FDA-21-RFQ-1246411_CAPA Systems .pdf

FDA-21-RFQ-1246411 Page 1 of 36 Pilot Analytics Tool for CAPA System

Offeror Name DUNS

PART 1 – GENERAL INFORMATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR 12.6 and 13.1 as supplemented with additional information in this notice. Quotes are being requested and this announcement constitutes the only solicitation. The Government contemplates issuing a firm fixed-price contract resulting from this solicitation. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular FAC 2021-05 dated March 10, 2021.

The associated North American Industrial Classification System (NAICS) code for this procurement is 541690 – Other Scientific and Technical Consulting Services, with an associated size standard of $16.5 million. This requirement is being solicited as a total small business set-aside.

PART 2 – SUPPLIES OR SERVICES AND PRICES/COSTS

Contract Type: This is a restricted procurement, and the government anticipates awarding a firm-fixed price Directed 8(A) award with International Consulting Associates, Inc., DUNS:

831361170, CAGE: 5LPY7. The vendor is an 8(a) and Hub Zone certified company (certification: 61038), which has demonstrated experience that is relevant to the contract requirements.

2.1 Firm Fixed Pricing

Line Item

Description Unit of Issue

Unit Price

Quantity Total Price

1 Development of

CAPA System Monthly

TOTAL $

2.2 Pricing Table for Quote:

Contract Line Item Description

Base Period

Labor Category

Quantity (Hours) Unit Quantity Unit Price Total Price

Principle Data Scientist

1928 each 1 $ $

Data Scientist I 1928 each 3 $ $

FDA-21-RFQ-1246411 Page 2 of 36

Data Engineer 1928 each 2 $ $ Full Stack Web Developer

1800 each 2 $ $

Senior Software Developer

1928 each 1 $ $

Artificial Intelligence Engineer

1800 each 2 $ $

Senior Program Manager

1928 each 1 $ $

Software Developer II

1928 each 4 $ $

AWS Cloud Architect

900 each 1 $ $

ODCs $ 30,008.00 (Not to Exceed)

Total $ -

Payment Schedule:

Payments shall be made in equal monthly, and no advanced payments will be made.

PART 3 – DESCRIPTION OF REQUIREMENT

Background

The Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biological products, medical devices, our nation’s food supply, cosmetics, and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make medicines and foods more effective, safer, and more affordable, and helping the public get the accurate, science-based information they need to use medicines and foods to improve their health.

The mission of the Center for Devices and Radiological Health (CDRH) is to protect and promote the public health. CDRH assure that patients and providers have timely and continued access to safe, effective, and high-quality medical devices and safe radiation-emitting products.

We provide consumers, patients, their caregivers, and providers with understandable and accessible science-based information about the products we oversee. We facilitate medical device innovation by advancing regulatory science, providing industry with predictable, consistent, transparent, and efficient regulatory pathways, and assuring consumer confidence in devices marketed in the U.S. CDRH’s science-based public health mission runs on data, and rapid developments in the availability of data storage and economically feasible computing

FDA-21-RFQ-1246411 Page 3 of 36 power have paved the way for CDRH to harness data in powerful new ways to advance our public health mission.

The CDRH is increasingly managing large volumes of complex, novel, and often disparate datasets across siloed and outdated systems and databases that are difficult to connect for strategic decision making. Putting sophisticated data to work to improve health outcomes for the American public will require new strategies and modern technologies for aggregating, analyzing, and interpreting data, as well as advanced approaches to interoperability across industry.

A modern analytics infrastructure that utilizes critical postmarket surveillance data about medical devices, paired with real-world performance data, can enable the CDRH to take full advantage of advanced capabilities like data visualization, artificial intelligence, machine learning and blockchain for track-and-trace. This can be integrated into existing CDRH software architecture, in particular efforts that have been underway to create an analytics dashboard that utilizes artificial intelligence for signal detection, to help the CDRH develop a Corrective Action and Preventative Action (CAPA) system that will allow postmarket data to rapidly be analyzed and used to direct other regulatory processes.

In addition to providing a more comprehensive assessment of available postmarket surveillance data for the FDA, this CAPA system also has the potential to allow the FDA to reduce burdens and costs of data collection on device stakeholders and improve patient access to safe and effective medical devices.

The CDRH aims to develop the CAPA system that allows the use of artificial intelligence methodology and algorithms to analyze data to identify trends and signals, assess device performance across different devices, and use postmarket data to analyze premarket processes and inform process changes or other ways to more efficiently approach premarket data collection in the future.

The CDRH requires contract to support to apply artificial intelligence in the development of this CAPA system, which would be integrated into a pilot analytics tool, using medical device postmarket surveillance data.

Objectives

The objective of this acquisition is to identify and complete the appropriate data mining, cleaning, and structuring efforts associated with CDRH postmarket surveillance data needed to build a machine learning platform that can function as an internal CAPA system at the CDRH.

This acquisition includes data cleaning and data mining efforts of CDRH data and the development of a CAPA system integrated into an existing pilot analytics tool that uses natural language processing and machine learning methodology.

Additionally, this requirement includes a user interface or user dashboard that can be navigated by CDRH staff in order to utilize the analytics data for regulatory decision-making.

Scope

FDA-21-RFQ-1246411 Page 4 of 36

The contractor shall review postmarket surveillance data sources collected by the CDRH during the medical device life cycle, identify the data mining and cleaning efforts needed to structure or efficiently use the key data fields, and identify the best methodology needed to build a CAPA system into an existing pilot analytics tool using natural language processing and machine learning to identify signals and key items of interest to the CDRH in accordance with pre-identified objective criteria. The contractor shall present these recommendations to the CDRH for approval.

After approval from the CDRH on best/most appropriate models for completing the tasks, the contractor shall then conduct the data mining, cleaning and structuring techniques. The contractor shall develop the methodology needed to apply artificial intelligence to analyze the data and meet the objectives of:

• Developing a CDRH data driven CAPA system used to collect information, analyze data, identify and investigate device performance or quality problems, and recommend an appropriate corrective action to prevent their recurrence. This can include:

o Identifying trends in device performance including specific trends that cross device specialties;

o Determine a statistically relevant baseline for surveillance of device events, and the criteria needed to identify data that is out of boundaries, indicating a signal of interest;

o Identifying signals with devices, defined as increased or unexpected risk to patients, device malfunctions, usability or quality issues with devices and other pre-defined events;

o Identify signals with device manufacturers or manufacturing sites, defined by trends or increases in manufacturing-related data;

Assessing CDRH’s postmarket surveillance data and identifying areas where more efficient or informed data can be collected premarket or process improvements can streamline the overall medical device clearance/approval or surveillance processes.

Tasks

The Contractor shall be responsible for delivering the following core tasks:

• Task One: Project Management

• Task Two: Identify Data Structuring and Extraction Needs; Execute Most Beneficial

Methodologies

• Task Three: Identify Artificial Intelligence Algorithms and Methodology Needed To

Assess Available Postmarket Surveillance Data; Build A Prototype CAPA System Integrated Into Pilot Ai Tool

A detailed description of required tasks follows:

Task One: Project Management

Subtask One: Initial Business and Technical (Kick-Off) Meeting

FDA-21-RFQ-1246411 Page 5 of 36

Within ten (10) business days following the contract award date, the contractor shall attend a Kick-Off Meeting to review task order goals and objectives, and to discuss technical requirements, administrative matters, security requirements, project transition, Government Furnished Information (GFI), the milestone schedule, review cycles, and invoicing. The contractor shall provide an agenda for the kickoff meeting 2 days prior to the meeting.

During the meeting, the contractor shall present its plan and schedule for performing the tasks.

The meeting shall be attended by all contractor key personnel and shall be held at the Government’s facility or virtually. The contractor shall record discussions during the kick-off meeting and provide a meeting minutes report within five (5) workdays after the meeting date.

Subtask Two: Project Plan and Schedule

The contractor shall develop a proposed schedule and high-level project plan. The contractor shall identify in the project plan the resources that the CDRH needs to provide for this effort. The Contractor shall ensure the project plan aligns the contract tasks and outline the supporting subtasks and projected timeline in enough detail to convey the associated activities, objective of the subtask, and alignment with the contract task or associated goal so that CDRH can provide relevant feedback. The Contractor shall ensure the project plan defines and details timelines and deliverables as well as any dependencies or associated constraints.

The Contractor shall provide the project plan to the COR in electronic format using one of the Microsoft Office products viewable and editable by FDA, such as MS Word, MS Excel, or MS PowerPoint. The Contractor may also deliver the project plan in MS Project format using MS Project 2013 or later.

The contractor shall present the draft PWP at the Kick-Off Meeting and shall submit the draft project plan to the COR and Technical POC within (5) business days of the kickoff meeting. If the COR determines that revisions are required to the project work plan, within fifteen (15) business days after the kickoff meeting, the Contractor shall meet with the COR to discuss required revisions. Within twenty (20) business days after the kickoff meeting, the Contractor shall submit a revised project work plan that addresses the revisions and issues discussed at the Day 15 meeting. If the revised project management plan requires additional revisions, the Contractor shall work interactively with the Government to address these issues so that the project management plan is approved by the Government within thirty (30) business days after the kickoff meeting.

The Contractor shall ensure the final draft of the project includes the timeline for all tasks and subtasks alongside detailed descriptions of deliverables and their respective due dates.

Subtask Three: Twice Monthly Meetings

The contractor shall meet with the OCEA/CDRH team biweekly to report out on progress of the recommendations and development under this contract. The meetings can be in person at FDA or by webcast. The contractor shall record discussions during all meetings and provide a meeting minutes report within five (5) workdays after the meeting date.

FDA-21-RFQ-1246411 Page 6 of 36

Task Two: Identify Data Structing and Extraction Needs; Execute Most Beneficial Methodologies

The contractor shall conduct a data analysis of the postmarket surveillance data, provide Data Mining and Data Cleaning recommendations, and Execute Data Cleaning and Data Mining based on approved recommendations.

The contractor shall execute all steps needed to mine, clean and extract the structured data and use it in the AI/ML algorithms proposed in Task Three: Identify Artificial Intelligence Algorithms and Methodology Needed To Assess Available Postmarket Surveillance Data And Build A Prototype CAPA System Integrated Into a Pilot AI Tool.

All efforts conducted under this contract shall be provided to CDRH at the end of the contract and will be owned and managed by CDRH moving forward.

Subtask One: Identify and Analyze

The contractor shall conduct a data analysis of the postmarket surveillance data to identify which medical device data fields, collected by or provided to the CDRH, can be analyzed to identify signals, trends, device performance analytics and areas where postmarket data can better inform premarket decisions and processes through a CAPA system.

The contractor shall assess data from postmarket sources and identify key drivers in premarket data that can be affected by the key data provided in the postmarket. The data assessment should also include identification of the key data fields that meet the objectives of a CAPA system integrated into a pilot AI tool.

Subtask Two: Provide Recommendations

Once the data analysis is completed, the contractor shall recommend to CDRH which data fields will be most beneficial to mine and structure for use in the development of the CAPA system integrated into the pilot AI tool. The contractor shall also identify the optimal extraction techniques to utilize the structured data in AI/ML methodology.

Subtask Three: Execute Data Cleaning and Data Mining

Based on approval of the recommendations made to CDRH, the contractor shall execute the data cleaning and data mining efforts. The data cleaning and mining efforts may use techniques that might include but not be limited to OCR text analysis for data cleaning and extraction and natural language processing for data structuring to identify device signals and performance trends. CDRH experts will provide criteria for defining a signal of interest in the CAPA system and will work with the contractor to identify objective performance criteria to be measured by the tool to enhance signal detection.

Task Three: Identify Artificial Intelligence Algorithms and Methodology Needed to Assess Available Postmarket Surveillance Data; Build A Prototype CAPA System Integrated Into A Pilot AI Tool

FDA-21-RFQ-1246411 Page 7 of 36

The contractor shall identify artificial intelligence methodology to utilize in postmarket surveillance data, provide Artificial Intelligence Methodology Recommendations, develop a prototype CAPA system, collect feedback, and deliver a refined final version of the CAPA system.

Subtask One: Identify and Analyze

The contractor shall identify artificial intelligence methodology, including machine learning techniques, to utilize the postmarket surveillance data in its post-data-cleaning and post-data-mining phase to develop a prototype CAPA system integrated into a pilot AI tool.

Subtask Two: Provide Recommendations

The contractor shall recommend artificial intelligence methodologies to CDRH with an assessment of the strengths and weakness of each method.

Subtask Three: Develop Prototype CAPA System

Based on the final methodology selected by CDRH, the contractor shall execute the application of AI to develop a tool that utilizes a CAPA system.

The contractor shall develop a prototype CAPA system in the pilot AI tool, conduct appropriate user testing, and ensure a user-friendly platform or dashboard can feed the data from the analytics tool to a team of CDRH staff. All tools developed under this contract shall be provided to CDRH at the end of the contract and will be owned and managed by CDRH moving forward.

The contractor shall develop data visualizations in the tool that can allow CDRH staff to view CAPA system recommendations. The contractor shall develop data visualizations in the tool that can allow CDRH staff to identify signals, particularly trends across device areas, suppliers, technologies, or manufacturers.

Both of these data visualizations must be present in both the prototype and final version of the CAPA System as described in 4.3.3 Develop Prototype CAPA System and 4.3.4 Collect Feedback and Deliver Final Version of CAPA System.

Subtask Four: Collect Feedback and Deliver Final Version of CAPA System

After user testing and feedback is received from CDRH users, the contractor shall refine the prototype type and user interface and deliver a final version of the tool by the end of the period of performance.

PART 4 – PACKAGING, MARKING, and SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and contractor name. The contractor shall guarantee that all required

FDA-21-RFQ-1246411 Page 8 of 36 materials shall be delivered in immediate usable and acceptable condition. All delivered equipment shall be newly manufactured, not used or refurbished or previously used for demonstration

PART 5 – INSPECTION And ACCEPTANCE

The COR, as a duly authorized representative of the Contracting Officer, shall assume the responsibilities for monitoring the Contractor’s performance, evaluating the quality of services and products provided by the Contractor, and performing final inspection and acceptance of all deliverables.

The Government will closely monitor the Contractor’s performance in terms of accuracy, quality and timeliness of deliverables, and responsiveness to requests.

The COR may inform the Contractor of any rejections verbally, electronically, or in writing.

Unless otherwise noted, the COR will accept or reject deliverables within fourteen (14) workdays.

PART 6 – DELIVERIES OR PERFORMANCE

Deliverables Table:

Task Deliverables Quantity/Frequency Due Date

3.1.1 Kick-Off Meeting Minutes One / Once

Within five (5) days of the Kick-Off Meeting.

3.1.2 Project Plan and Schedule One / Once

At Kick-Off meeting, within ten (10) days of award.

3.1.3 Twice Monthly Meeting Minutes Multiple Within five (5) days of biweekly meetings.

3.2.2 Data Mining and Data Cleaning

Recommendations One Time

Forty-five (45) calendar days after contract start date

3.3.2 Artificial Intelligence Methodology

Recommendations One Time

Ninety (90) calendar days after contract award date

3.3.3

Development of prototype CAPA System in Pilot AI Tool with Visualizations and Signal Detection Capability

One Time

One hundred and eighty (180) calendar days after contract award date

FDA-21-RFQ-1246411 Page 9 of 36

3.3.4 Development of final CAPA System in Pilot AI Tool with Visualizations and Signal Detection Capability

One Time Three hundred (340) calendar days after contract award date

Government-Furnished Property

After appropriate security clearance is obtained by contractor personnel, CDRH will provide access to the current prototype tool and all sample data that needs to be analyzed as part of this contract. All data is considered confidential and proprietary. The contractor shall not share the information with person or entity outside of the contract.

Government furnished property (materials, equipment, and/or information) may be provided in conjunction with required performance under this contract, as determined by mutual agreement between FDA and the Contractor.

When the Government provides equipment, the Contractor shall maintain a detailed inventory accounting system for Government Furnished Property (GFP) following contract award. The inventory accounting system must specify, at a minimum:

• Product description (make, model)

• Government tag number

• Date of receipt

• Name of receipt

• Location of receipt

• Current location

• Contract/order number under which the equipment is being used

The Contractor shall attach an update inventory report to each MPR unless otherwise specified by the COR. In either case, the Contractor’s inventory listing must be available for Government review within one (1) business day of COR request. The Contractor shall remain responsible and accountable for all GFP for the duration of the contract and ensure the return of the property upon completion of all work required under this contract.

CDRH Property Custodian:

Name: Cedric Amey U.S. Food and Drug Administration White Oak Campus Building 66 10903 New Hampshire Ave Silver Spring, MD 20993 Phone: 301-796-2306 Email: Cedric.Amey@fda.hhs.gov

Place of Performance mailto:Cedric.Amey@fda.hhs.gov

FDA-21-RFQ-1246411 Page 10 of 36

The contractor’s facility is the primary place of performance for this contract. However, much of the initial work under this contract may require the contractor to temporarily work on-site at the government’s facility for meetings or coordination with the COR or other government personnel.

During on-site performance, the government will provide a temporary work space. The CDRH will provide laptops to contractors and will provide access to CDRH databases, pending appropriate security clearances are received by contractor personnel. The location for on-site performance is the FDA’s White Oak Campus, located at:

Food and Drug Administration 10903 New Hampshire Avenue Silver Spring, MD 20993 Building 66

Government Provided Information

The Government will furnish information as needed for the Contractor to fulfill the obligations of the contract.

The contractor shall not release any information concerning the contract or any information gained due to such work without the advance, written consent of the contracting officer. Much of the work performed shall be considered management confidential and may at times be subject to the Privacy Act. All contractor work product produced by the contractor while under contract with the FDA shall be considered the property of the Federal Government.

Travel No travel will be required under this contract.

Key Personnel

The listed contractor personnel performing on this contract are considered key personnel and are critical to the successful and timely performance of all tasks.

Prior to placing an individual in a key personnel position, the contractor shall ensure the individual has the knowledge, skills, and abilities necessary to successfully perform the tasks in this SOW.

The following position is a Key Personnel position: Senior Data Scientist, Senior Analytics Developer, Software Developer, and Machine Learning Engineer.

Labor Category Key Personnel Description Senior Data Scientist Y Advanced degree (MS or PhD) in one of the following fields:

statistics, engineering or computer science.

FDA-21-RFQ-1246411 Page 11 of 36

At least 10 years’ experience in the field of data science, including skills in natural language processing and experience working with unstructured data fields.

Experience using Python and previous background in one or more of machine learning, deep learning (CNNs, RNNs, LSTMs, GANs), and familiarity with deep learning libraries (TensorFlow, PyTorch, etc.).

Senior Analytics Developer Y A minimum of a Bachelor’s degree in one of the following fields: computer science, programming, engineering or mathematics.

At least 10 years’ experience as an independent developer with experience in a variety of programming languages, such as C++, C#, JavaScript, and Python.

Experience define, develop, test, analyze, and maintain new software applications in support of the achievement of business requirements

Software Developer Y A minimum of a Bachelor’s degree in one of the following fields: computer science, programming, computer engineering/software engineering or mathematics.

At least 5 years’ experience as an independent developer with experience in a variety of programming languages, such as C++, C#, JavaScript, and Python.

FDA-21-RFQ-1246411 Page 12 of 36

Machine Learning Engineer Y Advanced degree (MS or PhD) in one of the following fields:

statistics, engineering or computer science.

At least 5 years’ experience using open source programming languages such as Python to manipulate and analyze data.

Experience with natural language processing.

Ability to utilize predictive modeling concepts, machine-learning approaches, and/or optimization algorithms to analyze data.

Experience with weakly-supervised/semi-supervised/self-supervised training.

Experience with training ML models under data-starved conditions.

Period of Performance

The period of performance is twelve (12) months

PART 7 – CONTRACT ADMINISTRATION DATA

The following personnel shall represent the Government for the purpose of this contract:

Contracting Officer’s Representative (COR):

Name: Tasha McMillian U.S.FDA, White Oak Campus 10903 New Hampshire Ave, Building 66 Silver Springs, MD 20993 Telephone Number: 301-796-5113 Email Address: Tasha.McMillian@fda.hhs.gov mailto:Tasha.McMillian@fda.hhs.gov

FDA-21-RFQ-1246411 Page 13 of 36

The COR is responsible for: (1) monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

Contracting Officer (CO): Contract Specialist (CS):

Gary Klaff Rodney D. Aytch 4041 Powder Mill Road 4041 Powder Mill Road Beltsville, MD 20705 Beltsville, MD 20705 Gary.klaff@fda.hhs.gov Rodney.Aytch@fda.hhs.gov Tel: (240) 402-7555 Tel: (240) 402-7514

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to (1) Direct or negotiate any changes in the RFQ; (2) Modify or extend the period of performance; (3) Change the delivery schedule; (4) Authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) Otherwise change any terms and conditions of this order.

Holiday and Government Closures

The Contractor is not required to provide on-site services on the following days that are Federal Holidays or on any other day designated as a Federal holiday, Government closure, or shut-down for the Washington, D.C. area:

New Year's Day Martin Luther King Day President 's Day Memorial Day Independence Day Labor Day Columbus Day Veteran 's Day Thanksgiving Day Christmas Day

The Contractor shall not schedule training during federal holidays or Government closure. As necessary, training scheduled during unexpected Government closures may be rescheduled following coordination with the COR. The Contractor shall not bill the Government for any training that the Contractor did not perform due to any Government closures

Section 8(a) Direct Award – Partnership Agreement Between SBA and HHS

A. This contract is issued as a direct award between the Food and Drug Administration (FDA) and the 8(a) Contractor in accordance with the Partnership Agreement between the Small mailto:Gary.klaff@fda.hhs.gov

FDA-21-RFQ-1246411 Page 14 of 36

Business Administration (SBA) and the U.S. Department of Health and Human Services (HHS). SBA does retain responsibility for 8(a) certification, 8(a) eligibility determinations and related issues, and providing counseling and assistance to the 8(a) Contractor under the 8(a) program. The cognizant SBA district office is:

Small Business Administration 409 3rd Street, NW 2nd Floor Washington, DC 20416 dcofferletters@sba.gov

B. FDA is responsible for administering the contract and taking action on behalf of the Government under the terms and conditions of the contract. FDA must, however, give advance notice to SBA before FDA issues a final notice terminating performance, either in whole or in part, under the contract. FDA must coordinate with SBA before processing any novation agreement. FDA may assign contract administration functions to a contract administration office

C. The Contractor agrees:

(1) To notify the Contracting Officer, simultaneous with the Contractor's notification to SBA (as required by SBA's 8(a) regulations) when the owner(s) upon whom 8(a) eligibility is based plan to relinquish ownership or control of the concern. Consistent with 15 U.S.C. 637(a)(21), transfer of ownership or control must result in termination of the contract for convenience, unless SBA waives the requirement for termination before the Contractor actually relinquishes ownership and control.

(2) That it shall adhere to the requirements of FAR 52.219-14, Limitations on Subcontracting.

D. Costing: The Contractor warrants that the costs charged under this contract shall not exceed the costs charged by the Contractor to its most favored customers for like items or services under comparable conditions.

The 8(a) partnership agreement between the SBA and HHS applies to this requirement. The document can be found at:

https://www.sba.gov/sites/default/files/files/Department%20of%20Health%20and%20Human%2 0Services.pdf

FDA Three-Way Match Invoicing Procedures:

A. The contractor shall submit all invoices to:

U.S. FOOD AND DRUG ADMINISTRATION

Attn: Vendor Payments Division of Payment Services mailto:dcofferletters@sba.gov https://www.sba.gov/sites/default/files/files/Department%20of%20Health%20and%20Human%20Services.pdf https://www.sba.gov/sites/default/files/files/Department%20of%20Health%20and%20Human%20Services.pdf

FDA-21-RFQ-1246411 Page 15 of 36

10903 New Hampshire Ave WO32 - Second Floor

MAIL HUB 2145

Silver Spring, MD 20993-0002 301-827-3742 FDAVendorPaymentsTeam@fda.hhs.gov

*** Acceptable methods of delivery include: E-mail (preferred) and Standard Mail.

B. Invoices submitted under this contract must comply with the requirements set forth in FAR Clauses 52.232-25 (Prompt Payment) and 52.232-33 (Payment by Electronic Funds Transfer - System for Award Management) and/or other applicable FAR clauses specified herein. To constitute a proper invoice, the invoice must be submitted on company letterhead and include each of the following:

(i) Name and address of the contractor;

(ii) Invoice date and invoice number;

(iii) Contract/Order number (including a reference to any base award for Indefinite- Delivery/Indefinite-Quantity Contracts or Blanket Purchase Agreements);

(iv) Description, quantity, unit of measure, unit price, and extended price supplies delivered, or services performed, including:

(a) period of performance for which costs are claimed;

(b) itemized travel costs, including origin and destination;

(c) any other supporting information necessary to clarify questionable expenditures;

(d) the contractor shall include the award item number for each description, quantity, unit of measure, unit price, and extended price supplies delivered, or services performed;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on government bill of lading;

(vi) Terms of any discount for prompt payment offered (Prompt Payment terms other than NET 30);

(vii) Name and address of official to whom payment is to be sent (must be the same as that in the purchase order/award, or in a proper notice of assignment);

(viii) Name, title, and phone number of the person to notify in event of defective invoice;

(ix) Taxpayer Identification Number (TIN);

(x) banking routing transit number of the financial institution receiving payment for Electronic funds transfer (EFT);

(xi) Name and telephone number of the FDA Contracting Officer Representative (COR) or other Program Center/Office point of contact, as referenced on the award;

(xii) For all Inspections, Time-and-Materials and Labor-Hour Awards, Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance;

(xiii) Any other information or documentation required by the award.

FDA-21-RFQ-1246411 Page 16 of 36

C. An electronic invoice is acceptable if submitted in Adobe Acrobat (PDF) format. All items listed in (i) through (xiii) of this clause must be included in the electronic invoice.

Electronic invoices must be on company letterhead and must contain no ink changes and be legible for printing.

D. Questions regarding invoice payments should be directed to the Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742);

or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

PART 8 – SPECIAL CONTRACT REQUIREMENTS

Section 508 Standard Requirements

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase information and communication technologies (ICT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities.

All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall

FDA-21-RFQ-1246411 Page 17 of 36 utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

• Must meet WCAG 2.0 A and AA

• E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

• E203 Access to Functionality (Appendix A, Application and Scoping Requirements)

• E204 Functional Performance Criteria (Appendix A, Application and Scoping

Requirements)

• E205 Electronic Content (Appendix A, Application and Scoping Requirements)

• E208 Support Documentation and Services (Appendix A, Application and Scoping

Requirements)

• Chapter 6 Support Documentation and Services (Appendix C, Functional

Performance Criteria and Technical Requirements)

• 302 Functional Performance Criteria (Appendix C, Functional Performance Criteria and Technical Requirements) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at https://www.hhs.gov/web/section-508/making-files-accessible/index.html, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

FDA-21-RFQ-1246411 Page 18 of 36

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High

Integrity: [ ] Low [X] Moderate [ ] High

Availability: [ ] Low [X] Moderate [ ] High

Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

FDA-21-RFQ-1246411 Page 19 of 36

Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer- Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with //HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

FDA-21-RFQ-1246411 Page 20 of 36

See Appendix D for baseline deliverables.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including

PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.