Draft Statement of Work.pdf

DRAFT Statement of Work (SOW) for the Data Access Program

Contents

1. Overview

Background

Statement of Need/Purpose

2. Scope

Objectives

3. Tasks

Task 1: Enclave (FFP)

Task 1.1: Certificate of Liability

Task 1.2: Enclave Acquisition & Development

Task 1.3: Enclave Assessment & Authorization (A&A)

Task 1.4: Enclave Operation & Maintenance

Task 1.5: Enclave Activity Analysis and Technical Assistance

Task 1.6: Enclave Enhancements

Task 1.7: DaaS Operation and Transition

Task 1.8: Enclave Transition or Decommission

Task 1.9: Enclave Task Management

Task 2: Data Linkage (T&M)

Task 2.1: Federal Data Use Agreement (DUA) Establishment and Acquisition

Task 2.2: Masking Identifiable Data

Task 2.3: Conducting Data Linkage

Task 2.4: Extract and Distribute Linked Research Files

Task 2.5: Data Documentation and Restructuring

Task 2.6: Review Analytic Output and Disclosure Process

Task 2.7: Processing and Creating Research Ready Data Files

Task 2.8: Advancing Data Linkage Techniques Using PII and PPRL

Task 2.9: Technical Assistance

Task 3: Program Operations (T&M)

Task 3.1: Receive and Review Data Use Agreements (DUA)

Task 3.2: Stakeholder Engagement

Task 3.3: Marketing, Dissemination and Training

Task 3.4: Technical Assistance

Task 3.5: Program Assessment and Enhancement

Task 3.6: Public Website & Code Repository

Task 3.7: Project Management

Task 4: Privacy Preserving Record Linkage Automation

Task 4.1. Environmental Scan: PPRL Methodology with Match Automation

Task 4.2. Encryption Keys, Data Transfer, and Identifiers

Task 4.3. Matching Algorithm

Task 4.4. Quality Assurance and Enhancements

4. Schedule

5. Personnel, Equipment, Facilities and Travel Requirements

Personnel

Overall Management

Onboarding Contractor Personnel

Government-Furnished Equipment (GFE)

Contractor-Furnished Equipment

Work Location and Travel

6. References

1. Overview

Background

The National Institutes of Health (NIH) is the nation’s medical research agency. In response to NIH’s mission to “…expand the knowledge base in medical and associated sciences in order to enhance the Nation's economic well-being and ensure a continued high return on the public investment in research,” several programs across NIH support data linkages with other federal agencies.

Established in 2021 within the National Institute on Aging, the LINKAGE Program currently provides support to NIH funded studies with a federated data enclave (for analysis and data sharing) and technical assistance to facilitate linkages with Centers for Medicare & Medicaid Services (CMS) data and other studies. In providing these resources free of charge, LINKAGE aims to reduce resource cost and time barriers and promote access for researchers.

Information about the current LINKAGE program can be found at https://www.nia.nih.gov/research/dbsr/nia-data-linkage-program-linkage.

If applicable, the existing contract is anticipated to have a six month overlap with the awardee for the Data Access Program, hereafter also referred to as “the Program.” To the extent the transition period is provided, the new Contractor shall participate in Program transition activities. This will allow the incumbent Contractor to properly transition existing work, provide training, etc. to the incoming Contractor as appropriate based on the requirements detailed in this Statement of Work. This overlap period is not guaranteed, and the contractor must be prepared to start work without an overlap period.

Statement of Need/Purpose

NIH seeks contractor support 1) to aid the current portfolio of data linkages already enabled by the current award; 2) for the development of new or expanded partnerships to maximize data linkage opportunities for NIH grantees, researchers, and federal researchers; and 3) for an expanded number and type of datasets available for linkages to include additional Federal and non-federal datasets, private data sources, and potentially others including NIH-funded international studies.

With respect to supporting the current portfolio of studies, the Data Access Program will provide services to NIH-supported studies and eligible researchers that link their data sets with CMS data or other federal and non-federal data for research purposes. If studies are willing to distribute their linked datasets, eligible researchers may access study datasets in the Enclave. For more information, visit the following website: Access or Share LINKAGE Data | National Institute on Aging (https://www.nia.nih.gov/research/dbsr/nia-data-linkage-program-linkage/access-or-share-linkage-data).

Moving forward, the NIH intends to expand the Data LINKAGE Program to serve all NIH institutes and centers. Expanding the Data Access Program involves accepting NIH-funded studies that are seeking to use the enclave for data sharing purposes and when data are transferred to NIH at the end of the study period (i.e., materials transfer agreement executed by NIH). Studies in this category may or may not require updated data linkage services.

In anticipation of expanding the number and types of datasets to include more than data from the CMS, the NIH seeks support to design and implement scalable, automated solutions for acquiring, ingesting, linking, and managing a range of data sources. Solutions should include standardized, repeatable workflows; automated quality checks and linkage validation; and enable efficient integration of federal, non-federal, and private datasets. All systems and services must operate within FISMA Moderate compliant environments and adhere to Zero Trust security principles, ensuring secure access control, identity assurance level 2 (IAL2) verification, and continuous monitoring. The contractor will support the development and maintenance of technical infrastructure to enable high-throughput, interoperable data processing that aligns with NIH’s broader data governance, privacy, and compliance objectives.

2. Scope

Objectives

The objective of this contract is to 1) host NIH funded studies with sensitive data for research purposes, including those studies that are seeking federated means for data storage and sharing, advance data sharing for NIH studies (including those that are not linking to CMS data), and 2) expand the options for linkage to additional Federal and private sector datasets. The Data Access Program’s primary requirements are structured under three tasks: enclave, data linkage delivery, and program operations.

As part of these objectives, the contractor shall enhance and expand the user base of the program, and support data linkages, support privacy preserving linkage automation, deliver technical assistance, provide statistical and methodological consultation through a technical expert panel, procure public or private real-world data, and facilitate quality improvement within the Program to improve user experiences.

The Contractor shall perform Task Assignments in areas that include, but are not limited to:

Developing and maintaining a secure cloud-based enclave to catalog, analyze, store, and distribute linked and non-linked datasets;

Supporting master and metadata cataloging to enable high-performance and robust variable-level searchability and discoverability of available datasets;

Implementing cloud-based infrastructure- and platform-as-a-service (IaaS and PaaS) technologies, including services such as AWS, Azure, and Google Cloud, for example;

Provisioning enclave user areas or accounts in the enclave;

Establishing and verifying researcher identities and data use agreements for studies;

Reviewing data access requests;

Conducting data linkages using automation to enhance eƯiciency and scalability;

Processing and creating research files (raw, annual, and longitudinal files);

Implementing validation protocols to ensure data quality and integrity;

Maintaining and updating data documentation;

Facilitating federated data services for studies that are not linked to CMS or other federal data sources;

Providing end-user technical support for both the enclave environment and the linkage process;

Supporting procurement of public or private real-world data;

Facilitating expert panel meetings.

Developing and implementing automated privacy-preserving record linkage methodology;

Maintaining a robust security posture in alignment and compliance with Zero Trust principles and FISMA moderate requirements.

Integrating software-as-a-service (SaaS) solutions that support operations of the Data

Access Program;

Monitoring program operations for quality improvement opportunities, proposing opportunities for improvement, and executing program improvement initiatives; and Administering the program successfully in consultation with and at the direction of the

COR.

As part of the broader NIH data infrastructure, the Contractor will coordinate with the National Clinical Cohort Collaborative (N3C) and other NIH programs as part of the NIH Real World Data Platform (RWDP), including the RWDP Coordinating Center, and researchers participating in the Autism Data Science Initiative (ADSI). The Contractor shall facilitate program access for researcher-users participating in the ADSI.

3. Tasks The following distinct tasks have been identified as follows:

Task 1: Enclave Task 2: Data Linkage Task 3: Program Operations Task 4: Privacy Preserving Record Linkage Automation

Task 1: Enclave (FFP)

This task requires provision, maintenance, and enhancement of a secure federated cloud service environment (enclave) designed for the cataloging, storage, analysis, and distribution of both linked and unlinked NIH study datasets. The enclave, which will be government-owned and contractor operated, must:

Support comprehensive master data and metadata management, ensuring robust data governance and interoperability.

Incorporate advanced search and indexing capabilities to optimize data discoverability, minimize search and transaction costs.

Streamline transitions across computational environments.

Provide technical assistance and user support to facilitate seamless integration, usability, and operational eƯiciency of the enclave.

The Contractor shall collaborate with all involved parties who provide capabilities in support of the enclave. The enclave shall be a secure and cloud-hosted government-owned system that is operated and maintained by the Contractor using nonproprietary technologies whenever feasible.

The Contractor shall have no claim to intellectual property, program operational data, system configurations, or other data rights. No proprietary methods, data, capabilities, or technologies shall be used in performance of this Contract. The Contractor shall manage the enclave system implemented through the acquisition of technology and services provided for the federated enclave, data linkage services, and program operations. The Contractor must ensure the availability of comprehensive transition support, including knowledge transfer, training, and full access to all system components, to facilitate seamless continuity of operations by the government or a successor contractor.

The Contractor shall ensure completion of the following:

1. Implementation Plan: Develop an implementation plan to schedule all enclave activities, including purchases and procurements to support enclave operations.

2. Maintaining and Expanding Capacity: Maintain and expand enclave and operational capacity to accommodate increasing user base. Ensure elastic scalability to handle workload spikes without degradation in performance.

3. Onboard and Maintain Users: Establish a structured onboarding process and training programs for new users and maintain continuous training programs for existing users.

4. Federal Standards and Policies: Maintain strict adherence to all applicable Federal standards, policies and procedures for enclave development, maintenance and enhancement.

5. Enclave Acquisition and Development: Implement, maintain, and support a secure, cloud-hosted data enclave across multiple cloud providers (minimum of 3) to optimize cost savings for the government. The enclave shall be provisioned using a cloud service provider with a FedRAMP Moderate as a baseline.

a. FISMA Moderate System and Frameworks: Ensure large-scale data storage and retrieval mechanisms conform to the Federal Information Security Modernization Act (FISMA) Moderate security requirements. The enclave shall be delivered with an Authority to Operate (ATO) within 6 months of award.

b. Acceptable Risk Safeguards: Implement all NIH security requirements, including CMS Acceptable Risk Safeguards (ARS) v5.1 security controls for FISMA Moderate systems. Apply security overlays, if applicable4.

c. Continuous Monitoring: Implement and maintain a comprehensive Continuous Monitoring (ConMon) program following NIST 800-137 guidelines. Develop, implement, and maintain automated security compliance tools to dynamically monitor, detect, and respond to security threats in real-time.

d. Zero Trust Architecture: Implement and maintain a Zero Trust Architecture1 in alignment with the Cybersecurity and Infrastructure Agency (CISA) Zero Trust

1 Zero Trust Architecture | NIST (https://www.nist.gov/publications/zero-trust-architecture )

Maturity Model2 throughout the enclave. The Contractor shall achieve the Advanced level of Zero Trust Maturity no later than 6 months after award.

e. Data Encryption: Ensure that all sensitive data, including government data, healthcare, and research data, is protected via encryption-at-rest and in-transit using FIPS 140-2 validated encryption. Implement tamper-proof audit logging for all sensitive data transactions.

f. Role Based Access Control: Implement a scalable role-based access control (RBAC) solution that can accommodate multiple roles and parties accessing the system and same DaaS workspace (e.g., multiple studies providing approval so data can be pooled in one workspace to lower transaction cost). Ensure multiple studies can grant approval to pool data within a shared workspace.

g. Security Documentation: Deliver comprehensive system security documentation that meet all NIH, FISMA, FedRAMP, Zero Trust requirements, and other federal requirements (if applicable during the time of the award). Adhere to industry best practices.

h. System integration and Testing: Document system integration efforts. Provide comprehensive system testing and validation reports.

i. Finalization and Handover: Deliver a detailed final review report outlining the enclave’s design specifications, operational requirements and transition plan.

6. Enclave Assessment and Authorization to Operate (ATO): Ensure that the enclave meets all required FISMA Moderate security controls and compliance standards. Conduct an independent Third-Party Security Assessment of the enclave (must not take longer than 3 months) to achieve and maintain Authorization to Operate (ATO) status.

7. Certificate of Liability: Document and purchase liability insurance in the amount of $100M or more to mitigate risk in the event of a data breach (including both linked and unlinked data) and ensure that this contract is listed under the terms of the insurance policy.

8. Enclave Operations and Maintenance: Maintain ongoing operations and maintenance activities for enclave through operational support, updates, producing system documentation and performance security and system monitoring. Implement automated cloud resource monitoring to optimize costs and performance.

9. Enclave Activity Analysis: Use dashboard analytics (aligned with DAMA-DMBOK framework) to track data access patterns, usage trends, and key performance indicators (KPI). Implement machine learning-based anomaly detection and security monitoring to identify unusual data access patterns and potential threats.

10. Enclave Technical Assistance: Provide technical assistance on all aspects of enclave use to users in coordination across all teams.

11. Enclave Enhancements & Future-Proofing: Implement ongoing enhancements based on NIH requests, user feedback, performance analytics, security, and industry standards.

Enhancements may also include integration of new data sets and analytical tools, and maintaining interoperability with new cloud platforms, databases, and integration of analytical tools.

2 CISA Zero Trust Architecture (https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model)

12. Automated Data Ingestion & ETL Pipelines: Develop automated Extract, Transform, Load (ETL) pipelines to support data ingestion from multiple sources. Enforce schema validation to ensure data consistency and integrity

13. Advanced Data Discovery & Sematic Search: Implement non-AI/AI-powered search and meta data tagging for enhanced for data discovery (optimized for transaction cost). Support FAIR principles (Findable, Accessible, Interoperable, Reusable)

14. High-Performance Computing (HPC) & AI/ML Readiness: Enable GPU acceleration for large-scale data analytics and AI/ML work. Support federated learning approaches for privacy-preserving machine learning.

15. Interoperability with Federal Login Systems: Ensure seamless integration with login.gov and NIH Researcher Auth Service (RAS), as appropriate.

16. Interoperability with common data models: Adopt common data models when applicable for a research study or data (e.g., OMOP, HL7, FHIR, CDISC, DDI, etc.)

17. Automated Documentation and Compliance Reporting: Require automated generation of system documentation and compliance reports and dashboards. Implement AI-powered compliance auditing tools when applicable.

18. Cloud Cost Optimization, Accountability and Sustainability: Establish robust cloud resource monitoring in a fixed-cost data enclave environment to ensure eƯicient utilization within predefined limits for each user or user group. Promote sustainable usage practices to maximize the value of allocated resources and reduce waste.

19. Transition Activities and Knowledge Transfer: Facilitate an orderly transition from the incumbent contractor to the new contract or as otherwise directed. Provide detailed transition plans, including source code, system configurations, API, documentation, and training materials. Conduct mandatory knowledge transfer sessions with federal and successor contractors

1.1 Methodology

Cloud Services

This task details the Contractor’s role in supporting NIH’s successful acquisition of a secure, multi-cloud-based research data infrastructure that meets its requirements across the full span of the research activities it supports.

The Data Access Program enclave shall enhance the accessibility, scalability, and analytical capabilities of the NIH research data infrastructure, through secure cloud-based services. This new approach shall involve multiple cloud service providers (minimum of 3) for data storage, with the enclave operator performing cost load balancing across the multiple cloud providers as appropriate for eƯiciency.

Challenges to be overcome in this eƯort include: security; the vast and expanding quantity and types of data to be managed; the functionally diverse and geographically dispersed community of researchers who may require access to the enclave; compliance with FedRAMP and other changing regulatory requirements, culminating in ATO approval which will require third party audit; and the cost and administrative burden of acquiring, establishing, operating, and maintaining the enclave.

Compliance with Federal Standards, Policies, and Procedures The secure, cloud-hosted enclave must adhere to prevailing laws, regulations and compliance standards that include documenting privacy and security controls in a system security plan (SSP) for moderate environment, with supporting documentation needed to achieve an ATO. Cloud services must be FedRAMP certified, and all systems must comply with the Centers for Medicare & Medicaid Services (CMS) Acceptable Risk Safeguards (ARS).

All enclave systems (and the enclave system-of-systems) must comply with the CMS ARS.3

All cloud services must be FedRAMP certified.4

See Section 7 for other standards, policies, and procedures with which the enclave shall comply.

Scope The scope of this task encompasses the hardware, software, security, cloud services, and IT services to design, deliver, maintain, manage, authenticate, authorize, and support a comprehensive, secure, and operational cloud-based enclave system that meets the NIH’s requirements across the full span of its research activities. Specific IT services include, but are not limited to, enclave design, access control protocols across multiple users, and implementation, ATO and regulatory compliance setup and maintenance, software license management, searchability, compute and storage usage management and optimization, operations and maintenance, enclave management, and end user support.

Safeguarding NIH Data in the Enclave

Non-Disclosure The Contractor shall treat all NIH data (including data belonging to or derived from CMS), NIH grants and cooperative agreements, and other federal and non-federal sources as confidential and shall disclose information collected during this contract only to authorized NIH and designated Contractor, or approved users. The Contractor shall add appropriate markings to all documents, as instructed by the COR.

The Contractor shall handle all enclave-hosted data as confidential. The enclave shall protect data-in-transit and data-at-rest using cryptographic mechanisms that conform to Federal Information Processing Standards (FIPS) 140-3. The Contractor shall ensure that all cryptographic mechanisms used to protect enclave-hosted data are FIPS 140-3 validated and are operating in the FIPS-approved mode of operation. In any situation where a NIH-provided secure communications implementation is insuƯicient, the Contractor shall implement an acceptable solution.

3 The CMS ARS is a tailored catalog of NIST SP 800-53 security controls available at:

https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars

4The list of FedRAMP certified products is available at: https://marketplace.fedramp.gov/products

Secure Storage The Contractor shall protect all project and task-related and other contract data from unauthorized access and secure it according to the NIH Information Security policies and standards and consistent with the terms and conditions of the contract.

Secure Communications The Contractor shall implement and use a mechanism for secure file transfer process over non-NIH networks (for example, via email that includes senders or recipients that are not using nih.gov email addresses), because many sensitive documents must be shared during the enclave development process. NIH allows sensitive documentation to be emailed via .zip files encrypted via AES (Advanced Encryption Standard); however, many documents exceed the file size limitation of the NIH Exchange server and NIH has found that many external stakeholders’ email systems may strip .zip files from the email. Any encryption mechanism (secure file transfer server, WinZip/SecureZIP, etc.) used or provided by the Contractor must be FIPS 140-3 validated and be operating in the FIPS-approved mode of operation. In any situation where a NIH-provided secure communications implementation is insuƯicient, the Contractor shall implement an acceptable solution.

Data Retention The Contractor shall return all Government-Furnished Information (GFI) to the government upon the completion of the contract or at the request of the contracting oƯicer. Unless otherwise required by law, no data collected, produced, or accessed under this contract, including but not limited to system data, reports, and analyses, shall be retained by the Contractor beyond the contract period. The Contractor shall ensure that all copies of such data are securely transferred to the government (see Task 1.8: Enclave Transition or Decommission) and any remaining copies in the Contractor’s possession are permanently deleted or destroyed in accordance with government-approved methods. The Contractor shall certify the return and destruction of all GFE/GFI and data within 30 days of contract completion, termination, or upon immediate notice.

Estimated Workload The Contractor shall provide an elastically scalable, secure cloud-hosted data enclave that will increase its storage and compute capabilities based on forthcoming option years.

The initial enclave shall host data sets provided by CMS, to include Medicare and Medicaid data sets that span decades.

The enclave shall also store data from other sources such as other federal agencies and licensed or obtained data from other sources (private or user created).

Large data sets must be stored to include at least 10 Terabytes in block storage and 300 Terabytes in object storage.

Data sets will increase in capacity requirements on a yearly basis as additional data are added to the data sets.

The Contractor shall assume initial support for a minimum of 100 NIH Studies that are linking their data with CMS data at the beginning of the contract period

The Contractor shall assume initial support for a user base that consists of at least 3,000 unique users This includes, at minimum, 100 users participating in the ADSI within the environment with the option to expand storage up to 1TB per user.

The Contractor shall anticipate up to 50% growth of the user base, annually.

The environment shall utilize a minimum of 1 petabyte of data, stored in a scalable, high-performance object storage solution that can integrate with faster access tiers and high-throughput modes across multiple cloud providers.

For GPU-accelerated workloads, the infrastructure shall incorporate GPUs with performance comparable to or exceeding NVIDIA A100 Tensor Core GPUs, while allowing for newer architectures such as the NVIDIA H100 or GH200 for enhanced deep learning and large-scale AI processing.

These Desktop as a Service (DaaS) environments shall deliver scalable, cost-eƯicient, and high-performance compute and storage capabilities, optimized for managing intensive, data-driven workloads across cloud-native infrastructures, and shall be designed to seamlessly integrate future advancements in processor and accelerator technologies as they become available. The contractor shall ensure eƯicient resource utilization across both Data Lake and DaaS environments while optimizing and analyzing operational costs by implementing cost monitoring and optimization tools that:

Analyze data and compute usage patterns Generate regular resource utilization performance reviews

To support the future growth rate, the contractor shall ensure a compute configuration that oƯers a balanced combination of processing power, memory, and network performance to meet the performance expectations with the following specifications:

Virtual Central Processing Units (vCPUs): Ensure there are adequate parallel processing capabilities for our workloads.

CPU Type: High-performance CPUs, such as those based on the latest generation architectures from Advanced Micro Devices (AMD) and Intel, including the AMD 5th-Gen EPYC “Turin”, Intel Xeon “Granite Rapids” and “Sierra Forest”, as well as the NVIDIA Grace CPU Superchip to support eƯicient, large-scale multi-threaded processing for modern compute-intensive workloads.

Performance Class: vCPUs that are comparable in performance to high-tier instance types across major cloud providers. For example, equivalent to:

Amazon Web Services (AWS): c7a.4xlarge or hpc7g instances, oƯering compute-optimized performance with the latest AMD or Graviton3E processors.

Microsoft Azure: Dv5 or HBv4 series, designed for high-throughput and memory-intensive workloads.

CPU Architecture: must be based on modern processor architectures, such as the AMD 5th-Generation EPYC “Turin” and Intel Xeon “Granite Rapids” or “Sierra Forest”, or, where applicable, the NVIDIA Grace CPU Superchip for specialized AI and HPC workloads, that provide:

High single-threaded and multi-threaded performance to support complex data analytics tasks.

A minimum clock speed of 2.4 GHz or higher to ensure eƯicient processing.

Memory: At least 256 GB of Random Access Memory (RAM) (e.g., DDR5), configured to deliver adequate memory bandwidth and multi-channel performance, with support for scaling to 512 GB or more to meet the demands of data-intensive applications without memory bottlenecks.

Network Performance: Enhanced networking capabilities with support for minimum 10 Gbps network throughput, enabling low-latency, high-bandwidth data transfer between instances, across distributed workloads, and to/from external storage systems.

Storage: High-performance NVMe-based Solid State Drive (SSD) storage with a minimum of 4,000 IOPS, capable of supporting low-latency, high-throughput data access and processing for intensive and concurrent I/O workloads

Enclave Onboarding: In support of the data, study and user growth rate, the Contractor shall operate an appropriate onboarding mechanism. Data sets are owned by separate entities who have unique access and control requirements associated with respective data sets and files.

The Contractor shall provide an automated enclave onboarding process that authenticates users in accordance with Identity Assurance Level 2 (IAL2), as defined by NIST SP 800-63A, and FIPS 140-3 as applicable. Identity verification must be revalidated at least annually, as required by data sensitivity, system risk assessments, or study-specific policies. The onboarding process shall ensure secure, scalable, and user-friendly enrollment into the enclave environment, minimizing manual intervention while maintaining compliance with federal identity verification requirements.

The Contractor shall implement a mechanism for provisioning study-specific user workspaces with granular, file-level and variable level access controls, ensuring that only study-authorized individuals can access datasets and variables explicitly approved for their research use. Each user shall be provided with a distinct, access-restricted workspace limited to a defined group of authorized personnel. These workspaces shall enable users to securely retrieve subsets of data and conduct individual analyses, with the option to contribute derived results to broader study datasets as permitted by the study's governance.

The Contractor shall provide mechanisms to support secure data analyses, including the ability to link study-specific data to centrally maintained datasets, with access automatically restricted based on the study’s Data Use Agreement (DUA) terms. All data interactions must occur within the secure enclave environment, with users prohibited from extracting or downloading raw data outside the system.

Task 1.1: Certificate of Liability (1.1.1) The Contractor shall document the purchase of liability insurance in the amount of $100M or more to mitigate risk in the event of a data breach (including both linked and unlinked data) and ensure that this award is listed under the terms of the insurance policy. The Contractor shall provide a letter or certificate documenting this requirement to the COR. If any changes are made to the policy, an updated letter shall be submitted within two weeks of the changes. The COR may request the contractor to obtain additional liability coverage to mitigate risks to the government.

The contractor shall facilitate the procurement of such coverage, and the government will reimburse the contractor for the actual cost incurred, in accordance with applicable contract terms and conditions.

Task 1.2: Enclave Acquisition & Development This task involves the initial design and implementation of the enclave. It will end once the initial version is deployed and achieves a successful ATO.

The purpose of the task is to deliver a comprehensive, secure, and operational enclave system through a structured process encompassing procurement, development, and deployment (including assessment and authorization in a later subtask) within 6 months (128 business days) of contract award. Initially, the focus is on acquiring the necessary hardware, software, and cloud services, ensuring all components meet project specifications and are delivered as required. In the development phase, the system’s architecture is meticulously planned and implemented, integrating cloud infrastructure, data lakehouse solutions, and DaaS setup while enforcing stringent security measures and conducting thorough testing to ensure performance and compliance. The deployment phase finalizes the system, transitioning it to operational status with detailed documentation, confirmation of successful deployment, and obtaining an ATO, ultimately resulting in a fully functional enclave system that meets all design specifications, security standards, and operational requirements, and is ready for production use.

Technical Specifications and Implementation The contractor shall ensure that all phases of the project comply with the specified standards, eƯectively managing risks and delivering high-quality results. Adherence to GAO, FedRAMP, CMMI, and DAMA-DMBOK standards is crucial for the success of the project.

The Contractor shall provide the necessary hardware, software, and cloud services based on the approved Enclave Architecture Design Document and Technical Requirements Specification Document.

The Contractor shall also include ATO (including third-party audits) and regulatory compliance setup and maintenance, software licensing, compute and storage use, operations and maintenance, enclave management, and end user support to includes continuous security monitoring to safeguard the data.

All software, data, and associated licenses required for performance under this Contract shall either be: (1) procured in the name of the National Institutes of Health (NIH); or (2) transferred to NIH or its designee at no additional cost upon completion or termination of the Contract, or upon NIH’s request, whichever occurs first.

The Contractor shall ensure that NIH retains full and unrestricted ownership, access, and usage rights to all such software, data, and licenses. The Contractor shall not enter into any licensing agreements or arrangements that would impose restrictions on NIH’s continued use, transfer, or control of any such items beyond the term of the Contract.

The Contractor shall indemnify NIH against any third-party claims, liens, or encumbrances arising from the use, licensing, or transfer of such assets. The Contractor shall ensure that all licenses are perpetual (where feasible), transferable, and free of usage limitations that would impede NIH’s operational, legal, or security obligations.

The Contractor shall ensure that all purchased components meet the specified requirements, including quality assurance and compliance, and are delivered on time.

Comprehensive Coordination with the Requirement Team Requirement Review:

o Ensure all requirement components are reviewed thoroughly by coordinating with the

NIH.

o Address any feedback or changes required to finalize the requirements.

Approval Process:

o Facilitate the approval process for all requirement components, ensuring that approvals are obtained from relevant stakeholders and decision-makers.

The Contractor shall coordinate with the requirement team to ensure that all requirement components are reviewed and approved.5

Architectural Design and Technical Specification (1.2.1) The Contractor shall develop and deliver a Technical Requirements Specification Document. The Contractor shall identify and evaluate potential vendors and service providers for the enclave components including cloud services, data lakehouse solutions, scalability, cost and security, and DaaS systemss. The Technical Requirements Specification document must include the following:

Cloud Services: specify technical requirements for cloud services, including compute, storage, and network configurations.

Scalability: define requirements for scalability to accommodate growth and varying loads.

Security Compatibility: detail security measures and compatibility requirements to ensure secure cloud operations.

Cost Considerations: prepare cost models and pricing structures for proposed solutions, including initial investment, ongoing operational expenses, and anticipated total cost of ownership. Include recommendations to ensure cost-eƯectiveness and long-term financial sustainability.

Collaboration: describe collaboration with the NIH, CMS, and other relevant entities to gather and integrate requirements.

The Contractor shall implement, maintain, and support a secure, cloud-hosted data enclave. The enclave shall host data and storage components with one or more suitable cloud service providers.

The enclave shall support large data storage and retrieval mechanisms and conform to a FISMA Moderate information system aligned with Zero Trust principles, including identity-based access controls, continuous authentication, least privilege enforcement, and network micro-segmentation.

5 The CMS ARS is available at: HYPERLINK "https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars"https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars

Figure 1 - Reference Architecture

Figure 1 provides a reference architecture that the contractor shall provide to satisfy the secure, cloud-hosted data enclave. The contractor shall provision the data enclave using a cloud service provider that has achieved FedRAMP Moderate accreditation. All components that make up the enclave shall be commercially available through the cloud service provider with privacy and security controls that have achieved FedRAMP Moderate as a threshold as well. Figure 1 depicts data sources from which research data shall be ingested. Data sources are outside the scope of the contractor-provided solution. However, the enclave shall implement a mechanism to perform ingest, link, and anonymize functions. This mechanism shall apply Privacy Preserving Record Linkage (PPRL).

The enclave shall include a data lake that allows data management where source data owners maintain data governance for the data. Figure 1 depicts sourced data in segmented cloud storage, wherein source data are stored in respective cloud storage constructs. The data lake shall include mechanisms that provide dashboards, data services, provisioning, and user support.

The data lake shall interface with an analytical platform as well as a data warehouse that provides business intelligence (BI). The analytical platform shall integrate with the data lake and the data warehouse components and have analytic capabilities such as machine learning or artificial intelligence applications. The data warehouse and BI component shall include virtual tools and dashboards.

The contractor shall manage and maintain the DaaS and virtual desktop environment to ensure it aligns with the principles outlined in the DAMA-DMBOK and CMMI frameworks. This includes implementing robust data governance and architecture practices to ensure data integrity, security, and compliance, while integrating eƯective data quality management and seamless data integration. Additionally, the contractor shall apply CMMI best practices in process management, project management, and continuous improvement to enhance the eƯiciency and reliability of virtual desktop operations. The Contractor is responsible for establishing well-documented processes, providing comprehensive support, and utilizing metrics to drive improvements.

The Contractor shall oversee the management of virtual desktop images in compliance with NIH configuration specifications. These virtual desktop images shall incorporate analytics software, including, but not limited to, Jupyter Notebooks, STATA, Python, SAS Analytics, MATLAB, and R. The Contractor shall manage and maintain a central data storage space that supports up to 10 terabytes workspace and gradually increase as more data will be added monthly.

The Contractor shall manage and support study-specific data storage, ensuring that each study’s environment is securely isolated to prevent unauthorized access from non-study users. Study-specific data storage shall be configured with the following components:

Immutable Data Storage – A dedicated storage area that enables the retrieval of immutable datasets, implemented as a write-once, read-many (WORM) solution to ensure data integrity.

Study Workspace – A shared workspace where authorized study users can both read and write data, facilitating collaborative research within the study environment. The Study Workspace includes both a Study Collaboration Workspace and Study Repository. The study collaboration workspace shall allow study users to read and write data. The study repository shall allow study administrators and principal investigators to read and write data and allow study researchers to read data.

Researcher Workspace – A personal workspace assigned to individual researchers, allowing them exclusive read and write access for conducting analyses and managing data.

Data Linkage Environment – A secure environment designed for performing data linkages across multiple datasets, allowing researchers to integrate study-specific data with external datasets in a controlled, auditable, and compliant manner, with personally identifiable information (PII) and/or Privacy-Preserving Record Linkage (PPRL) strategies.

The data storage infrastructure shall be designed for high availability, security, and scalability, incorporating role-based access controls (RBAC) to manage permissions and encryption to protect data at rest and in transit.

The contractor shall provision a mechanism that manages data access. The data management mechanism shall:

Implement RBACs for the data linkage team; study administrator; study principal investigator; and study users.

Allow studies to retrieve data from the central repository and are prevented from changing or deleting centrally stored data.

Allow users to share data from their individual Study Workspace to the study collaboration workspace.

Ensure that study users are prevented from changing or deleting data stored in the study workspace and are limited to changing or deleting data to respectively assigned researcher user workspace only.

Ensure that access controls defined in the study DUAs are enforced.

Ensure that data provisioning can be tracked using master data management principles.

The Contractor shall implement, maintain and support an on-demand pool of server instances that conform to server configuration standards. The Contractor shall ensure that components, operating systems, configuration and software adhere to appropriate standards that conform to FISMA Moderate environments.

The Contractor shall implement a mechanism by which study researchers submit process jobs to a server pool resource. Job submissions shall ensure that data confidentiality and integrity are preserved throughout job submission, processing, and results delivery. Processed jobs shall deliver results to the study researcher only.

The Contractor shall ensure that all data at-rest and in-transit are appropriately secured using an AES-256 encryption mechanism compliant with Federal Information Processing Standards (FIPS) 140-3.

The Contractor shall manage and maintain the virtual desktop environment via DaaS in alignment with DAMA-DMBOK and CMMI frameworks, with specific deliverables set for 3 months and 6 months:

Within 3 Months:

Initial Setup and Configuration: Implement and configure the virtual desktop environment via DaaS to support Microsoft Windows virtual workstations, adhering to NIH specifications and integrating essential analytics software such as Jupyter Notebooks, SAS Analytics, Stata, MATLAB, Python, and R-Shiny, Adobe Acrobat Reader, Microsoft Excel, Microsoft Word, Notepad++.

Data Governance and Architecture: Establish initial data governance policies and architecture, including the setup of data lakes for centralized storage and management of large datasets, following DAMA-DMBOK principles.

Process Documentation: Develop and document processes for managing user support, data access, and system maintenance within the virtual desktop environment adhering to DAMA-DMBOK and CMMI best practices.

Security Measures: Apply initial security measures, including AES-256 encryption for data at rest and in transit, and implement access controls to safeguard data within the environment, ensuring compliance with FISMA Moderate standards.

Within 6 Months:

Full Deployment and Optimization: Complete the full deployment of the environment, optimizing virtual workstations and analytics tools to enhance performance and user experience.

Comprehensive Data Management: Fully implement data management practices, including robust data quality management, regular audits, and validation processes to ensure the accuracy and reliability of data in the data lakes.

Process Improvement and Training: Refine virtual desktop management processes based on feedback and performance metrics. Provide training for users and administrators on new processes and best practices, in alignment with CMMI continuous improvement principles.

Advanced Security and Compliance: Conduct a thorough security audit and implement additional measures as needed to address identified risks. Ensure ongoing compliance with FISMA, Zero Trust, and other applicable regulations and standards.

Performance Metrics and Reporting: Establish and utilize performance metrics to monitor operations and drive continuous improvements. Provide comprehensive reporting on system performance, security, and user support, including updates on data lake utilization and compliance status.

Authorization to Operate (ATO): Achieve and maintain Authorization to Operate (ATO) status across 3 cloud vendors by ensuring that the DaaS virtual desktop environment meets all required FISMA Moderate security controls and compliance requirements within 6 months of the award (including completion of a third-party audit and obtaining approval from NIH). This phased approach ensures that the DaaS virtual desktop environment is established adequately, secured, and continuously improved, meeting both immediate operational needs and long-term regulatory compliance requirements.

The Contractor shall develop a comprehensive Enclave Architecture Design Package that includes:

(1.2.2) System Diagram

(1.2.3) Data Flow Diagram and Documentation

(1.2.4) Integration Points Specification Document

(1.2.5) Data Ingestion Plan

(1.2.6) Data Storage Architecture Document

(1.2.7) Extract, transform, load (ETL) and ETL Evaluation Report

(1.2.8) Data Lakehouse Integration Plan

(1.2.9) DaaS virtual desktop setup Document

(1.2.10) Master Data Management Implementation Plan

(1.2.11) Metadata Management Plan

Continuous Monitoring The contractor shall implement and maintain a comprehensive Continuous Monitoring (ConMon) program to ensure the ongoing security and performance of the enclave. This program shall follow NIST 800-137 guidelines and include automated security compliance tools to dynamically monitor, detect, and respond to security threats in real-time. The continuous monitoring solution shall cover all aspects of system operations, including, but not limited to network activity, user access, and data flows, and shall integrate seamlessly with the enclave’s Zero Trust Architecture.

In addition to a ConMon program, the contractor shall implement automatic generation of system documentation and compliance reports and dashboards. When applicable the contractor shall implement AI-powered compliance auditing tools.

Zero Trust Architecture The Contractor shall implement and maintain a Zero Trust Architecture6 in alignment with the Cybersecurity and Infrastructure Agency (CISA) Zero Trust Maturity Model7 throughout the enclave.

The Contractor shall achieve the Advanced level of Zero Trust Maturity no later than 6 months after award. The CISA Zero Trust Maturity Model defines the Advanced level as:

Advanced – wherever applicable, automated controls for lifecycle and assignment of configurations and policies with cross-pillar coordination; centralized visibility and identity control; policy enforcement integrated across pillars; response to pre-defined mitigations;

changes to least privilege based on risk and posture assessments; and building toward enterprise-wide awareness (including externally hosted resources).

Data Encryption The Contractor shall ensure that all sensitive data, including government, healthcare, and research data, is protected via encryption both at rest and in transit using FIPS 140-2 validated encryption.

The system shall use encryption algorithms that meet or exceed federal standards, such as AES- 256 for data at rest and TLS 1.2 or higher for data in transit and shall implement tamper-proof audit logging for all sensitive data transactions. Additionally, the Contractor shall enforce compliance with data use agreements (DUAs) created by the sponsor to govern how data is accessed, shared, and used.

Role-Based Access Control The Contractor shall implement a scalable role-based access control (RBAC) solution that can scale to accommodate multiple roles and parties accessing the system and same workspace (e.g., multiple studies providing approval so data can be pooled in one workspace to lower transaction cost) and shall ensure multiple studies can grant approval to pool data within a shared workspace.

The RBAC system shall support provisioning consistent with MDM principles, and enforce least privilege principles, ensuring that users only have access to the data and resources necessary for their role, as defined in their Data Use Agreement (DUA), and as dictated by NIH policies. The contractor shall perform identity validation at least annually, or more frequently as required by NIH policies or risk management guidelines.

The confidentiality, integrity, and availability of NIH controlled-access data must be protected in accordance NIH policies including NOT-OD-24-157: Implementation Update for Data Management and Access Practices Under the Genomic Data Sharing Policy and

6 Zero Trust Architecture | NIST (https://www.nist.gov/publications/zero-trust-architecture ) 7 CISA Zero Trust Architecture…