting. The purpose of this Kick-Off Meeting is to (1) aid both the Government and contractor personnel in achieving a clear and mutual understanding of all requirements, and (2) identify and resolve potential problems.

The Kick-Off Meeting shall include, but not be limited to, the following topics:

• Program Review

• Existing and Planned Applications and Technical Initiatives

• Personnel and Physical Security Issues

The Government and contractor will schedule the Kick-Off Meeting. It is anticipated that the Kick- Off Meeting will be for 1 day in duration.

C.5.1.3 PROGRAM CONTRACT MANAGEMENT

The Contractor shall provide support for the following tasks:

• The Contractor shall provide high quality project management support for all government approved projects.

• The Contractor shall provide qualified program and project management resources with relevant background and experience, including an active Project Management Institute Project Management Professional (PMP) certification or generally accepted government equivalent (e.g., Federal Acquisition Certification for Program and Project Managers (FAC- P/PM) Level

II).

• The Contractor shall manage projects using formal project management tools, methodologies and standards based on standardized and industry accepted methodologies.

• The Contractor shall provide full lifecycle project management support to OCIO projects using standardized and industry accepted methodologies for project initiation, planning, executing, monitoring and controlling, and closing.

• The Contractor shall ensure all deliverables, documentation, and artifacts adhere to the policies, processes, and templates as applicable to include project plans, schedules, Project Charter, Project Management Plan, Risk Management Plan, Communications Management Plan, and Change Management Plan. This shall also include the delivery and update as needed of a work breakdown structure and activity/milestone schedules for each ongoing and planned project.

• The Contractor shall deliver written project status reports on no less than a monthly basis for all active projects to the designated ITIO project manager.

• The Contractor shall prepare for and participate in project status reviews, stage gate reviews, and other oversight meetings with ITIO and other HHS management and staff on no less than a monthly basis.

• The Contractor shall provide technical and programmatic preparation and support for liaison and collaboration meetings among other HHS OpDiv and StaffDiv organizations.

• The Contractor shall upload all project deliverables, reports, and other artifacts to a government-provided project collaboration site.

C.5.1.4 CONTRACT, VENDOR, CUSTOMER PROGRAM & FINANCIAL CONTROL

• Develop detailed project plans for assigned projects and activities.

• Develop, track and report key Program metrics.

• Produce Business and Financial Plans and Projections.

• Develop products that provide customers with tangible cost savings for their organizations.

• Provide financial analysis support to systematically integrate business, cost estimating and financial management processes to ensure the efficient stewardship of public funds.

C.5.1.5 VENDOR & CUSTOMER BUSINESS DATA & CONTRACT ANALYTICS

The Contractor shall provide expert techniques and resources to conduct data modeling with the goal of discovering useful information, suggesting conclusions, and supporting decision making. The contractor shall perform data analytics on acquisition related data residing in several financial and acquisitions systems. The contractor shall gather data from these sources and conduct in-depth analysis to deliver current and future state of all acquisitions and contracts.

Specifically, the contractor shall:

• Identify disparate systems where acquisition data is residing.

• Map data and normalization data can be used for analysis and reporting purposes.

• Advise on acquisition data analysis strategies and techniques.

• Develop detailed timeline and identify major acquisition-related milestones for all contracts.

• Develop financial reports that provide clear view into all contracts, so the leadership has updated information to make sound decisions for all acquisitions.

SECTION C – DESCRIPTION/SPECIFICATIONS/PERFORMANCE WORK STATEMENT

C.5.1.6 VENDOR & CUSTOMER PROGRAM OUTREACH & ENGAGEMENT

• Develop communication briefings for all audience levels.

• Create materials for customers and vendor education and outreach.

• Develop and present end user training program materials, for both web-based and classroom instruction.

• Measure and evaluate the effectiveness of communications strategies using surveys and data calls conducted quarterly, and the results will be summarized and recommended to the COR for implementation.

• Identify, develop, and upon COR approval, implement recommendations for improving communications.

• Assist or provide guidance to with peers/program manager to ensure the consistent use of best practices.

• Assist the COR to collaborate with software developers to communicate web site development requirements. Contractors will work closely with OCIO program office supporting the web site development to ensure that updated information is provided and that there are no issues on Web site security.

• Assist the COR to Conduct market research and requirements building engagements with customers, publishers, and value-add resellers.

• Assist with coordinating, planning and overseeing all logistics for communication events (for example: vendor days, vendor provided training, etc.)

• Obtain and summarize customer feedback on the program.

C.5.2 TASK 2: ENTERPRISE AND ACQUISITION MANAGEMENT CONTRACT

BPA/ELA/ORDER SUPPORT

C.5.2.1 ACQUISITION & CONTRACTS SUPPORT

• Acquisition document development, including cost/price estimates, quality assurance surveillance plans, draft Statements of Work, draft Performance Work Statements, and Acquisition Plans, etc.

• Assistance in supporting proposal evaluations, including price/cost analysis or technical proposal analysis: contract administration support services.

• Assist with OCIO contracts ensuring compliance with acquisition regulations (i.e., FAR, HHSAR, OMB Mandates, Section 508, etc.)

• Must have demonstrated knowledge and experience in reviewing and discussing software, hardware, and services licensing agreements by attending meetings with OCIO federal staff.

C.5.2.2 ENTERPRISE CONTRACT ELA/BPA/ORDER MANAGEMENT & SUSTAINMENT

• Planning assistance, including consolidating and documenting customer requirements and market research.

• Assist with OCIO contracts in investigating reports of contract discrepancies, contract close-out assistance, and competitive sourcing support.

C.5.3 OUT-GOING TRANSITION SUPPORT

In the event the Government re-competes the requirements of this task order and prior to completion of this task order’s period of performance, the Contractor shall, at the Government’s option, provide the Government with a 30-day Transition-Out Plan that shall ensure an orderly and successful transition of the remaining tasks to a successor contractor should the incumbent Contractor not be selected during the re-competition. As part of the transition-out plan, the Contractor shall adequately train the successor contractor’s employees following any re-competition of the requirements specified in this task order.

C.5.4 Deliverables:

Contract and Vendor Management

• BPA/ELA Tracking Report The Contractor shall maintain a centralized tracker of all BPAs and ELAs, including contract terms, period of performance, renewal dates, and key provisions.

Frequency: Monthly

• Vendor Performance Report The Contractor shall assess and report vendor performance against established service level agreements (SLAs) and performance metrics.

Frequency: Quarterly

Financial Management

• Software Spend and Cost Analysis Report The Contractor shall provide detailed reporting on software expenditures, including trends, forecasts, and variance analysis.

Frequency: Monthly/Quarterly

• Cost Savings and Cost Avoidance Report The Contractor shall identify and document realized and potential cost savings through optimization, consolidation, and negotiation strategies.

Frequency: Quarterly Compliance and Audit Support

• Audit Readiness Package The Contractor shall prepare and maintain documentation required to support internal and external software licensing audits, including proof of entitlements and usage records. (in coordination with SAM) Frequency: As Required

• Compliance Status Report The Contractor shall report on compliance with licensing terms and conditions and identify any risks or gaps.

Frequency: Quarterly

Renewal and Strategic Planning

• Software Renewal Plan

The Contractor shall develop and maintain a forward-looking (12–24 month) renewal schedule for all licensing agreements, including recommended actions.

Frequency: Quarterly

• Pre-Renewal Assessment Report The Contractor shall conduct assessments of licensing needs, usage trends, and market conditions to support renewal and negotiation strategies.

Frequency: As Required (prior to renewals)

Reporting and Program Management

Program Status Report The Contractor shall provide updates on activities, risks, issues, and performance metrics.

Frequency: Monthly

• Executive Briefings The Contractor shall prepare and deliver briefings summarizing program status, risks, vendor performance, and recommendations.

Frequency: Monthly/Quarterly

• Dashboards and Metrics Reporting The Contractor shall maintain dashboards tracking key metrics such as license utilization, vendor performance, spend, and renewals.

Frequency: Continuous / Updated Monthly

Process and Governance

• Standard Operating Procedures (SOPs) The Contractor shall develop and maintain documented processes for software licensing and vendor management activities.

Frequency: Initial and Updates as Needed

C.5.5

PERIOD OF PERFORMANCE:

Base period: 09/07/2026-09/06/2027 Option period 1: 09/07/2027-09/06/2028 Option period 2: 09/07/2028-09/06/2029 Option period 3: 09/07/2029-09/06/2030

C.5.6 PLACE OF PERFORMANCE:

The contract place of performance will be as designated by the COR and will be determined upon award.

Contractors off-site office location should be in the very close proximity and should be readily available to be physically present at the HHS Fishers Lane at Rockville on an ad hoc basis.

C.5.7 GOVERNMENT FURNISHED EQUIPMENT

The Government shall provide laptops and PIVs for the resulting award to the contractors.

C.5.8 Procurements Requiring Information Security and/or Physical Access Security

Physical and Logical Access refers to when contractor personnel (and/or any subcontractor) are expected to have (1) routine physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to government information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3) as per the HHSAR Subpart 304.13 - Personal Identity Verification[13] and OMB M- 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 - Policy for a Common Identification Standard for Federal Employees and Contractors [14].

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/[OpDiv] policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language#ftn13 https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language#ftn14

Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/[OpDiv] and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. , links to an external website, opens in a new tab [PDF]Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ ] Low [ ] Moderate [ ] High

Integrity: [ ] Low [ ] Moderate [ ] High

Availability: [ ] Low [ ] Moderate [ ] High

Overall Impact Level: [ ] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/[OpDiv] regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/[OpDiv] Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/[OpDiv] security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

Note to the Requiring Activity Representative: This information may be included after award in the event it is not yet available at the time of acquisition. Section d must be included in all contracts regardless of whether or not personally identifiable information (PII) is involved.

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within [OpDiv to insert contract-specific timeline] after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and [OpDiv] policies. Unauthorized disclosure of information will be subject to the HHS/[OpDiv] sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf, links to an external website, opens in a new tab [PDF, 5.87 MB]

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents [OpDiv] specify which documents/forms will be provided to contractor] to comply with contract deliverables as appropriate.

Note to the Requiring Activity Representative: See Appendix C for baseline deliverables. Do NOT include in procurement documentation.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR [OpDiv-provided delivery date].

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/, links to an external website. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement. [OpDiv inserted information/link should be cited here], as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Note to the Requiring Activity Representative: See Appendix D for the HHS Contractor Non-Disclosure Agreement. Do NOT include in procurement documentation.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete [OpDiv-specified] Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with http://csrc.nist.gov/publications/ http://csrc.nist.gov/publications/ significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and [insert any OpDiv-specific rules, as applicable].

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/[OpDiv] IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send [OpDiv] approved notifications to affected individuals [insert OpDiv Specific timeline, process, and format].

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT) [OpDiv inserted contact information should be cited here], COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US- CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/OpDiv and [OpDiv] privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation [OpDiv insert timeline if required].

5. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Note to the Requiring Activity Representative: The Requiring Activity Representative, in conjunction with Personnel Security, must use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/, links to an external website) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

6. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Note to the Requiring Activity Representative: For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12, links to an external website)

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within [OpDiv Specific timeline] of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within [OpDiv Specific timeline] of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. [If the OpDiv has an electronic template, include that information here along with a link, if applicable.]

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology or [insert OpDiv-specific requirement] and in accordance with the https://www.opm.gov/investigations/ https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation [enter OpDiv-specific requirements] to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within [OpDiv-specific timeline] before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or [OpDiv] policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the [OpDiv] Contractor Employee Separation Checklist [insert links to OpDiv form] when an employee terminates work under this contract within [insert OpDiv-specific timeline] days of the employee's exit from the contract. All documentation must be available to the CO and/or COR upon request.

9. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 --…