FDA-22-RFQ- CVM-OR-22-C-1404 CNB.pdf

FDA-22-RFQ- CVM-OR-22-C-1404

NARMS Retail Meat Sample Collection and Testing

P a g e 1 | 62

Solicitation Number - FDA-22-RFQ- CVM-OR-22-C-1404:

Part 1 – Description

The U.S. Food and Drug Administration’s (FDA) Center for Veterinary Medicine (CVM) has a need for a NARMS Retail Meat Sample Collection and Testing.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a separate written solicitation will not be issued.

This solicitation is a Request for Quote (RFQ) using FAR Parts 12 and 13 procedures. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2022-06. The North American Industry Classification System (NAICS) code for the proposed acquisition is 541990: All Other Professional, Scientific, and Technical Services. The Small Business Size Standard is $ $15.0 million dollars. This acquisition is set aside for small business.

This requirement is for a NARMS Retail Meat Sample Collection and Testing.

Part 2 – Supplies or Services and Prices/Costs

2.1 Contract Type: Time and Materials

See Attachment 001 Price Quote Request for Pricing Table

Part 3 – Description/Specifications

3.1 BACKGROUND

The FDA is responsible for ensuring the safety and effectiveness of antibiotics. As such, the FDA Center for Veterinary Medicine (CVM) established the National Antimicrobial Resistance Monitoring System (NARMS) as a source of data for the approval of new animal antibiotics and for the post-approval safety monitoring of these compounds. NARMS began in 1996 as a partnership between the FDA, the Centers for Disease Control and Prevention (CDC), and the U.S. Department of Agriculture (USDA) to track antibiotic resistance in foodborne bacteria from humans (CDC), retail meats and seafoods (FDA), and food animals (USDA). NARMS is used to assess the risks associated with new drugs and to monitor the continued safe use of older agents.

NARMS retail sampling helps FDA understand consumers’ risk of antimicrobial resistant bacterial exposure. Currently, retail sampling takes place in 24 states through cooperative agreements with state public health laboratories and academic institutions. The sampling scheme is designed such that collectors purchase meats and seafood from supermarkets in both urban and rural areas, with the frequency of urban/rural sampling weighted by state population. Because retail samples are not collected in all states, an expansion of the sampling area to include cities/ rural areas not currently covered helps to improve representativeness and robustness of the data.

3.2 OBJECTIVES

The objective of this contract is to expand NARMS sampling to supermarkets in Florida (Jacksonville, Miami, Tampa and surrounding rural areas). Retail meats shall be analyzed for the presence of

P a g e 2 | 62

Salmonella, Escherichia coli, Enterococcus and Campylobacter. The project will support CVM’s mission of protecting the public health by generating data regarding levels of antimicrobial resistant bacteria, possibly in meats produced by brands not previously surveyed.

3.3 SCOPE OF WORK

Contractor shall:

• Independently, and not as an agent of the Government, furnish the necessary personnel, services, and otherwise do all things necessary for, or incident to, the performance of the work.

• Contractor shall provide staff (contract staff) to be trained and capable of performing the tasks as described in this contract.

• Contractor shall provide materials and transportation and services necessary to collect the sample

• Contractor shall provide the equipment and reagents necessary to perform isolation and identification of bacteria from retail meats.

3.4 Tasks

Contractor tasks include:

• 4.1 Sample Collection

• 4.2 Sample Handling and Data Recording

• 4.3 Microbiological Analyses

• 4.4 Enteric Bacteria Isolation

• 4.5 Whole-Genome Sequencing (WGS) and Data Submission

• 4.6 Shipping Isolates to CVM/OR

3.4.1 SAMPLE COLLECTION

a) What to collect

Contractor shall purchase a total of 32 retail meat samples from grocery stores per month (total sample size of 384 per year), based on the following four categories:

• Quantity 8 chicken packages (1 breast, 1 chicken leg, 1 chicken whole-cut, 1 chicken thighs, 1 chicken wings, 1 chicken livers, 1 chicken gizzards, 1 chicken hearts)

• Quantity 8 ground turkey samples (at least 50g of meat in each)

• Quantity 16 ground pork samples (at least 50g of meat in each)

Additional Requirements for sample collection:

• Chicken:

o Contractor shall consider bone-in/skin-on except for chicken giblets. If a whole chicken is collected, contractor is to test the chicken breast. At least one or two of the chicken samples shall be organic or raised without antibiotics each month (it can be any of the eights chicken package).

o Contractor shall collect unpackaged chicken liver, hearts, and gizzard if available.

o Contractor is to maintain a log sheet of the samples collected, more detailed requirements for the log sheet are provided in the following section. To help

P a g e 3 | 62 document issues related to cross-contamination, contractor shall indicate on the log sheet how many giblets type in one package (1, 2, or 3).

o For chicken giblets, contractor shall purchase no mixed parts packages. If contractor is unable to locate no mixed part packages, contractor may consider mixed, however contractor shall not test more than one type of giblets from the same package.

o If a whole chicken is purchased with its giblets stuffed inside, contractor shall consider these giblets as one chicken giblets package (provided contractor can get the required weight (50 g) from one of the giblets stuffed inside).

• Ground turkey:

o Any fat percentage is acceptable.

o If ground turkey is not available, contractor is to collect ground turkey breast or ground turkey patties not previously frozen.

• Pork: Contractor shall sample ground pork. If ground pork is not available, contractor is to collect pork chops.

b) Where to collect

Collection shall be at retail grocery stores weekly or every other week. NARMS has determined the catchment areas for sampling. CVM/NARMS will provide the contractor with four primary zip codes per month with a secondary list of 5 zip codes as backups. The contractor shall visit any grocery store in the primary zip codes provided but shall avoid buying all samples from one zip code. The contractor shall try to diversify grocery stores within a zip code.

c) How to collect

Contractor shall collect retail meat packages as specified above. Upon purchase, contractor is to place each package in a separate bag. Contractor shall place the packages in a cooler, on ice, when collecting samples in the grocery stores and these samples shouldn’t be kept out of refrigeration for an extended period of time.

3.4.2 SAMPLE HANDLING AND DATA RECORDING

• Sample Handling: Samples shall be kept on ice during transport from grocery stores to the laboratory. Samples shall be refrigerated at 4°C in the laboratory and begin processing within 96 hours after purchase.

• Data Recording: For each meat or poultry sample, contractor is to record on the NARMS monthly log sheet the following information:

o Demographic information including, at the minimum, the store name and location, brand name, organic or raised without antibiotics, sell-by date, purchase date, and lab processing date.

o Sample Information, including at the minimum, how the sample was packaged and country of origin. Contractor is to record whether the meat or poultry sample was packaged in the store and the packaging type (MAP [modified atmosphere packaging], plastic film wrapped, vacuum, and other)1. Contractor shall also record the country of origin if the information is provided on the meat package.

1 Examples of the packaging types located in SOW Appendix A

P a g e 4 | 62

3.4.3 MICROBIOLOGICAL ANALYSES

Meat samples shall be analyzed for microbiological contents as specified above (i.e., Campylobacter, Salmonella, E. coli, and Enterococcus), isolates shall be shipped to CVM OR and contractor shall perform WGS with data submission as described in detail in the following pages Methods for screening and isolating Salmonella, generic E. coli, Enterococcus and Campylobacter from retail meats are provided below and, in the FDA, Bacterial Analytical Manual (BAM). Equivalent methods may be used if they have been validated according to the standards described in the FDA BAM.

3.4.3.1 ENTERIC BACTERIA ISOLATION

a) Processing day 1

* Note: Media shall be brought to room temperature prior to use. Contractor shall not store the retail meat samples on ice once in the lab. Contractor shall not open packages until ready to begin processing.

* Contractor shall not test two different types of chicken giblets from the same package.

Contractor shall place intact packages of meat or poultry samples on a clean surface and aseptically open the packages. Contractor shall ensure external surface and edges of wrappings do not touch meat or poultry samples. Contractor shall aseptically remove meat or poultry samples with sterile tools (e.g., tongs, gloves, or spoons). Contractor shall photocopy or photograph all meat and poultry package labels and save for future reference.

Contractor shall aseptically place 50 g meat or poultry sample into a sterile plastic bag (e.g., stomacher bag). More than one piece may be used to achieve a 50 g sample of bone-in/skin-on chicken part or any of the chicken giblets. 50 g ground turkey, and 50 g ground pork or one piece of pork chop.

Contractor shall add 250 ml buffered peptone water (BPW) to each bag. For bone-in samples, carefully hand-massage samples for 3 minutes (being careful not to puncture the bag) or use a laboratory shaker at 200 rpm for 15 minutes. For ground meat samples, contractor shall stomach at low speed (230 rpm) for 90 s, hand massage for 3 minutes, or use a laboratory shaker at 200 rpm for 15 minutes until clumps are dispersed.

Aseptically transfer three sets of 50 ml rinse from each bag into separate sterile flasks (or other suitable sterile containers) for the isolation of Campylobacter, E. coli, and Enterococcus, respectively.

Salmonella Contractor shall leave samples in the remaining BPW in the bag and incubate at 35°-37oC for 24 hours.

Campylobacter Contractor shall add 50 ml double strength (2x) Bolton broth to each container. Mix thoroughly but gently to avoid aeration and incubate containers (with loosened caps or closed loosely) in a microaerophilic atmosphere (85% N2, 10% CO2, 5% O2) or in a jar with a CampyPak for 24 hours at 42 +C. Contractor shall not stack containers; this will prevent some of the samples from achieving the appropriate microaerophilic atmosphere.

https://www.fda.gov/food/laboratory-methods-food/bacteriological-analytical-manual-bam

P a g e 5 | 62

E. coli Contractor shall add 50 ml double strength (2x) MacConkey broth and mix thoroughly.

Contractor shall incubate at 35°-37oC for 24 hours.

Enterococcus Add 50 ml double strength (2x) Enterococcosel broth and mix thoroughly. Contractor shall incubate at 45°C for 24 hours.

b) Processing day 2

Salmonella Screening methods including BAX, VIDAS, PCR, or LAMP may be used. Contractor shall follow manufactures instructions to screen samples for Salmonella. Only proposals that include validated methods will be accepted.

If a sample tests positive from the BAX or VIDAS systems, contractor is to streak the positive samples to XLT4 agar and incubate at 35-37oC for 18-24 h.

Contractor shall transfer 0.1 ml from overnight BPW to a test tube containing 10 ml RVR10 (Rappaport-Vassiliadis) medium. Contractor shall incubate in water bath at 42°C for 20-24 hours.

Campylobacter Contractor shall carefully mix 2x Bolton broth avoiding aeration. Contractor shall dip a saturated cotton tip swab into one container and swab the first quadrant of a Campy Cefex Agar (CCA) plate and discard. Using a loop, contractor shall streak the remainder of the plate to obtain isolated colonies. Incubate the plates in a microaerophilic atmosphere (85% N2, 10% CO2, 5% O2) or in a jar with a CampyPak at 42°C for 24 hours.

E. coli Contractor shall streak one loopful from one container of 2x MacConkey broth onto the first quadrant of a MacConkey (MAC) agar plate. Then streak the remainder of the plate to obtain isolated colonies. Contractor shall incubate plates at 35°-37o C for 24 hours.

If no growth or blackening is observed in a container, sample is negative and can be discarded; contractor shall complete the log sheet and place a check mark under the no growth column. If growth and blackening is observed in the container, streak one loopful onto the first quadrant of an Enterococcosel agar plate. Contractor shall streak the remainder of the plate to obtain isolated colonies. Incubate plates at 35°-37oC for 24 hours.

c) Processing day 3:

For each RVR10 culture, contractor shall vortex or mix the enrichment before streaking to one XLT4 plate, incubate at 35-37oC for 18-24 hours.

Optional Selective Agars: Chromogenic agar, HE agar, or a selective non-H2S producing agar may be used in conjunction with XLT4 to obtain a positive isolate.

These suggested agars are not to be used to replace XLT4 agar.

P a g e 6 | 62

Campylobacter Contractor shall examine each CCA plate for typical Campylobacter colonies (round to irregular with smooth edges; thick translucent white growth to spreading, film-like transparent growth). If typical growth is present, select one typical, well-isolated colony and streak for isolation onto a blood agar plate (BAP). If the CCA plate does not have isolated colonies, streak again to another CCA before subculturing to BAP. Contractor shall incubate the BAP in a microaerophilic atmosphere (85% N2, 10% CO2, 5% O2) or in a jar with a CampyPak at 42 + 2°C for 24 hours. If a CCA plate does not have any typical colonies, re-incubate the plate as previously described. Chromogenic agar may be used in conjunction with CCA in identifying Campylobacter. Contractor shall indicate on the log sheet when an isolate is not being sent from the CCA plate.

E. coli Contractor shall examine each MAC plate for typical E. coli colonies (pink colonies). If no typical growth is observed on MAC agar plate, sample is negative and can be discarded, indicate results on the log sheet for E. coli. If typical growth is present, select one typical, well-isolated colonies and streak for isolation onto a blood agar plate. Incubate blood agar plate(s) at 35°-37oC for 18-24 hours.

Contractor shall examine each Enterococcosel agar plate for typical Enterococcus colonies (brownish black to black zones around colonies). If no typical growth is observed on the Enterococcosel agar plate, sample is negative and can be discarded; indicate results on the log sheet for Enterococcus. If typical growth is present, contractor shall select one typical, well-isolated colony and streak for isolation onto a BHI (or other non-blood containing) agar plate.

If the Enterococcosel plate does not have isolated colonies, contractor shall streak again to another Enterococcosel plate before subculturing to BHI. Incubate BHI plate(s) at 35°-37oC for 24 hours.

d) Processing day 4

Contractor shall examine each XLT4 plate for typical Salmonella colonies. For XLT4, look for pink colonies with or without black centers; colonies may have large, glossy black centers or may appear as almost completely black colonies. If there is typical or atypical growth, pick two colonies from XLT4. If the XLT4 plate does not have isolated colonies, streak again to another XLT4 before subculturing to BAP. If typical growth is present, contractor shall confirm that the two colonies are Salmonella. Once confirmed, contractor shall pick one colony for isolation onto a blood agar plate. Contractor shall incubate blood agar plate at 35°- 37oC for 18-24 hours. If no typical growth is observed on XLT4, sample is negative and can be discarded; indicate results on the log sheet for Salmonella.

For re-incubated CCA plates: Contractor shall examine each re-incubated CCA plate for typical colonies (round to irregular with smooth edges; thick translucent white growth to spreading, film-like transparent growth). If no typical growth is observed, sample is negative and can be discarded; indicate results on the log sheet for Campylobacter. If typical growth is present on CCA plate, select one typical, well- isolated colony and streak for isolation onto a blood agar plate. If the CCA plate does not have isolated colonies, contractor shall streak again to another CCA before subculturing to BAP. Incubate blood agar plate(s) in a

P a g e 7 | 62 microaerophilic atmosphere (85% N2, 10% CO2, 5% O2) or in a jar with a CampyPak at 42 + 2°C for 24 hours.

For blood agar plates: Contractor shall examine each blood agar plate for purity and typical Campylobacter colonies (round to irregular with smooth edges; thick translucent white growth to spreading, film-like transparent growth). If growth is pure and colonies are typical, contractor shall perform a Gram stain, oxidase and catalase tests to confirm growth as Campylobacter (motility and hippurate tests are optional). If there is no typical growth on blood agar plate or no colonies are positive for Campylobacter (Gram-negative rods with corkscrew motility, catalase positive, oxidase positive), sample is negative and can be discarded; contractor shall complete the log sheet and select no for Campylobacter. If hippurate test is performed and is positive, record on the log sheet as C. jejuni. If positive for Campylobacter and hippurate negative, use PCR testing to confirm as C. coli. (Note: PCR is optional and may be used in addition to or in place of a hippurate test to identify an isolate as C. jejuni or C. coli). If Campylobacter positive and no speciation is done, contractor shall record on the log sheet as Campylobacter species. Swab the growth into Brucella broth with 15% glycerol mixture and freeze at -60 to -80°C. If an isolate is positive for Campylobacter but cannot be confirmed as C. jejuni and C. coli, contractor shall freeze it at -60 to -80°C in Brucella broth with 15% glycerol mixture and ship all isolates on dry ice to FDA- CVM. Contractor shall ship all isolates in a cryovial on dry ice to FDA-CVM.

E. coli Contractor shall examine each blood agar plate for purity and typical E. coli colonies. If no typical growth is observed, sample is negative and can be discarded; contractor shall complete the log sheet and select no for E. coli. If typical growth is observed, contractor shall perform an indole test (oxidase optional) on each blood agar plate. If the growth is pure, and indole positive (oxidase negative), contractor shall swab the growth into Brucella broth with 15% glycerol mixture and freeze at -60 to -80°C. Ship all isolates on dry ice to FDA-CVM.

Contractor shall examine each BHI agar plate for purity and typical enterococci colonies. If no typical growth is observed, sample is negative and can be discarded; contractor shall complete the log sheet and select no for Enterococcus. If typical growth is observed, Gram stain the suspected colonies. If the Gram stain is atypical, sample is negative for enterococci and can be discarded; contractor shall complete the log sheet and select no for Enterococcus.

If Gram-positive cocci are observed, perform a catalase test. If catalase negative, confirm further with a PYR test. If catalase positive or PYR negative, plates may be discarded;

complete the log sheet and select no for Enterococcus. If results produce catalase negative and PYR positive, record the isolate as positive for Enterococcus. Contractor shall subculture one well-isolated colony from BHI to blood agar plate. Incubate at 35°-37oC for 24 hours.

e) Processing day 5

Contractor shall examine each blood agar plate for purity. If pure, contractor shall confirm as Salmonella by standard biochemical methods, API, VITEK or MALDI-TOF and serotype (optional). For sites that confirm and serotype both isolates and get 2 different serotypes from one meat sample, sequence both isolates and forward both isolates to CVM for further testing. Contractor shall swab the growth into Brucella broth with 15% glycerol mixture and freeze at -60 to -80°C. Contractor shall ship all isolates on dry ice to FDA-CVM.

P a g e 8 | 62

Contractor shall examine each blood agar plate for purity and typical Campylobacter colonies (round to irregular with smooth edges; thick translucent white growth to spreading, film-like transparent growth). For those plates that were re-incubated from Day 3 that had low growth, contractor shall recheck for positive growth and continue processing. If growth is pure and colonies are typical, contractor shall perform a Gram stain and an oxidase, catalase and motility test (hippurate optional) to confirm growth as Campylobacter. If there is no typical growth on blood agar plate or no colonies are positive for Campylobacter (Gram-negative rods with corkscrew motility, catalase positive, oxidase positive), sample is negative and can be discarded; contractor shall complete the log sheet and select no for Campylobacter. If positive for Campylobacter and hippurate positive, contractor shall record on log sheet as C.

jejuni. If positive for Campylobacter and hippurate negative, use PCR testing to confirm as C.

coli. (Note: PCR is optional and may be used in addition to or in place of a hippurate test to identify an isolate as C.jejuni or C. coli.) If an isolate is positive for Campylobacter but cannot be confirmed as C. jejuni and C. coli, contractor shall freeze at -60 to -80°C in Brucella broth with 15% glycerol mixture and ship all isolates on dry ice to FDA-CVM.

Contractor shall examine each blood agar plate for purity and typical Enterococcus growth.

Swab the growth into Brucella broth with 15% glycerol mixture and freeze at -60 to –80°C.

Ship all isolates on dry ice to FDA-CVM.

Part 4 –Performance and Deliverables

4.1 WHOLE- GENOME SEQUENCING (WGS) AND DATA SUBMISSION

a) The first 150 Salmonella, generic E. coli, and Campylobacter isolates will be subject to WGS. If less than 150 Salmonella, generic E. coli, and Campylobacter are obtained, then Enterococcus isolates will be subject to WGS up to a total of 150 isolates. If fewer than 150 total isolates are obtained, then all isolates will be subject to WGS. If the number of isolates is less than recommended for a sequencing run according to the protocols in part c below isolates will be held for sequencing the following month. If number is greater than 150, the priority is first, Salmonella, second, E. coli, third, Campylobacter, and lastly Enterococcus

b) Contractor shall fill out the NARMS monthly log sheet from sampling first. The NARMS ID generated on the log sheet shall be the ID used when sequencing and for submission to NCBI.

Contractor shall use the entire NARMS ID generated including the -EC, -S, -C, -E.

c) Contractor shall perform sequencing, following GenomeTrackr, PulseNet, or USDA/FSIS procedures for the Illumina MiSeq platform. Guidelines for Listeria shall be used for Enterococcus as the genome sizes are similar. After the sequencing run is complete, contractor shall perform a run-level assessment of clustering and Q30 to determine if run was acceptable (using PulseNet/GenomeTrackr cutoffs provided). Contractor may use other Illumina platforms, such as the NextSeq or NovaSeq in place of the MiSeq if the resulting data is of equivalent quality as assessed in part d below.

d) Contractor shall follow the Quality Control guidelines provided in Timme et. al 2020 (https://doi.org/10.1186/s42522-020-00026-3) to determine if samples pass QC thresholds.

https://www.fda.gov/food/laboratory-methods-food/bacteriological-analytical-manual-bam https://www.cdc.gov/pulsenet/pathogens/protocols.html https://www.fsis.usda.gov/sites/default/files/media_file/2021-03/mlg-42.pdf

P a g e 9 | 62

Note that guidance for Enterococcus is not provided and quality will be assessed only on average read quality (>=Q30) and average coverage (>=20X). Bionumerics and Galaxy are common tools used to perform quality assessment.

e) The NCBI umbrella BioProjects for FDA NARMS are listed below. Contractor shall submit WGS data to NCBI SRA using either the PulseNet or GenomeTrakr protocols. Contractor shall coordinate with FDA CVM to establish new submission group and BioProjects under these umbrella projects. Contractor and FDA CVM will have access to submit WGS data and edit metadata (BioSamples) through this submission group.

PRJNA292661 for Salmonella PRJNA292663 for E. coli PRJNA292664 for Campylobacter PRJNA292665 for Enterococcus

f) If any sequences do not meet quality metrics, contractor shall re-sequence the isolate and notify CVM NARMS to sequence the isolate from the physical sample the contractor submitted.

g) Contractor shall provide a sequencing point of contact (POC) to Jason Abbott to contact in case there are issues with sequences or to contact about missing isolates. If the contractor has any lab-related questions, the contractor can contact Jason Abbott.

4.2 SHIPPING ISOLATE TO CVM/OR

a) Preparing isolates for shipment

Contractor shall label each vial with the NARMS isolate ID. Labels shall not be hand-written or taped to the tube as these come off during the freezing process. The NARMS isolate ID on the vial shall match the NARMS isolate ID on the log sheet.

b) Packaging the isolates Contractor shall ship all isolates in cryogenic vials with parafilm wrapped tops to keep tops from coming unscrewed. Contractor should not use excessive parafilm on the tubes.

Cryogenic vials shall be properly wrapped with absorbent material to prevent leakage during shipment. Place cryogenic vials in a shipping container with plenty of dry ice placed in a box for shipping. Cryogenic vials shall be shipped to CVM/OR in accordance with current shipping of hazardous material guidelines. Prior to shipment of isolates to CVM/OR, sites shall e-mail a copy of the completed log sheets to NARMS retail study liaisons at FDA. The original log sheets or hard copies of electronic log sheets shall be included with each isolate shipment to CVM/OR. Each site shall retain copies of log sheets for their records.

c) Shipping the isolates Packages shall be sent overnight. Isolates shall be shipped so the shipment will arrive at CVM/OR between Tuesday thru Thursday. If the isolates will not arrive by Friday, the samples are to store in a freezer (between -80C and -20) and ship the following Monday.

Shipments shall occur on a monthly basis. Send all shipments to Shawn McDermott at the following address:

Attn: TBD FDA, Center for Veterinary Medicine Office of Research 8401 Muirkirk Road https://www.protocols.io/view/ncbi-submission-protocol-for-microbial-pathogen-su-bgrajv2e

P a g e 10 | 62

Laurel, MD 20708 Phone: (240) 402-5447

4.3 Deliverables:

The following table summarizes the deliverables of this contract, the means of delivery, and frequency. It is anticipated that the contractor will be able to invoice monthly for the deliverables accepted each month.

Description Related Tasks Delivery Means Frequency

Purchase of 32 Samples from stores within CVM/OR supplied Zip Codes (see Sample Collection Table Below)

4.1 N/A

Monthly

NARMS Log Sheet Updates 4.1, 4.2, 4.3, 4.3.1, 4.3.2, 4.3.3

E-mail To be submitted monthly prior to shipping isolates

Microbiological Analysis of Samples (32 sample per month) and Enteric Bacteria Isolation

4.3, 4.3.1 Log Sheet Updates and Isolate Deliveries

Monthly

Whole Genome Sequencing Services 4.3.2 Data Upload to

NCBI SRA

Monthly unless exception as noted in 4.3.2.

Isolate Deliveries 4.3.2, 4.3.3 Shipped Overnight per task 4.3.3

Monthly

SAMPLE COLLECTION TABLE

The following table summarizes the sample collection quantities listed in task 4.1. The contractor shall refer to task 4.1 for additional sample collection requirements.

Samples purchased per month

Samples tested per month

PRODUCT PER

MONTH

SALMONELLA CAMPYLOBACTER E

COLI

ENTERROCOCCUS

Chicken Breast

1 1 1 1 1

Chicken legs 1 1 1 1 1 Chicken whole-cut

1 1 1 1 1

Chicken thighs

1 1 1 1 1

Chicken wings

1 1 1 1 1

P a g e 11 | 62

Chicken livers

1 1 1 1 1

Chicken gizzards

1 1 1 1 1

Chicken hearts

1 1 1 1 1

Ground Turkey

8 8 8 8 8

Pork chops 16 16 16 16 16 Total 32 32 32 32 32

Purchase a total of 32 food samples per month:

• 8 samples of retail chicken (chicken breast, legs, whole-cut, thighs, wings, livers, gizzards, hearts)

• 8 samples of retail ground turkey

• 16 Ground chops/Pork chops

4.4 PLACE OF PERFORMANCE

Samples are to be collected in Florida (Jacksonville, Miami, and surrounding areas). All work will occur at the contractor’s facility.

4.5 PERIOD OF PERFORMANCE

The period of performance is 5/30/22-5/29/23.

Part 5 –Contract Administration

5.1 Representative’s

The Contracting Officer’s Representative (COR) will perform inspection and acceptance of equipment and services to be provided.

For the purpose of this PART, (COR TBD) is the authorized representative of the Contracting Officer.

The COR is responsible for the following as required by this order: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluations; (4) performing technical inspections and acceptances; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as an agent of the Government under this order. Only the Contracting Officer has authority to: direct or negotiate any changes in the order, including modifying or extending the period of performance, changing the delivery schedule, authorizing reimbursement to the Contractor for any costs incurred during the performance of this order, or otherwise change any terms and conditions of this order.

The contact information for the Contracting Officer is the following:

Terry Frederick

P a g e 12 | 62

U.S. Food and Drug Administration Office of Acquisitions and Grants Services 4041 Powder Mill Road Beltsville, MD 20705 Terry.Frederick@fda.hhs.gov

The contact information for the Contract Specialist is the following:

Robert Maydwell U.S. Food and Drug Administration Office of Acquisitions and Grants Services 4041 Powder Mill Road Beltsville, MD 20705 Robert.Maydwell@fda.hhs.gov;

(301) 348-1814

The contact information for the Contractor is the following: (TBD)

CVM/OR CONTACTS

Sampling: Epiphanie Nyirabahizi, (240) 402-2578, Epiphanie.Nyirabahizi@fda.hhs.gov Log sheet: Claudine Kabera, (240) 402-5430, Claudine.Kabera@fda.hhs.gov WGS: Jason Abbott, (240) 402-5446, Jason.Abbott@fda.hhs.gov Shipping: Shawn McDermott, (240) 402-5447, Shawn.McDermott@fda.hhs.gov COR: Robin Wilson, 240-402-0913, Robin.Wilson@fda.hhs.gov

5.2 FDA Information Security and Privacy Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order

(hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or mailto:Robert.Maydwell@fda.hhs.gov mailto:Epiphanie.Nyirabahizi@fda.hhs.gov mailto:Claudine.Kabera@fda.hhs.gov mailto:Jason.Abbott@fda.hhs.gov mailto:Shawn.McDermott@fda.hhs.gov mailto:Robin.Wilson@fda.hhs.gov

P a g e 13 | 62 any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location.

In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the

HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X ] Low [ ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.”

Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

P a g e 14 | 62

PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with //HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

P a g e 15 | 62

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information

[PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.)

and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf

P a g e 16 | 62 signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the

FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures

(SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of

P a g e 17 | 62

Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send FDA approved notifications to affected individuals as directed by FDA’s SOP.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the FDA Systems Management Center, COR, CO, and other stakeholders, (Recommend adding the FDA Senior Official for Privacy with contact information and either defining or deleting “other stakeholders.”) including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one

(1) hour of discovery/detection, and consistent with the applicable FDA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

P a g e 18 | 62

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information and HHS and FDA incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.