SOW04282010_OCI COMMENTS(3).doc

FDA-SOL-10-1068201-02

ATTACHMENT 1: STATEMENT OF WORK AND OTHER TERMS / CONDITIONS

SECTION 1.0 : FDA-REGULATED PRODUCTS INTERNET MONITORING

STATEMENT OF WORK

1.1 INTRODUCTION

The Food and Drug Administration (FDA) requires contractor support to further its on-going efforts to counter the widespread illicit trafficking and/or marketing of FDA-regulated products over the Internet. These products include: prescription drugs; dietary supplements; tobacco; medical devices; blood and biologics; vaccines; cosmetics; radiation-emitting products; animal and veterinary medicines; and foods.

1.1.1 OBJECTIVE:

The objective of the Internet Monitoring Program is to support protecting the public health by obtaining Internet monitoring and analysis support services to identify illegal marketing and/or sale of FDA-regulated products via the Internet.

1.2 SCOPE

Primarily the contractor will be proactively and reactively monitoring the open internet as directed by FDA-OCI staff in writing or verbally. Monitoring activities may change frequently based on emerging threats and trends. Therefore, the contractor must be prepared to be flexible and have the capacity to quickly modify their search efforts within 24hrs of notification. The Government anticipates that the contractor will monitor a maximum of 10,000 websites annually.

1.3 DEFINITIONS

· AFFILIATE NETWORK

An "affiliate network" or "affiliated network" is defined as the following: Any presence on the Internet (i.e., website, webpage, blog, etc.), operating in association with other presence on the Internet, which: (1) provides information about FDA-regulated products, together with links to the actual merchants / websites who sell the FDA-regulated products; (2) directly offers FDA-regulated products for sale; (3) process payments for the sale of FDA-regulated products; (4) serves any other purpose (including direct marketing, customer and/or order fulfillment services) on behalf of the organization / network.

· INTERNET MONITORING

For the purpose of this effort "Internet monitoring" is defined as any information that is publicly available (overt, open source) such as, monitoring of websites, Internet billboards, chat rooms, social networking sites, and Internet spam activity, to gather intelligence and report identified illicit websites and networks. Please note that monitoring does not include active participation in social networking sites. The contractor will participate in the following two internet monitoring techniques.

· Proactive Monitoring - information previously unknown to the FDA

· Reactive Monitoring – information known by the FDA and initiated at the specific request of the FDA.

· RELEVANT DATA AND STATISTICAL INFORMATION

For the purpose of this effort, "relevant data and statistical information" is defined as the following:

1.

Website domain names

2.

IP address for each identified URL

3.

Name server utilized for each URL

4.

Mail exchange server utilized for each URL

5.

Who is information to include IP address, Registrar, Registrant and Web host

6.

Geographical identification of website

7.

Associated affiliate network

8.

Anchor site for each identified network

9.

Sub-networks identified

10.

FDA-regulated product(s) offered for sale

11.

Source of supply, when identified

12.

Methods of payment accepted

13.

Point-of-contact information identified on website; i.e., email addresses, telephone numbers; fax numbers

14.

Merchant processor and merchant acquirer information, when identified

· STRAW PURCHASES

For purposes of this effort, "Straw Purchases" is defined as the use of a "zero balance" credit card to complete a transaction on a website for the sole purpose of identifying the Internet payment service provider, merchant processor, and/or associated financial institution.

· INVESTIGATIVE TEST PURCHASES

For purposes of this effort, "Investigative Test Purchases" is defined as the purchase, payment for, and intended receipt of FDA-regulated products from websites.

1.4 GENERAL REQUIREMENTS

This contractor shall provide monitoring of the Internet to capture relevant data and statistical information (further described in Section 3 below), as well as the targeting of the following:

· Illicit pharmaceutical and active pharmaceutical ingredient (API) websites, operators, and facilitators.

· This would include, instances where prescription drugs and/or API are being offered for sale in any manner which would violate Federal law.

· Illegal / unapproved medical device websites, operators, and facilitators.

· This would include medical devices that are not approved for use in the United States by the FDA, are stolen, or expired.

· Illicit tobacco product websites, operators, and facilitators.

· This would include the sale of flavored cigarettes to US-based consumers, as well as the sale of tobacco products by entities not licensed to sell such products (located both domestically and/or internationally), or any other activities which would violate Federal law.

· Illicit food and / or dietary supplement websites, operators, and facilitators.

· This would include the sale of dietary supplements which contain undeclared ingredients, or are not approved for use/sale in the United States by the FDA.

· This would also include the sale of food products which may be potentially harmful to consumers (i.e., counterfeit, stolen, adulterated, etc.)

· Illicit cosmetics websites, operators, and facilitators.

· This would include the sale of counterfeit, unapproved, misbranded or adulterated cosmetic products intended for sale to individuals in the United States.

· Illicit animal and veterinary product websites, operators, and facilitators.

· This would include the sale of counterfeit, unapproved, misbranded or adulterated veterinary products intended for sale to consumers in the United States.

· Illicit vaccine, blood and / or biologics websites, operators, and facilitators.

· This would include the sale of stolen, counterfeit, unapproved, adulterated and/or misbranded vaccines, blood and/or biologic products regulated by the FDA.

· Illegal / unapproved medical device and radiation-emitting product websites, operators, and facilitators.

· This would include medical devices and/or radiation-emitting products that are not approved for use in the United States by the FDA, are stolen, or expired.

· Other Internet entities not detailed above, such as Registrars and Web host providers, actively involved in or facilitating illicit activities associated with the manufacturing, sale, marketing and/or distribution of FDA-regulated products.

· This would include the collection and analysis of data associated with the above-mentioned entities which may result in the identification of specific trends / patterns of the activities of the individuals engaging in illegal activities. These patterns may include usage of specific domain name registrars and web hosting services(either domestically or abroad).

1.5 SPECIFIC REQUIREMENTS / DELIVERABLES

The Contactor Shall Provide:

1.5.1 Project Management Plan (PMP)

The PMP shall describe the proposed management approach. The PMP shall include detailed Standard Operating Procedures (SOPs) for all tasks. The PMP shall include milestones, tasks, and subtasks required in this contract. The PMP shall provide for an overall Work Breakdown Structure (WBS, completed in Microsoft Project) and associated responsibilities and partnerships between Government organizations. During completion of the PMP, the Contractor shall consult with and advise the COTR in tailoring and mapping various project management artifacts/documents to ensure adequate visibility, accountability and compliance.

The Contractor shall provide the Government with an updated PMP within one week after the Kick-Off meeting. The FDA will have an opportunity to comment and provide necessary changes, if necessary.

The PMP is an evolutionary document and is baseline for this contract after the FDA has had an opportunity to comment. PMPs shall be updated monthly and presented at the first IPT meeting of each month for FDA approval.

1.5.2 Monthly Status Reports (MSR)

The Contractor shall provide a MSR using MS Office Suite applications, by the 10th of each month via electronic mail to the FDA COTR. The report shall include the following:

· Activities during reporting period, by task (Include: On-going activities, new activities, activities completed; progress to date on all above mentioned activities). Start each section with a brief description of the task;

· Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them;

· Personnel gains, losses and status;

· Government actions required;

· Schedule (Shows major tasks, milestones, and deliverables; planned and actual start and completion dates for each);

· Any change request and level of efforts;

· Accumulated invoiced cost for the previous month;

1.5.3 Initial Data Form Reports (on an as-need basis)

The contractor shall provide to FDA-OCI for inspection, all lists of rogue Internet websites identified through Internet monitoring or reports of spam; Website Who is information, or termination or suspension of websites. The following data shall be submitted on an as-need basis, in a format subject to FDA-OCI approval (primarily PDF and Database Reports):

1. IP address for each identified URL

2. Name server utilized for each URL

3. Mail exchange server utilized for each URL

4. Who is information to include IP address, Registrar, Registrant and Web host

5. Geographical identification of website

6. Associated affiliate network

7. Anchor site for each identified network

8. Sub-networks identified

9. FDA-regulated product(s) offered for sale

10. Source of supply, when identified

11. Methods of payment accepted

12. Point-of-contact information identified on website; i.e., email addresses, telephone numbers; fax numbers

13.

Merchant processor and merchant acquirer information, when identified

The contractor shall provide a maximum of 10,000 reports of analysis (which may include other associated attachments [i.e., spreadsheets, etc.]) under the scope of this contract. Supplemental reports of analysis prepared by the contractor in support of initial reports shall not count towards this quota.

The contractor shall fill out Initial Data Form Reports in the following instances:

· Internet Landscape Changes Significant changes in the Internet landscape shall be reported to FDA-OCI within 24 hours of discovery of a significant change. Examples of significant changes in the landscape would include the inability of Contractor to identify websites, such as when a website is non-operational, termination of the website(s), domain names, and/or hosting locations; and/or changes in the domain registrar and/or the web hosting company for entities presently being monitored by the contractor at the request of the FDA-OCI.

· Recidivist Activities by Previously-Warned Entities Individuals / firms which have been previously warned by the FDA regarding illegal promotion and/or sales of FDA-regulated products which re-engage in the illegal marketing and/or sales of FDA-regulated products shall be reported to FDA-OCI within 24 hours of discovery.

· Identification of Affiliated Networks When the contractor (as part of any proactive-monitoring efforts) becomes aware of websites engaging in illegal activities associated with FDA-regulated products, the contractor shall attempt to document the size and scope of the operation, including any affiliate network. An initial report shall be provided to FDA-OCI within 10 business days, and shall indicate if the identification process has been completed, or will require additional time to be completed. If additional time is required, the contractor shall submit the final report within 14 days from the submission of the initial report.

When the contractor is performing work based on a request from FDA-OCI, the contractor shall attempt to determine if an affiliate network exists. If so, the contractor shall document the size and scope of the operation, including any affiliate network. An initial report regarding the affiliate network shall be provided to FDA-OCI within 10 business days, and shall indicate if the identification process has been completed, or will require additional time to be completed. If additional time is required, the contractor shall submit the final report within 14 days from the submission of the initial report.

· Incidents of National Security –

Both Proactive and Reactive monitoring activities may include identification of circumstances that potentially affect National Security and/or create significant public health and safety issues. The contractor shall immediately notify FDA-OCI and shall provide status updates at a minimum of every 6 hours regarding the status of the completion of the monitoring and/or analysis of information.

· Straw Purchases –

At the direction of FDA-OCI, the contractor will conduct a maximum of 500 straw purchases annually from websites in an effort to identify the purchase process and the movement of funds. Straw purchases will be conducted with "zero balance" credit cards, which will allow the contractor to complete the straw purchase. While the transaction will ultimately be declined by the credit card company, the straw purchase will allow for FDA-OCI to identify the Internet payment service provider, merchant processor and/or involved financial institution(s).

FDA-OCI will provide the "zero balance" credit cards to the contractor, which shall be used exclusively for and at the direction of FDA-OCI. These shall remain the property of FDA-OCI and shall be returned to FDA-OCI within 24 hours of request.

There shall be no costs incurred by FDA-OCI or the contractor associated with straw purchases.

· Investigative Test Purchases At the direction of FDA-OCI, the contractor will conduct a maximum of 500 investigative test purchases from websites. The ordering process is quick, maybe 10 minutes. However, receipt of the actual product can take up to 8 weeks (or more).

Upon receipt of the product(s) ordered, the products will be forwarded to a designated representative at FDA-OCI. Investigative test purchases will be conducted with credit cards that shall be provided by FDA-OCI.

The credit cards shall remain the property of FDA-OCI and shall be returned to FDA-OCI within 24 hours of any written request.

The statements for these credit cards shall be mailed to an undercover mailbox under the control of FDA-OCI and forwarded to the contractor upon receipt by FDA-OCI.

The contractor is responsible for paying the balances (including any late fees and interest incurred for untimely payments) on any credit cards under the control of the contractor. The contractor shall submit a request for reimbursement at the end of each month for any costs incurred associated with investigative test purchases. FDA-OCI shall reimburse the contractor within 60 days of receipt of the completed reimbursement form. Reimbursement forms that do not include all required documentation shall be returned to the contractor for appropriate corrections.

1.5.4 Continuation of Data Form Report – Analysis Reports of Findings After review of the initial data form reports, OCI will determine if it is necessary for the contractor to provide a further Analysis of their findings via an Analysis Report of Findings. The Analysis Reports of Findings is considered to be included in the 10,000 data form report maximum limit and is considered supplemental information to the data form report. OCI does not anticipate more than 5,000 supplemental Analysis Reports of Findings will be needed annually. The analysis reports shall provide a strategic overview of the individual project request and shall highlight significant findings and matters of concern related to the illegal marketing, trafficking, and/or sale of FDA-regulated products. The report shall be prepared through detailed analysis of the information obtained by the contractor in conjunction with any information which may be supplied by FDA-OCI in support of the request. The assessment report shall be designed to provide FDA-OCI with a focused discussion of key issues and developments associated with the request.

1.6 Prepare and Submit a Final Report

The Contractor shall submit a Final Report upon completion of the internet monitoring project. The Contractor shall maintain up-to-date records of all work results, developments, and accomplishments for the preparation of the report. The Final Report shall include descriptions of all documentation, processes, techniques, models, studies, and procedures developed under this contract.

1.7 Option Line Item: Transition Plan

The contractor shall create transition plan providing a description of transition activities to be carried out and a timeline for the implementation and completion of all final transition activities. If applicable, the successor contractor and out-going contractor shall work together to implement an orderly, secure, and efficient transition of the contracts. This includes transitioning operations, equipment and any data relative to this contract. The contractor shall also conduct a close out meeting to ensure that all necessary transition activities have occurred and to obtain a signoff from the COTR. The contractor shall provide all required documents including close out lesson learned document and obtain the stage gate review and approval.

2.0 DELIVERABLE SCHEDULE

Internet Monitoring (Maximum of 10,000 websites) –

a. Proactive Monitoring

b. Reactive Monitoring

c. Conduct Straw Purchases

d. Investigative Test Purchases

Updates to Project Management Plan

Monthly Status Reports

DATA FORM REPORTS

1.5.3 - Initial Data Form Report for the following:

a. Internet Landscape changes

b. Recidivist Activities by Previously-Warned Entities

c. Identification of Affiliated Networks,

d. Incidents of National Security

1.5.4 – Final Supplemental Analysis Report of Findings Each

Maximum Amount:10,000 (Note: 5,000 of the 10,000 limit may require the an Analysis Report of Findings)

As requested by COTR and as needed (10 days to deliver report upon general request / Priority Requests require immediate work and delivery)

As requested by COTR and as needed (14 days to deliver report after initial report / Priority Requests require immediate work and delivery)

Transition Plan

Note: The work product created as a result of this contract will be stored on storage media owned and operated by the FDA. The contractor shall provide all copies of work product created to FDA-OCI upon written request, including back-up and/or archived records.

3.0 PLACE OF PERFORMANCE: Work is to be performed at the Contractor's Site . The contractor will be required to conduct weekly status meetings with FDA-OCI staff in the Rockville, MD area. The majority of these meetings will be conducted via teleconference. Requests which result in the collection of large amounts of data may require the contractor to present the findings to FDA-OCI in-person at a Government site within the United States. Local travel shall be included as an allowable expense under this contract.

3.1 HOURS OF OPERATION: Normal hours of operation will be normal business hours (9am-5pm) EST. However, in matters dealing with National Security and/or significant public health and safety issues, the contractor shall provide services outside of normal business hours to meet the timely reporting requirements specified above.

3.2 OBSERVANCE OF FEDERAL HOLIDAYS & OTHER GOVERNMENT CLOSINGS: Coverage is expected during all Federal work days. No services or deliveries shall be performed at the Federal sites on Federal legal holidays as shown below unless specifically requested by the COTR (in the best interest of industry coverage).

1.

New Year’s Day January 1st 2.

Martin Luther King Day Third Monday in January

3.

President’s Day Third Monday in Feb.

4.

Memorial Day

Last Monday in May

5.

Independence Day July 4th

6.

Labor Day

First Monday in Sept.

7.

Columbus Day Second Monday in Oct.

8.

Veteran’s Day

November 11

9.

Thanksgiving Day Fourth Thursday in Nov.

10.

Christmas Day December 25

4.0 PERIOD OF PERFORMANCE

Base Period: 12 months from Time of Award.

Option Period 1: 12 months

Option Period 2: 12 months

5.0 CONTRACT ADMINISTRATION DATA

Contracting Officer’s Authority The Contracting Officer (CO) identified above has responsibility for ensuring the performance of all necessary actions for effective contracting; ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this contract and is the only person authorized to approve changes to any of the requirements under this contract, and notwithstanding any provision contained elsewhere in this contract, this authority remains solely with the CO.

No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this Task Order. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the contract. The Government will not reimburse the Contractor for any work not authorized by the CO, including work outside the scope of the contract.

5.1 GOVERNMENT POINTS OF CONTACT (POC)

Supervisory Contracting Officer

Contracting Officer:

Brenda Lee

Jody O'Kash

5630 Fishers Lane, RM 2004

5630 Fishers Lane, RM 2009

Rockville, MD 20857

Rockville, MD 20857

301-827-7036

(301) 827-5094 Email: Brenda.Lee@fda.hhs.gov

Email: Jody.O'Kash@fda.hhs.gov

5.2 CONTRACTING OFFICER'S TECHNICAL REPRESENTATIVES (COTRs):

Address and Telephone number of Contracting Officer Technical Representative (COTR):

A Government Contracting Officer Technical Representative (COTR) will be responsible for the overall success of the project, ensuring adequate coordination among the various management components. The COTR is designated to monitor the performance of this contract on behalf of the Government. He/She will provide no supervisory or instructional assistance to Contractor personnel regarding the application software. The COTR’s function is primarily to provide the Contractor with working data. He/She is not empowered to make any commitments or authorized to make any changes that affect process, terms or delivery as specified in this order. Any such proposed changes shall be brought to the immediate attention of the CO for action. The acceptance of any changes by the Contractor without specific approval and written consent of the CO shall be at the contractor’s own risk. The following persons have been appointed as the COTR:

Overall COTR for Requirements Analysis for Internet Monitoring and

To Be Disclosed at time of Award

5.3 THE CONTRACTOR'S CONTRACT ADMINISTRATION FUNCTIONS WILL BE PERFORMED AT THE FOLLOWING ADDRESS:

A. Address and Telephone number of the Contracting Staff:

5.4 NOTIFICATION REGARDING ADMINISTRATIVE PROBLEMS

If at any time during the performance of this contract, administrative problems should arise which will have an adverse impact on timely performance by the Contractor or affect the contract costs or funding, the Contractor is required to immediately notify the Contracting Officer (CO) identified and the Contract Specialist identified in paragraph 11.1 above.

5.5 BILLING INSTRUCTIONS:

A. In accordance with FDA's two-way method for processing invoices for Time and Material / Labor Hour Performance Based Contracts and FAR 52.232-25, Prompt Payment, the contractor must submit invoices electronically to the Contract Specialist identified in G-1. In accordance with FAR 32.905(e) the Contract Specialist will determine whether the invoice is proper.

B. All invoices must include the following information:

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Purchase order number and line item numbers and;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(xi)DUNS number.

C. Proper invoices will be forwarded within 5 days of receipt to the Program Office and the Office of Financial Management for approval and payment.

D. Improper invoices will be returned to the Contractor within 7 calendar days, with a cover letter detailing the reason why the invoice is being returned.

E. The contractor shall submit a Release of Claims for final contract and task order invoices (including final invoices for each option period).

6.0 SPECIAL REQUIREMENTS

6.1 GOVERNMENT FURNISHED EQUIPMENT / INFORMATION

The FDA will supply the contractor with the following equipment in support of the contract:

· Laptop computers, which will contain the appropriate software to accomplish the requirement of preparing the reports for FDA-OCI (i.e., Adobe Acrobat, Microsoft Word, Microsoft Excel, etc.). The number of computers to be provided to the contractor will be determined by FDA-OCI and will be based on the number of contractor staff which will be dedicated to the contract.

· Undercover cellular telephone, which will be utilized in support of test purchases and investigative test purchases. The U/C telephone shall remain the property of FDA-OCI and shall be returned to FDA-OCI within 24 hours of any written request. The undercover cellular telephone shall be used only at the direction of FDA-OCI and in support of requests made by FDA-OCI under this contract.

The equipment, and software listed above will remain the property of FDA-OCI and shall be returned to FDA-OCI within 24 hours of a written request. Additionally, all equipment issued to the contractor shall be used solely in support of this contract and shall not be utilized for any other purpose.

Any information maintained by the FDA that will be utilized in analysis and/or the preparation of reports will be provided to the contractor by the FDA. This information remains the property of the FDA and will be returned to the FDA at the conclusion of the analysis. The contractor is prohibited from copying, maintaining, and/or disclosing the information to anyone.

The work product created as a result of this contract will be stored on storage media owned and operated by the FDA. The contractor shall provide all copies of work product created to FDA-OCI upon written request, including back-up and/or archived records. At the termination of the contract, the contractor shall turnover all work product to FDA-OCI, and is prohibited from retaining or disclosing (in any fashion) any work product created under the scope of this contract.

6.2 CONTRACTOR EQUIPMENT

The contractor shall have all necessary infrastructure, to include sustainable connectivity to the Internet and any Commercial Off-The-Shelf (COTS), Government Off-The-Shelf (GOTs), contractor-owned and/or contractor-created software, in place and operational prior to the initiation of the contract services to FDA-OCI.

6.3 RECOGNITION OF NONDISCLOSURE. At all times during the term of the contract and thereafter, the contractor will hold in strictest confidence and will not disclose, use, lecture upon or publish any FDA Proprietary Information (defined below), except as such disclosure, use or publication may be required in connection with the contractors work for FDA-OCI, or unless an authorized agent of FDA-OCI expressly authorizes such in writing. The contractor assigns to FDA-OCI any rights the contractor may have or acquire in such Proprietary Information and recognizes that all Proprietary Information shall be the sole property of FDA-OCI and FDA-OCI shall be the sole owner of all work product and associated data in connection therewith.

The term "Proprietary Information" shall mean confidential knowledge, data or any other proprietary information of FDA-OCI. By way of illustration but not limitation, "Proprietary Information" includes (a) any work product and associated data produced at the request of FDA-OCI; (b)ideas, processes, formulas, source and object codes, data, programs, other works of authorship, know-how, improvements, discoveries, developments, designs and techniques (hereinafter collectively referred to as "Inventions"); and (c) information regarding plans for research and/or investigation, development, investigative / operational plans, licenses, prices and costs, suppliers and customers; and information regarding the skills and compensation of other employees of the Company.

6.4 THIRD PARTY INFORMATION. The contractor understands, in addition, that the contractor will receive from third parties confidential or proprietary information ("Third Party Information") subject to a duty on the FDA-OCI's part to maintain the confidentiality of such information and to use it only for certain limited purposes. During the term of the contract and thereafter, the contractor will hold Third Party Information in the strictest confidence and will not disclose (to anyone other than FDA-OCI personnel who need to know such information in connection with their work for FDA-OCI) or use, except in connection with work for FDA-OCI, Third Party Information unless expressly authorized by an appropriate agent of FDA-OCI in writing.

6.5 CLASSIFIED INFORMATION. The contractor may be required to complete a Classified Information Nondisclosure Agreement.

6.6 PUBLIC TRUST POSITIONS – SECURITY REQUIREMENTS FOR ACCESS TO SENSITIVE INFORMATION/U.S. CITIZENSHIP REQUIRED. The personnel security access level for this contract is FDA-OCI SENSITIVE, U.S. citizenship, by birth or naturalized, is required. FDA-OCI’s approval to perform on this contract will be based on a favorably adjudicated National Agency Check and Inquiries (NACI). A favorably adjudicated Minimum Background Investigation (MBI), Limited Background Investigation (LBI), or a favorably adjudicated Single Scope Background Investigation (SSBI) conducted by the Office of Personnel Management (OPM), the Department of Defense/Defense Security Service (DOD/DSS), or other Federal agency will be accepted pending supplemental record checks conducted by FDA-OCI.

6.7 PERSONNEL SECURITY CLEARANCE REQUIREMENTS

FDA 1335

The SOW requires the contractor to (1) develop, (2) have the ability to access, or (3) host and/or maintain a Federal information system(s). Pursuant to Federal and Department of Human and Health Services (HHS) Information Security Program Policies, the contractor and any subcontractor performing under this task order shall comply with the requirements stated in the document below. Security information specific to DBAProject is documented in this section.

Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002);

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf.

Information Type [x] Administrative, Management and Support Information:

Information Management

Lifecycle/Change Management

Record Retention

Budget and Finance

Reporting and Information

[x] Mission Based Information:

Consumer Health and Safety

Security Categories and Levels Confidentiality Level:

[ ] Low [ ] Moderate [X] High

Integrity Level:

[ ] Low [ ] Moderate [X] High

Availability Level:

[ ] Low [ ] Moderate [X] High

Overall Level:

[ ] Low [ ] Moderate [X] High

Position Sensitivity Designations The following position sensitivity designations and associated clearance and investigation requirements apply under this task order.

[x] Level 6: Public Trust - High Risk (Requires Suitability Determination with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

Contractor employees shall comply with the DHHS criteria for the assigned position sensitivity designations prior to performing any work under this contract. The following exceptions apply:

Level 6: In special circumstances the COTR may request a waiver of the pre-appointment investigation. If the waiver is granted, the COTR will provide written authorization for the contractor employee to work under the contract.

The Office of the Assistant Secretary for Management and Budget, Department of Health and Human Services (DHHS), requires that DHHS employees and contractor employees (including subcontractors) who will be working in a DHHS-owned or leased space and/or who will have access to DHHS equipment, and non-public privileged, proprietary, or trade secret information, undergo a background investigation of some type.

Contractor employees who will be in DHHS-owned or lease space for less than thirty (30) days are exempted from the background investigation requirement. These contractor employees must be escorted at all time while in DHHS-owned or leased space.

GENERAL

The contractor shall submit the following items to the Contracting Officer, ten (10) calendar days prior to commencement of work under this contract:

a. Certification that all required security form packets and a list of contractor employees names for whom the requisite security information has been provided to Division of Security Operations, Policy and Planning, Personnel Security Staff.

b. "Contractor's Commitment to Protect Non-public Information Agreement" forms signed by each employee named in paragraph a. above.

With the exception of costs associated with fingerprinting Contractor employees outside of the FDA Personnel Security Office, the Government will conduct all required background investigations at no cost to the contractor. The cost of fingerprinting Contractor employees at any location other than the FDA Personnel Security Office will be borne by the Contractor.

Contractor employees shall obtain security badges in order to access to DHHS-owned or leased property without an escort. (See Section 3 for details on the badging process) However, in the event that work must commence before security badges can be issued, contractor employees will be allowed onto DHHS-owned or leased property, but must be escorted at all times.

All Contractor employees who undergo a background investigation are required to log onto the Office of Personnel Management’s (OPM’s) Electronic Questionnaire for Investigation Processing (e-QIP) system to complete the forms necessary to initiate their background investigations. The forms required vary with the position risk levels for the contract.

The position risk levels for this contract are Level 6 There are two (2) potential position risk levels, which are:

Non-Sensitive Positions (Level 1) (SEE ATTACHMENT 1) - Positions which involve the lowest degree of adverse impact on the efficiency of the Agency. The forms set forth by CHART A are required for Non-Sensitive Positions (Level 1). Contractor employees assigned to Level 1 who receive a security badge will be required to provide additional security information for a background investigation as specified in Paragraph 5 below.

Public Trust Positions (Levels 5 or 6) (SEE ATTACHMENT 1) - Positions in which the incumbent's actions or inaction could diminish public confidence in the integrity, efficiency, or effectiveness of assigned Government activities, whether or not actual damage occurs. The forms set forth by CHART B are required for Public Trust Positions (Levels 5 or 6). Contractor employees assigned Levels 5 or 6 must receive security badge as well as a background investigation.

In order to access the e-QIP system, Contractor employees must provide the appropriate Personnel Security Specialist with the following information: (a) full name; (b) position title; (c) social security number; (d) date of birth; (e) place of birth; (f) email address; and (g) phone number. The Personnel Security Specialist will use this information to initiate each Contractor employee into the e-QIP system. Once this is done, each Contractor employee will receive an email that contains a web link to access the e-QIP system, as well as instructions and additional forms needed to initiate the suitability background investigation. The Contracting Officer's Technical Representative for the contract will provide the name of the appropriate Personnel Security Specialist to the Contractor. A Contractor’s failure to comply with the e-QIP processing guidelines will result in that Contractor’s employees being denied access to FDA property until all security processing has been completed.

.8 BADGING PROCESS

The FDA Contracting Officer's Technical Representative will sponsor Contractor employees on the FDA Form 3391 for the purpose of obtaining an FDA Security Access Card. In order to obtain one, a contractor employee must receive a “favorable” fingerprint return. Fingerprints must be submitted to the Personnel Security Office at least ten (10) days prior to the commencement of work. Fingerprints will be submitted in one of two ways, depending on where the contract will be performed:

Contractor employees who will work in the Washington D.C. metro area will, at the direction of the FDA Contracting Officer's Technical Representative or his/her designee, contact the Personnel Security Branch to schedule a fingerprinting appointment, or

Contractor employees who will work in a field office will submit fingerprints to:

Food and Drug Administration

OSO/Office of Security Operations

Attn: Personnel Security Staff

10903 New Hampshire Ave, RM 1201

Silver Spring, MD 20993

Upon the receipt of a “favorable” fingerprint return, each Contractor employee must present two forms of identification in order to receive his or her badge. One form of identification must be a government-issued photo identification document. Acceptable forms of photo identification are referenced on the FDA Form 3391. Acceptable forms of secondary identification are listed on the back of the I-9 Form. This form can be obtained at http://uscis.gov/graphics/formsfee/forms/files/i-9.pdf An individual who receives an unfavorable report may appeal that finding by submitting a written request to the Personnel Security Staff.

6.9 BACKGROUND INVESTIGATIONS

The Government shall conduct an additional background investigation for those individuals named to risk Levels 5 and 6 serving under this contract.

Required background investigations may include, but not be limited to:

Review of prior Government/military personnel records;

Review of FBI records and fingerprint files;

Searches of credit bureaus;

Personal interviews; and

Written inquiries covering the subject's background.

Background investigations will be conducted by the Office of Personnel Management (OPM).

The Contractor is responsible for ensuring that the integrity of contract performance is maintained pending completion of all appropriate background investigations of contractor employees.

The Contractor shall submit the information required for eQIP access and other requisite forms for the risk level(s) specified. In addition, the contractor shall provide a cover letter which includes: the Contractor's name, the contract number, the name of the Contracting Officer administering the contract, the names of all Contractor employees' for whom a background check is required and those employees’ social security numbers, dates of birth, and former names. This cover letter and all completed forms shall be transmitted, in a separate sealed envelope marked, "TO BE OPENED BY ADDRESSEE ONLY," to:

Food and Drug Administration

OSO/Office of Security Operations

Attn: Personnel Security Staff

10903 New Hampshire Ave, RM 1201

Silver Spring, MD 20993

The contractor shall send a separate letter to the Contracting Officer that includes the contract number and employee names.

The contractor shall advise its prospective employees that all standard forms submitted to the FDA will be forwarded to the Office of Personnel Management (OPM) for scheduling background investigations.

Personnel Security Staff will resolve with the contract employee any issues arising out of inaccurate or incomplete forms.

Employees who have been previously granted a Government security clearance shall advise Personnel Security Staff of the details of such clearances to determine if a previous clearance level is suitable for the current FDA position.

At any time, if a contractor employee for whom security forms have been submitted is terminated or otherwise ceases work under the contract, the contractor shall immediately notify Personnel Security Staff, in writing, with copies to the respective FDA Project and Contracting Officers.

The OPM background investigation will take approximately 120 days. The Contracting Officer will notify the Contractor in writing if an employee is denied a clearance. Those individuals who have been cleared by Personnel Security Staff may continue to work under the contract. Those who are not cleared must cease work on the contract immediately.

If a Contractor employee changes job responsibilities under this contract, the contractor shall notify the Contracting Officer, and the Government will make a determination whether an additional security clearance is required.

In the event that a cleared individual is replaced, the contractor shall notify the Contracting Officer and comply with all requirements of this clause, as specified herein, prior to the commencement of work by the replacement individual.

The Contractor shall be responsible for the return of any Government issued security badges to the Contracting Officer's Technical Representative.

6.10 Access to Non-Public Information

FDA 1350tc " H-[ FDA 1350 Access to Non-Public Information " \l 2 All contractor and subcontractor employees are required to sign the Contractor's Commitment to Protect Non-Public Information Agreement form provided as an attachment to this contract (Attachment 1). If a person who has signed this agreement resigns, is dismissed, or is otherwise no longer working on this contract, the contractor shall notify the FDA Contracting Officer's Technical Representative (P.O.) and Contracting Officer. Any new contractor and subcontractor employees assigned to this contract shall sign the form, and the contractor shall hand-deliver it (ten (10) days prior to commencement of work) to the Contracting Officer.

The prime contractor, subcontractors, and consultants shall not be provided nor possess non-public information in any form unless written approval and a facility clearance have been granted.

Briefings

A FDA representative (typically, the Contracting Officer's Technical Representative) will conduct an orientation briefing for the contractor/contractor employees. The briefing will stress: (1) the importance of protecting non-public information; (2) specified computer/ADP requirements as outlined in the DHHS Automated Information Systems Security Program Handbook; and (3) the consequences of unauthorized disclosure of non-public information. Briefing updates will be conducted annually.

The contractor shall brief all contractor employees, subcontractors and consultants regarding the sensitivity of the information to be handled under the contract and of the responsibility to protect it. The briefing shall stress that the information is non-public and shall not be disclosed to any unauthorized source. The contractor shall conduct an updated briefing annually and shall submit a report to the FDA Contracting Officer's Technical Representative within ten (10) days after the briefing which includes: an outline of the briefing, a copy of any briefing materials, date briefing was conducted and the names of the attendees.

If this is an automated data processing/telecommunications (ADP/TC) contract, in addition to the above briefings, the FDA Contracting Officer's Technical Representative and the FDA Center/Office Information Systems Security Officer (ISSO) will brief contractor and subcontractor personnel and consultants on security measures required pertinent to any hardware/software being utilized. Furthermore, appropriate contractor and subcontractor personnel and consultants shall attend training courses as directed by the FDA to fulfill requirements of the Computer Security Act of 1987. These courses are generally one (1) day in length; and attendance at one (1) course is sufficient. This training will be provided at no cost to the contractor.

6.11 Physical Security Requirements for Releasing Non-Public Information

FDA 1354

Under the provisions of Title 21, United States Code, Section 331(j), the contractor shall establish and maintain comprehensive security measures for controlling access to non-public information released under a contract involving the processing of such information.

The contractor shall be required to submit a physical security plan with their proposal. The plan shall provide written procedures which detail the instructions issued to contract employees on the following:

a. Safeguarding material during use;

b. Safeguarding material at all other times;

c. Accounting for material

d. Tracking procedures,

e. Created in-process;

f. Storage control;

g. Key control;

h. Area security;

i. Visitor control;

j. Receipt and transmittal of material;

k. Reproduction of material;

l. Destruction of material;

m. Recording logs;

n. Response to emergency situations;

o. Compromise of information; and,

p. Administrative controls.

This clause applies to the contractor, any subcontractors, and any consultants. Non-public information will be released to only those persons who will be using the contractor's approved facility unless the off-site facility has been reviewed by the FDA Physical Security Staff and approved in writing by the FDA Physical Security Office.

For transmittal of documents the contractor shall adhere to the following:

1. Documents to be transmitted internally shall be transmitted on a person-to-person basis between approved employees only.

2. Documents to be transmitted outside the contractor's facility shall be double-wrapped with the inner wrapping marked "FDA Privileged Information - Access Controlled". The names and addresses of the sender and addressee shall be typed on both the inner and outer wrappings.

3. Documents to be transmitted back to the FDA or to another address designated by the FDA shall be transmitted by an approved employee or by U. S. Registered mail (return receipt requested). It shall be double-wrapped or wrapped by such a method as specifically approved in writing by the FDA Physical Security Office.

4. A receipt log shall be maintained for all external transmittals.

5. The contractor shall follow up all transmittals in order to obtain signed receipt within five (5) working days of transmittal. Failure of recipient to furnish such receipt shall be reported to the FDA Physical Security Office within ten (10) working days of transmittal.

No non-public information will be released to the contractor unless all required security precautions have been met [as demonstrated during an inspection by the Food and Drug Administration (FDA) Physical Security Staff], and written procedures for enforcing them have been provided by the contractor and approved in writing by the Physical Security Staff. The FDA Physical Security Office will notify the contractor of the approval.

When the contractor facilities have a current certification from the Defense Contract Administration Services/Defense Logistics Agency (DCAS/DLA) as a "Secret" or higher classification, such rating will satisfy the FDA security requirements for the contractor's facility. Loss of such certification during the period of the contract will be cause for a possible issuance of a Stop Work Order pending review by the FDA's Physical Security Staff of the contractor's facility. The contractor shall notify the FDA Physical Security Office in the event the DCAS/DLA rating is expected to be terminated.

Pending the outcome of any subsequently required investigation, additional requirements on the contractor shall include, but not be limited to, the following: restrictions on access to data by contractor employees, subcontractor employees, and consultants; special storage requirements; restrictions on transmission and disclosure of information; changes in periods of retention and in methods of destruction of source documents or related material; and disclosure statements for all contractor employees, subcontractor employees, and consultants.

The FDA Physical Security Staff will review the contractor's facility and assess the contractor's compliance. Recommendations for bringing noncompliant areas into compliance will be provided to the contractor by the FDA Physical Security Office.

The Contractor shall make any changes necessary within thirty (30) days after written notice from the FDA Physical Security Office in order to comply with FDA security requirements. When appropriate changes have been made the Contractor shall contact the FDA Physical Security Office to request further review by the FDA. The FDA Physical Security Office will notify the Contractor in writing of the outcome of the second inspection. Failure of the contractor to satisfy FDA security requirements within thirty (30) days after the first written notification from the Contracting Officer may be cause for termination of the contract.

The contractor shall designate a Security Representative to act as liaison between the contractor and the FDA on all security-related matters. This includes personnel changes, personnel terminations, disciplinary actions, etc.