FDASOL1238616 SOW ATTACHMENT 1 FINAL 7 19 2021 2 00 PM.pdf

FDASOL1238616

ATTACHMENT 1

STATEMENT OF WORK (SOW)

Center for Drug Evaluation and Research (CDER) Office of the Center Director (OCD)

Controlled Substances Program (CSP), Controlled Substance Staff (CSS)

Assessing Whether Drug Discrimination Selectively Evaluates Pharmacological Mechanisms of Action

Statement of Work

1. Introduction

1.1 The U.S. Food and Drug Administration (FDA), an agency within the U.S. Department of

Health and Human Services (HHS), is charged with protecting the public health by ensuring the safety, effectiveness, and security of human and veterinary drugs, biological products, and medical devices; ensuring the safety of foods, cosmetics, and radiation-emitting products; and regulating tobacco products.

1.2 As part of FDA, the Center for Drug Evaluation and Research (CDER) performs an essential public health task by making sure that safe and effective drugs are available to improve the health of people in the United States. CDER also regulates over-the-counter and prescription drugs, including biological therapeutics and generic drugs. This work covers more than just medicines. For example, fluoride toothpaste, antiperspirants, dandruff shampoos and sunscreens are all considered "drugs."

1.3 As part of the FDA, CDER regulates over-the-counter and prescription drugs, including biological therapeutics and generic drugs. This work covers more than just medicines. For example, fluoride toothpaste, antiperspirants, dandruff shampoos and sunscreens are all considered "drugs."

1.4 The CDER OCD provides leadership and overall direction to all CDER activities to ensure that the mission of the Center is accomplished. CDER makes sure that safe and effective drugs are available to improve the health of consumers. CDER ensures that prescription and over-the-counter drugs, both brand name and generic, work correctly and that the health benef its outweigh known risks. CSS focuses on the assessment of abuse potential of drugs, to promote the public health through the medical science-based assessment and management of drug abuse risks.

2. Background

2.1 Half a century of drug discrimination studies in rats show that full generalization (>80%) typically occurs when a test drug has the same pharmacological mechanism of action as that of the training drug. In contrast, it is generally thought that drugs with similar physiological ef fects (such as drugs that produce stimulation) but different mechanisms of action (such as dopamine reuptake inhibitors, dopamine releasers, or adenosine antagonists) will not produce full generalization to each other. However, this premise has not been systematically evaluated in the recent scientific literature.

2.2 This study will train animals to discriminate classic drugs of abuse with distinct mechanisms of action (morphine, d-amphetamine, psilocybin, and alprazolam) from saline. Animals will then be tested to see whether drugs with similar mechanisms of action (drugs in the same pharmacological class) or different mechanisms of action, but similar behavioral effects or medical indication produce full generalization. Other drugs may also be considered for training drugs or test drugs using the same principle.

3. Objectives

3.1 The primary objective of this study is to conduct drug discrimination studies in adult rodents to evaluate whether drugs with different mechanisms of action, but similar behavioral effects produce full, partial, or no generalization to each other.

4. Scope

4.1 Independently and not as an agent of FDA, the Contractor shall furnish the necessary personnel, materials, services, facilities, and otherwise do all things necessary for, or incident to the performance of the work as described below.

4.2 The purpose and scope of these drug discrimination studies are to generate comprehensive drug discrimination data evaluating the ability of various drugs with central nervous system (CNS) activity to substitute and/or generalize to classic drugs of abuse.

5. Assumptions/Constraints

5.1 FDA assumes that all costs associated with the fulfillment of study requirements will be ref lected in the Contractor’s price proposal.

5.2 FDA assumes that immediately upon contract award, the Contractor will initiate the process of obtaining the necessary study clearances, including but not limited to Institutional Animal Care and Use Committee (IACUC) approval and Drug Enforcement Administration (DEA) licenses for all controlled substances to be used in the study (especially with regard to Schedule I licenses, which are issued on the basis of individual protocols and typically require more lead time than licenses for other scheduled drugs).

5.3 FDA assumes that the research facility must be FDA Office of Laboratory Animal Welfare (OLA) assured and be accredited by Association for Assessment and Accreditation of Laboratory Animal Care International (AAALAC).

5.4 FDA assumes that the research facility is already compliant with DEA regulations regarding the handling and storage of Schedule 1 substances, as well as other scheduled substances to be used in the studies.

5.5 The Contractor shall designate a Principal Investigator and adhere to FDA Policies and Guidance in the performance of such duties. Studies do not need to be conducted under Good Laboratory Practice.

5.6 FDA has unlimited rights to all documents/material produced under this contract. All documents and materials produced under this contract shall be FDA-owned and are the property of FDA with all rights and privileges of the ownership/copyright belonging exclusively to FDA. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to FDA shall be the sole property of FDA and may not be used for any other purpose. All data collected by the

Contractor or provided to the Contractor in the performance of this contract are the property of FDA. FDA retains all rights to the data used and all derivative works developed by the Contractor.

6. Requirements

This section presents the tasks that will support or comprise a contract for assessing whether drug discrimination selectively evaluates pharmacological mechanisms of action.

The Contractor shall use the following measures for all studies unless otherwise specified for a single study:

1) Male outbred rats or mice shall be used for all studies in this task order. The Contractor shall use the same species and strain for all studies.

2) Adult rodents shall be used for all experiments.

3) An N of at least 12 rodents per group shall be used.

4) All studies shall be conducted during the rodent light cycle, between the hours of 8am-

4pm.

5) For all experiments, rodents shall be handled each day for at least 3 days prior to the start of experiments.

6.1 Animal Ordering, Housing, Handling and Maintenance

The Contractor shall order, house, handle and maintain animals. In support of this task, the Contractor shall keep a compendium of all instances of animal disease or injury, including the nature of the disease or injury and course of action, or instances of animal death not resulting f rom euthanasia due to completion of the experiment (e.g., deaths resulting from surgery or unknown cause). The Contractor shall include this compendium in the Final Report.

The Contractor shall deliver the animal subject health notifications within 48-hours of animal disease, injury or death.

6.2 Protocols

The Contractor shall propose complete scientific protocols and methodologies for all studies supporting this contract, based on the outline of studies provided by FDA. FDA will provide feedback and approval of the final protocols prior to initiation of the studies.

The Contractor shall propose a drug discrimination protocol based on the following specifications:

At a minimum, four groups of rats shall be trained to discriminate the four different training drugs (morphine, d-amphetamine, psilocybin, and alprazolam) from saline. Challenge drugs to include those with similar mechanisms of action, behavioral effects, and/or medical indications to the training drugs. For each group of rats, a standard panel of drugs with different mechanisms of action than the training drug will also be tested: phenobarbital, alprazolam, delta-9-tetrahydrocannabinol (THC), ethanol, amphetamine, morphine, psilocybin.

Group #1:

• Train rats (n = 12) to discriminate intraperitoneal (i.p.) morphine from saline, using published doses/pretreatment times and a f ixed ratio (FR) 10 schedule of reinforcement.

• Demonstrate a dose-response curve with three doses of i.p. morphine.

• Challenge with the following drugs at either a single standard dose or 1-3 doses (based on published studies), pretreatment times based on time to maximum plasma levels (Tmax), and no reward at the conclusion of the challenge session:

o Full mu opioid agonists (oxycodone, codeine) o Partial mu opioid agonists (buprenorphine) o Kappa opioid agonists (enadoline, Salvinorin A) o Mixed kappa/mu opioid agonists (nalbuphine, butorphanol) o Mixed kappa opioid agonist/mu opioid antagonist (pentazocine) o Non-opioid drugs that produce depressant effects (phenobarbital, alprazolam, ethanol, THC, diphenhydramine, suvorexant) o Non-opioid drugs with analgesic properties (aspirin, THC) o Standard panel not listed above (d-amphetamine, psilocybin)

Group #2:

• Train rats (n = 12) to discriminate intraperitoneal d-amphetamine from saline, using published doses/pretreatment times and a FR10 schedule of reinforcement.

• Demonstrate a dose-response curve with i.p. d-amphetamine.

• Challenge with the following drugs at either a single standard dose or 1-3 doses (based on published studies), pretreatment times based on Tmax, and no reward at the conclusion of the challenge session:

o Drugs that have activity as dopamine transporter (DAT) inhibitors (methamphetamine, methylenedioxymethamphetamine (MDMA), cocaine, mephedrone) o Drugs that have activity as serotonin transporter (SERT) and norepinephrine transporter

(NET) inhibitors (duloxetine), o Drugs that produce stimulant effects through non-DAT mechanisms (caffeine, nicotine, modafinil, bupropion) o Standard panel not listed above (phenobarbital, alprazolam, THC, ethanol, morphine, psilocybin)

Group #3:

• Train rats (n = 12) to discriminate intraperitoneal psilocybin from saline, using published doses/pretreatment times and a FR10 schedule of reinforcement.

• Demonstrate a dose-response curve with i.p. psilocybin.

• Challenge with the following drugs at either a single standard dose or 1-3 doses (based on published studies), pretreatment times based on Tmax, and no reward at the conclusion of the challenge session:

o Tryptamine and phenethylamine 5HT2 agonist psychedelics (lysergic acid diethylamide

(LSD), 2,5-dimethoxy-4-iodoamphetamine (DOI) o Non-5HT2 agonist drugs with psychedelic-like effects (Salvinorin A, ketamine, dextromethorphan, MDMA) o Standard panel not listed above (phenobarbital, alprazolam, THC, ethanol, d-amphetamine, morphine)

Group #4:

• Train rats (n = 12) to discriminate intraperitoneal alprazolam from saline, using published doses/pretreatment times and a FR10 schedule of reinforcement.

• Demonstrate a dose-response curve with i.p. alprazolam.

• Challenge with the following drugs at either a single standard dose or 1-3 doses (based on published studies), pretreatment times based on Tmax, and no reward at the conclusion of the challenge session:

o Benzodiazepines (diazepam, lorazepam) o Non-benzodiazepine gamma-amino-butyric acid (GABA) agonists (phenobarbital, ethanol, gamma-hydroxy-butyrate (GHB)) o Non-GABA drugs that produce depressant effects (opioids, ethanol, THC, diphenhydramine, suvorexant) o Non-GABA drugs that produce anxiolysis (buspirone, paroxetine, escitalopram) o Standard panel not listed above (THC, ethanol, d-amphetamine, morphine, psilocybin)

The Contractor shall deliver the initial draft proposed study protocol within 20-business days after award. The Contractor shall deliver the final proposed study protocol within 40-business days af ter award.

6.3 Institutional Animal Care and Use Committee (IACUC) Approval and DEA License

Approval The Contractor shall obtain IACUC review and approval. The Contractor shall have Office of Laboratory Animal Welfare (OLAW) assurance on file and be accredited by American Association for Accreditation of Laboratory Animal Care (AAALAC). The Contractor shall ensure that the IACUC approval package include all the Contractor’s proposed protocols—to include identification of species and approximate number of animals to be used, rationale for the use of animals, species, and number used, complete description of proposed animal uses, description of procedures to minimize discomfort and injury to animals, and description of euthanasia methods to be used. Documentation of prior approval from an external IACUC may be included.

The Contractor shall deliver an email message showing IACUC approval of research protocols within 70-business days after award.

The Contractor shall obtain all necessary DEA licenses for required study drugs that are scheduled under the Controlled Substances Act (CSA). The Contractor shall prepare the DEA license applications for these drugs, as appropriate, and shall respond to any queries posed by

DEA.

The Contractor shall deliver an email message with regular updates regarding DEA license approvals for scheduled research drugs, starting 70-business days after the award and biweekly af ter that until all approvals are obtained.

6.4 Drug Discrimination Studies

The Contractor shall conduct a series of drug discrimination studies in rodents. Studies shall be performed in at least four separate groups of animals, as described in section 6.3, trained to discriminate the following drugs of abuse from saline: a full mu opioid agonist (morphine), a stimulant (d-amphetamine), a specific serotonin receptor (5-hydroxytryptamine; 5HT2) agonist psychedelic (psilocybin) and a benzodiazepine (alprazolam) o For each training drug, a full dose-response curve must be determined. The doses used should reflect doses typically used in rats in the published scientific literature.

o Substitution tests should be performed with 1-3 doses of each substance. The doses used for the substitution drugs should reflect doses typically used in rats in the published scientific literature.

The Contractor shall deliver the drug discrimination studies within 480-business days (24 months) af ter award.

6.5 Study Reports

The Contractor shall write draft and final reports fully describing and characterizing the data.

Study reports should include detailed accounts of the study procedures (e.g., materials and methods) and be drafted in a format suitable for publication in a peer reviewed scientific journal.

The Contractor shall deliver a draft report to the Contracting Officer’s Representative (COR). The draf t report shall consist of the work performed during the contract period of performance, including, but not limited to, specific methodologies, results, tables and figures, statistical analyses, raw data, and data analysis files from all studies in this contract. This report shall be in suf ficient detail to comprehensively describe all results. Safety information regarding the response of the rats to the study treatments (including any severe reactions or deaths) shall also be provided (i.e., compendium).

The Contractor shall also ensure that draft and final reports include the following statistical and data analyses:

The Contractor shall provide draft and final reports which include information on the specific protocols, drug doses, and materials/equipment used for each study to include, but not limited to the number of animals used for each study, rodent species and strain, suppliers, including city, state, and country for all animals, drugs, equipment and materials used in the study, and details regarding surgical procedures, including selection of anesthesia and animal recovery time.

In collaboration with the FDA, the Contractor shall conduct statistical analyses to evaluate the data. The Contractor shall provide draft and final reports which include a data analysis component. The data analysis component shall include, but not be limited to, personnel who will conduct the statistical analyses and qualifying credentials (e.g., relevant course work and/or training), software program(s) that will be used to analyze the data, methods and criteria for outlier detection and removal where applicable, and selection of the significance level and post-hoc analyses when applicable.

The Contractor shall deliver a draft report, to the COR, within 440-business days (22-months) af ter award. The Contractor shall deliver the final report, to the COR, within 480-business days (24-months) after award.

6.6 Project Management Support

The Contractor shall perform project management activities. The Contractor shall manage cost, schedule, and quality daily. All management activities for the contract shall be performed throughout the period of performance.

The Contractor shall:

• Ensure that the scope, schedule, performance, and cost are consistent with the terms of the contract.

• Perform full project lifecycle ownership

• Plan and organize work to deliver required results, provide appropriate resources with the required skill and ability to complete the work within agreed upon timeframes, and provide guidance and leadership to those resources.

• Develop a Work Plan.

• Conduct monthly project meetings to brief FDA on progress, review issues, updates to the project schedule, and address questions/issues.

o Provide a monthly status report.

• Monitor contract compliance

The Contractor shall support routine project management and status meetings (e.g.

monthly progress meetings, bi-weekly (i.e. twice a month, every other week) status meetings, ad hoc meetings). The Contractor shall participate in meetings in different capacities, to include leading discussions, contributing questions and answers, raising issues/concerns, recommending potential solutions, developing and giving presentations, and other active oral and written communications. The Contractor shall prepare and track meeting agendas, minutes/notes, issues, and action items for all meetings held with Subject Matter Experts (SMEs) and FDA designated staff in support of the project and any planned deliverable. Meeting minutes shall be required for all project meetings, and shall include participant information, summary of the meeting discussion, action items, issues, and decisions made during meetings.

In addition to the routine project meetings, the Contractor shall schedule and conduct a presentation of its approach at a Kickoff Meeting, to be held within five (5) business days of contract award. The Contractor shall deliver a Summary within three (3) business days af ter the Kickoff Meeting, to document key decisions, actions, milestones, issues, and concerns that were discussed and agreed upon during the Kickoff Meeting.

6.6.2 Reporting

The Contractor shall immediately and proactively inform the COR, Project Manager(s) and/or designee(s) of all issues, problems, and recommendations that should be addressed for the overall effective accomplishment of project goals. Upon the COR’s approval, recommendations for actions that need to be taken by FDA staff, or other Contractors, shall be clearly defined and will be reviewed by the COR for approval. The Contractor shall communicate each approved action to the responsible party and the FDA, and each approved action shall have identified dates for completion.

• Meeting Agendas and Minutes/Notes

The Contractor shall participate in a bi-weekly (i.e., every other week) call with the COR and other FDA staff, as needed. The Contractor shall also participate in other or ad hoc meetings. These calls shall be used as a mechanism for discussing and managing administrative and project issues that surface prior to the call. The Contractor shall produce and deliver agenda items at least two (2) business days prior to the calls and provide a written summary of the teleconference on the third business day following the meeting. The summary report shall include:

• Date, time and place of meeting;

• Attendees by name and title; and

• Subjects/issues discussed, resolution reached, and action items required

• Monthly Status Reports

The Contractor shall submit to the COR a monthly status report covering all requirements and tasks specified in this SOW, on the 10th business day of each month. Within the first thirty (30) days after contract award, the Contractor shall propose a reporting format, subject to FDA approval. The report shall outline all work accomplished the previous month with a comparison of planned tasks versus actual completion, success in meeting service level metrics (if applicable), and recommendations for changes or additional activities to ensure the tasks support progress on the overall objectives. The report shall also inform the FDA of any significant problems that may adversely affect project performance, cost and the Contractor’s proposed solution for addressing these problems.

• Project Management Closure Report

The Contractor shall prepare and submit draft and final versions of a comprehensive Project Management Closure Report, 15 business days before, and the last day of the contract, respectively. The Report shall capture cost invoice status, summary of work delivered, and any uncompleted activities during the period of performance. The Contractor shall also support FDA in any transition-out activities at may apply to project closure.

6.6.3 Work Plan

The Contractor shall develop a Work Plan that provides the technical approach, organizational resources, deliverables, documentation, and management controls to be employed to meet the cost, performance, and schedule requirements throughout project execution. The Work Plan should represent the formal road map for project activities that communicates a set of goals, processes, and actions by which personnel can accomplish those goals. The Work Plan should also clearly articulate the required steps needed to achieve a stated goal by setting demonstrable objectives and measurable deliverables that can be transformed into actions. The Work Plan shall serve as a guiding document for the Contractor, enabling the realization of an outcome through efficient team activities.

At a minimum, the Work Plan shall address the following areas: Requirements Management, Risk Management, Schedule Management, Cost Management, Quality Management, Communications, Staffing (including plans for Staff Training and Staff Retention) and Project Organization, Performance Metrics, timely delivery and reporting quality controls, and clearly defined roles, responsibilities, lines of authority, resources appropriately aligned to services and deliverables. Changes to the Work Plan shall be subject to review and approval by the COR. Once approved, the updated Work Plan shall be enforced for implementation of the tasks.

The Contractor shall deliver the Draft Work Plan and Final Work Plan 15- and 25-business days after award

7 Deliverables

Format of Deliverables

All deliverables are expected to first be submitted to the COR and FDA program official as draft at a minimum of five (5) business days before the final deliverable due date. Deliverables (both draft and f inal versions) shall be provided in soft copy using Microsoft (MS) Office products as specified below. Summary documents shall be presented in an MS PowerPoint format to easily share with FDA leadership. Daily, weekly, interim, informal, and working-copy products may be provided by email to the COR and FDA program officials. Final soft copies of deliverables, at the end of the period of performance, shall be developed using the current FDA version of MS Office products and/or other standard application software unless otherwise specified.

Deliverable Submission Procedures

The Contractor shall submit the draft and final deliverable to the COR, unless otherwise stated in the deliverable schedule. The COR will be responsible for the review and acceptance of all draft and f inal deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the statement of work requirements of the task.

The Contractor shall ensure the accuracy and completeness of all deliverables in accordance with referenced policy, regulations, laws, and directives. Reports and presentations shall be concise and clearly written; errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and "padding," or excessive length if a page limit is imposed, shall be considered deficiencies and will be subject to correction by the Contractor at no additional cost to the government.

A Level II certif ied COR will utilize the Contracting Performance Assessment System (CPARS) to assess the contractor’s performance based on feedback at task completion. The COR will monitor technical progress including the surveillance and assessment of performance and compliance with project tasks. The COR will perform technical inspections and acceptance of deliverables. The COR will review invoices and facilitate any required corrections.

In the event FDA rejects any deliverable, the COR shall notify the Contractor in writing explaining the specific reason(s) for the rejection. If FDA suggests changes, or rejects, the Contractor shall resubmit the revised deliverable within five (5) business days after receiving FDA’s input.

Deliverable Schedule

The list below summarizes specific tasks, activities, and deliverables the Contractor shall deliver in support of FDA objectives. A suggested timeframe for deliverables is included. The Contractor may propose a schedule in their response to the RFP. The f inal deliverable schedule will be agreed upon the by the Contractor and COR, and will be specified in the Work Plan. Due dates are expressed in business days (versus calendar days).

Ref. Deliverable Name Due Date Format

6.6.1 Project Kickoff Presentation

Brief ing Within 5 business days after award PowerPoint

6.6.1 Kickoff Meeting Summary Within 3 business days after

Project Kickoff Meeting Microsoft Word

6.6.3 Draf t Work Plan Within 15 business days after

award Microsoft Word

6.6.3 Final Work Plan Within 25 business days after

award Microsoft Word

6.1 Animal Subject Health

Notif ications

Within 48 hours of animal disease, injury or death. Email Message

6.2 Initial Draf t Proposed Study

Protocols

Within 20 business days after award Microsoft Word

6.2 Final Proposed Study Protocols Within 40 business days after award Microsoft Word

6.3 IACUC Approval of Research

Protocols

Within 70 business days after award Email Message

6.3 DEA License Approvals for

Scheduled Research Drugs

Within 70 business days after award, and biweekly until approvals are obtained

Email Message

6.4 Drug Discrimination Studies Within 480 business days (24

months) after award Microsoft Word

6.5 Draf t Report Within 440 business days (22

months) after award Microsoft Word

6.5 Final Report Within 480 business days (24

months) after award Microsoft Word

6.6.2 Meeting Agendas At least 2 business days prior to

meetings Microsoft Word

Ref. Deliverable Name Due Date Format

6.6.2 Meeting Minutes/Notes Within 3 business days after

meetings Microsoft Word

6.6.2 Monthly Status Report

Proposed template due no later than 30 business days after award;

monthly reports due the 10th business day of each month

Microsoft Word

6.6.2 Draf t Project Management

Closure Report

Within 15 business days of project completion Microsoft Word

6.6.2 Final Project Management

Closure Report Last day of period of performance Microsoft Word

8 Period of Performance The contract’s period will include a two (2) year period of performance.

9 Place of Performance The Contractor shall perform the study at its laboratory facility or sub-contracted laboratory facility.

10 Travel Travel encountered by the Contractor in the performance of the service(s) shall not be reimbursed.

11 Key Personnel

The Key Personnel specified for this contract are essential to work performance. Pursuant to HHSAR Clause 352.237-75, Key Personnel (December 2015), the Key Personnel for this contract are identified below.

The Contractor shall ensure that all Key Personnel are on-board immediately following contract award. The Contractor shall ensure that Contractor personnel have initiated background checks immediately after award.

Labor Category Desired Qualifications Senior Scientist/Principal Investigator

Extensive knowledge of drug discrimination study design and methodology, including statistical considerations. Experience with the overall management and conduct of drug discrimination studies including budgeting and project management.

12 Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI)

No Government-furnished property will be provided to the Contractor. During protocol development, FDA personnel will be available to consult with the Contractor and provide feedback. This feedback will be provided via regular (e.g., biweekly) meetings or as needed.

13 Security

1) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a) Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

b) Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

c) Comply with the Privacy Act requirements and tailor FAR clauses as needed.

2) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ ] Moderate [ ] High Integrity: [ ] Low [ ] Moderate [ ] High Availability: [ ] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [ ] Moderate [ ] High http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Conf identiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

3) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323.

All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a) marked appropriately;

b) disclosed to authorized personnel on a Need-To-Know basis;

c) protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and returned to FDA control, destroyed when no longer needed, or held until otherwise directed;

d) Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

4) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by FDA or collected by the Contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notif ied in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The conf identiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

5) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

6) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

7) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

8) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a) Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b) Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c) All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d) Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e) Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

9) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

10) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a) If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an ATO.

b) The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

14 Section 508 Compliance

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards.

This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Sections apply to this procurement:

E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements) E203 Access to Functionality (Appendix A, Application and Scoping Requirements) E204 Functional Performance Criteria (Appendix A, Application and Scoping Requirements) E205 Electronic Content (Appendix A, Application and Scoping Requirements) 302 Functional Performance Criteria (Appendix C, Application and Scoping Requirements) E208 Support Documentation and Services (Appendix A, Application and Scoping Requirements) Chapter 6 Support Documentation (Appendix C, Application and Scoping Requirements)

15 Special Material Requirements There are no requirements for any special materials in the performance of the service(s).

16 Other Unique Requirements There are no unique requirements or considerations for this effort.

6.6.3 Work Plan