FY25 RFP 75P00125R00014 Rev1 - 6 June 2025.pdf

(x)

75P00125R00014 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

OAMS

Rockville MD 20857 5600 Fishers Lane Office of Acquisition Management Services

OS/ASA/OAMS

06/06/20250001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

05/21/2025

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Title: Federal Occupational Health (FOH) - Information Technology (IT) Staffing Support

Services

This is Amendment 0001 of the Original Solicitation 75P00125R00014:

The purpose of this contract is to provide Information Technology Service Management support for Federal Occupational Health, Information Technology, (FOH IT).

The services provided will support FOH IT in performing its FOH enterprise-wide IT responsibilities covering FOH and its customers, will perform strategic and technical ITSM tasks and activities essential for FOH to optimize operational performance, and will provide administrative, technical and engineering staff to develop, implement, and maintain

Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Saundra Kpadeh

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 179

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

75P00125R00014/0001 elements of the assigned infrastructure.

The period of performance shall be for one (1) 7-month base period, four (4)

12-month option periods, and one (1) 5-month option period, as follows:

Base Period - August 31, 2025, through March 31, 2026

Option Period 1 - April 1, 2026, through March 31, 2027

Option Period 2 - April 1, 2027, through March 31, 2028

Option Period 3 - April 1, 2028, through March 31, 2029

Option Period 4 - April 1, 2029, through March 31, 2030

Option Period 5 - April 1, 2030, through August 30, 2030

The exercise of Option Periods is dependent upon funding and the Government's existing needs.

FOB: Destination

Change Item 1 to read as follows(amount shown is the obligated amount):

1 Base Period Federal Occupational Health (FOH) -

Information Technology (IT) Staffing Support

Services

Period of Performance: 08/31/2025 to 03/31/2026

Change Item 2 to read as follows(amount shown is the obligated amount):

2 Option Period 1 Federal Occupational Health (FOH)

- Information Technology (IT) Staffing Support

Services

(Option Line Item)

Period of Performance: 04/01/2026 to 03/31/2027

Change Item 3 to read as follows(amount shown is the obligated amount):

3 Option Period 2 Federal Occupational Health (FOH)

- Information Technology (IT) Staffing Support

Services

(Option Line Item)

Period of Performance: 04/01/2027 to 03/31/2028

Change Item 4 to read as follows(amount shown is the obligated amount):

4 Option Period 3 Federal Occupational Health (FOH)

- Information Technology (IT) Staffing Support

Services

(Option Line Item)

Period of Performance: 04/01/2028 to 03/31/2029

Change Item 5 to read as follows(amount shown is the obligated amount):

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 179

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

75P00125R00014/0001

5 Option Period 4 Federal Occupational Health (FOH)

- Information Technology (IT) Staffing Support

Services

(Option Line Item)

Period of Performance: 04/01/2029 to 03/31/2030

Change Item 6 to read as follows(amount shown is the obligated amount):

6 Option Period 5 Federal Occupational Health (FOH)

- Information Technology (IT) Staffing Support

Services

(Option Line Item)

Period of Performance: 04/01/2030 to 08/30/2030

All questions/inquiries concerning the solicitation document must be submitted by email (no face or telephone calls please) to the Contract Specialist at ivan.mora-juarez@hhs.gov. Questions and submission instructions are found in Section

L.

Attachments

J.1 - Contractor Non-Disclosure Agreement

J.2 - Quality Assurance Surveillance Plan (QASP)

J.3 - Labor Categories

J.4 - Contractor Performance Self-Assessment

J.5 - Price Worksheet

J.6 - Past Performance Questionnaire

J.7 - Disclosure of Lobbying Activities

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

Solicitation #: 75P00125R00014

Federal Occupational Health (FOH) – Information Technology (IT) Staffing Support Services

SECTION B - Supplies or Services and Prices/Costs

Section B – Time and Materials

B.1 BRIEF DESCRIPTION OF SERVICES

The requirement is to acquire the services of quality information technology professionals to support the medical and occupational health mission of Federal Occupational Health (FOH) of the Program Support Center (PSC), under the Department of Health and Human Services (HHS).

FOH provides integrated Occupational Health Services (OHS) throughout the Federal

Government. These services are to facilitate delivery of FOH occupational health services by providing reliable Information Technology (IT) infrastructure and staffing expertise that supports mandated requirements and efficiently allows FOH staff to be as competitive as possible in the performance of their work.

B.2 TYPE OF CONTRACT

The anticipated contract type is commercial Time and Materials (T&M).

B.3 SEVERABLE SERVICES

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

B.4 CONSIDERATION AND PAYMENT (T&M – Severable Services)

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid in accordance with the fixed loaded hourly rates as shown herein for the specified categories of labor based on the number of actual hours incurred in the performance of the work specified. Fully loaded rates shall be all inclusive of direct labor, fringe benefits, applicable indirect costs, and any profit for each labor category. Additionally, the contractor shall be reimbursed the actual cost of materials in accordance with FAR 52.212-4; Alt 1. If the ordering options are exercised, funding will be obligated by modification to the contract. The option periods are priced as follows:

B.5. CLIN 1 - Base Period: August 31, 2025, through March 31, 2026 Labor Categories Loaded Rates Estimated Total

Labor Subtotal $

Materials Subtotal

CLIN Ceiling (Not to Exceed)

B.5.1 CLIN 2 – Option Period 1: April 1, 2026, through March 31, 2027

B.5.2 CLIN 3 – Option Period 2: April 1, 2027, through March 31, 2028

B.5.3 CLIN 4 – Option Period 3: April 1, 2028, through March 31, 2029

B.5.4 CLIN 5 – Option Period 4: April 1, 2029, through March 31, 2030

B.5.5 CLIN 6 – Option Period 5: April 1, 2030, through August 30, 2030

B.5.6 Base and All Options Value:

B.5.7 MATERIAL (NON-LABOR) INDIRECT COST RATES

Pursuant to the General Provisions of this contract and FAR 52.232-7 Payments Under Time and

Materials and Labor Hour Contracts, the following indirect fixed rate to be applied against

Materials is established:

Type Fixed Rate

Materials Handling

B.6 CEILING PRICE

The hours and total price per labor category are for budgeting purposes only. The number of hours actually used for each category may exceed or be less than the estimate by category as long as the ceiling price for the CLIN is not exceeded. The ceiling for each CLIN is identified in

Section B. The Government shall not be obligated to pay any amount in excess of this ceiling price nor is the Contractor obligated to continue performance if to do so would exceed this ceiling price. In the event that the Government chooses to exercise optional CLINS, unused funds from a previous CLIN may not be used to fund any services taking place in a subsequent

CLIN. The ceiling price may be modified by the Government if it is determined that the estimated hours or estimated materials are insufficient for the work required.

B.7 ADDITIONS AND CHANGES TO LABOR CATEGORIES

It may be necessary to add or change labor categories during performance of this contract in order to carry out the services described in Section C. If new labor categories are added, or existing labor categories revised, the parties will negotiate the labor category(ies) prior to the incorporation into the contract. Any new labor rate proposed will be evaluated for reasonableness in accordance with FAR 15.4.

SECTION C - Description/Specifications/Performance Work Statement

TITLE: Federal Occupational Health (FOH) – Information Technology (IT) Staffing

Support Services

C.1 PROGRAM DESCRIPTION AND BACKGROUND

The mission of Federal Occupational Health (FOH), a component of the Program Support Center

(PSC), within the U.S. Department of Health and Human Services (HHS), is to improve the health, safety, and productivity of the Federal workforce. Granted authority under 5 USC § 7901, FOH promotes and maintains the physical and mental fitness of federal employees of HHS and other federal agencies by providing occupational health programs and services, including:

clinical services delivery, expert medical consultation tailored to a particular federal agency’s occupational health service needs, wellness and health promotion services, behavioral health services, and environmental health and safety services.

FOH provides occupational health programs and services as centralized services through the

HHS Service and Supply Fund (SSF) authorized at 42 USC 231. The Continuing Appropriations

Act, 2021, and Other Extensions Act, Pub. L. No. 116-159, div. C, title I, sec. 2107 (Oct 1, 2020) states that the SSF Statute “shall be applied with respect to any fiscal year as though the phrase

‘central services’ referred to central services for any Federal agency.” This provides specific transfer authority for the provision of occupational health services under 5 USC §7901 for both

HHS employees and employees of another federal agency.

FOH provides such occupational health services to federal customer agencies exclusively through Interagency Agreements (IAAs). FOH is the largest provider of occupational health services in the Federal Government. FOH enters into IAAs negotiated with federal departments and federal agencies’ national headquarters, and/or with their regional/local components for occupational health and consultation services. FOH maintains sole responsibility for consulting with its Federal agency customers. The Contractor’s primary role is to facilitate delivery of FOH occupational health services by providing reliable IT infrastructure and staffing expertise that supports mandated requirements and efficiently allows FOH staff to be as competitive as possible in the performance of their work. The intent is that these will aid in management of the revenue stream for the entire organization. IT is a significant enabler to the FOH mission.

FOH is supported by HHS Office via an IAA in conjunction with the Contractor supported scope of work outlined in this requirement. The FOH Business Owner and the FOH Contracting

Officer’s Representative (COR) ensures that the terms and conditions of the IAA are met.

Additional background information about FOH may be found at FOH | HHS.gov.

C.1.1 PURPOSE

The purpose of this requirement is for FOH IT to procure a full range of qualified IT personnel to perform enterprise-level end-to-end IT operational services to support the IT infrastructure in meeting mission requirements and operational objectives.

C.1.2 OBJECTIVES

The overall objective of this requirement is to provide highly efficient, cost-effective, performance-based IT services for FOH. The Contractor will be required to perform day-to-day operations and maintenance for the FOH IT infrastructure, which includes customized government off-the-shelf

(GOTS) applications, security applications and supporting infrastructure (as described in section

C.2.2. Current FOH Infrastructure and Services) that is used to manage and perform work within

FOH. These systems support critical business and program activities.

The Contractor shall provide a technologically effective solution to maintain and improve the current

IT operational infrastructure, support potential future enhancements in response to emerging IT requirements and provided reduced costs and increased efficient overtime in support of the following categories:

1. Infrastructure Monitoring and Management Services

2. Customer Support /Application Support

3. Program Management and Administration

C.2 PERFORMANCE WORK STATEMENT

C.2.1 GENERAL REQUIREMENTS

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in the contract.

The Contractor shall perform day-to-day operations and maintenance for the Federal

Occupational Health (FOH) Information Technology (IT) infrastructure, which includes customized GOTS applications, security applications and supporting infrastructure (as described in section C.2.2. Current FOH Infrastructure and Services, that is used to manage and perform work within FOH. These systems support critical business and program activities.

The Contractor shall provide administrative, technical, and engineering staff support to develop, implement, and maintain all elements of the assigned FOH IT Infrastructure. The

Contractor shall perform all service delivery responsibilities in compliance with all HHS IT standards, direction, and guidance, as well as other application service delivery documents as directed by the Government.

The Contractor shall maintain a framework that enables disciplined management and execution of changes to FOH IT Systems and the configuration management of those changes. The

Contractor shall perform proactive planning to ensure high availability, reliability, and responsiveness of FOH IT Systems while adapting to and implementing frequent changes and working within a quality control environment that encourages and reinforces appropriate testing of new capabilities to prevent adverse impact to operations or the user’s experience during system modification and/or upgrades.

The Contractor shall provide superior end-user service delivery for approximately 900 users through a flexible and responsive delivery methodology capable of quickly and effectively responding to new IT service needs and mission requirements, provide customer-focused service delivery performance targets that align all IT services with FOH requirements and needs, and enable FOH with continuous, highly available, secure, and efficient IT service support. The Contractor shall achieve continual improvement in customer satisfaction while meeting or exceeding performance targets.

The Contractor shall obtain and maintain an Authorization to Operate (ATO) on behalf of HHS for

FCS-STM, FCS-FedHealth and FCS-MERITS in accordance with technical specifications outlined below

(Section C.2.2.7, C.2.2.10 and C.2.2.11) in the HHS AWS cloud environment. The contractor shall obtain an

Authorization to Operate for new FOH applications in accordance with HHS Enterprise Lifecycle

Performance Framework (EPLC). FOH systems are subject to HHS’ Certification and Accreditation (C&A) process to receive the ATO prior to use by Federal employees. HHS officials will approve the ATO and

HHS will perform or contract out the independent System Test and Evaluation (ST&E) requirements of the

C&A process. Contractors must demonstrate experience in maintenance and support of secure AWS cloud-based systems.

C.2.2 CURRENT FOH INFRASTRUCTURE AND SERVICES The Contractor shall manage operations, maintenance, and the continuous enhancement of all FOH IT systems and services, as well as support any third-party replacement or modernization to achieve the target state of the FOH IT environment as determined and directed by the Government.

FOH partners with vendors for Contractor-owned/ Contractor-operated (COCO) Platform-as-a-

Service (PaaS) and Software-as-a-Service (SaaS) to execute our operational service. The

Contractor shall work with HHS, third-party vendors, and other stakeholders to support COCO, PaaS and SaaS as directed by the COR.

Non-sensitive information for FOH IT systems, platforms, tools and services are described within this section. Within scope upgrades to services and platforms may be required in accordance with FOH operational and security requirements. The Government will disclose sensitive details post award.

C.2.2.1 Network and Network Services

• FOH is running a blend of Windows Server and Red Hat Enterprise Linux (RHEL) servers.

• High-availability/High-traffic application systems make use of web forms and content switches, as well as cluster-based zero-trust architectures.

• Some Local Area Networks (LANs) may make use of secure wireless solutions. To date, these have been implemented with Cisco equipment.

• Virtual Private Network (VPN) is provided via GlobalProtect client version 6.2.0-89 or higher for (Health and Human Services HHS).

• Authentication services for systems accessed from remote sites are managed by the HHS

Access Management Services (AMS) service utilized for FedHealth and FOH Service

Tracking and Management System (FSTM). FOH is in the process of identifying a multi factor authentication (MFA) solution for remote desktop protocol (RDP)access for

MERITS. AMS is an Identity Assurance Level Three (IAL3) Authenticator Assurance

Level Three (AAL3) identity provider that is a separate page with a consistent interface that controls access to both FedHealth and FSTM. AMS is provided by an internal vendor supported by contractors. Users are redirected to AMS in order to authenticate via

IAL3/AAL3 credentials and are not allowed to proceed to the target application if any lower-level credential sets are presented. Personal Identification Verification (PIV) provides level 3 credentials. External Access Management System (XMS), which is the external version of AMS, hardened for public exposure, shall be implemented and utilized in the future, in areas where public facing systems access management is required for multi-factor authentication.

C.2.2.2 Network and System Administration

• FOH systems are hosted as Infrastructure as a Service (IaaS) in the HHS Cloud-Managed

Application Hosting Center (C-MAHC) operated by OCIO. Relational Database Services

(RDS) is in the works and S3 is active but being used in an IaaS fashion until logging is stood

up. The system shall then be hybrid IaaS/PaaS (Platform as a service).

• All FOH systems are on virtual machines with production and staging environments on HHS hosted Amazon Web Services (AWS) instances. The production and support environments

(staging, quality assurance (QA)) are Amazon AWS EC2 (Elastic Compute) instances that are managed by an outside cloud vendor. All systems are either Microsoft Windows Server or

RedHat Enterprise Linux. Each instance is set up with internal and external configurations to control access depending on use case. When RDS is stood up, it will act as a serverless solution.

• Development environments are also hosted on HHS managed AWS hosts. There is no fail-over environment.

• Backups are performed by HHS via a ComVault solution in the C-MAHC.

• Corporate Anti-Virus protection, a Zenoss solution, is supported by HHS in the C-MAHC.

• Patch management and configuration compliance is the shared responsibility of FOH IT and

HHS. FOH IT provides for the Application layer up, while HHS OCIO manages everything below the Application layer, including the OS layer.

• FOH assets reside on the HHS general support network managed by OCIO. FOH asset security is the shared responsibility of OCIO and FOH IT.

• Tenable Security Center OCIO- managed is used to analyze security vulnerabilities in both instances. This system identifies known and zero-day vulnerabilities, plus provides security risk assessments, enabling security best practices, policy enforcement, and regulatory audits.

C.2.2.3 Cybersecurity

• FOH receives System Security and Privacy Officer (SSPO) and Information Systems Security

Manager (ISSM) services through an Interagency Agreement with OCIO’s Enterprise Security

Services line of business for FOH systems which are all categorized as Moderate systems.

• SSPO services are carried out in accordance with the most recent version of the HHS SSPO

Designation Memo which includes Authority to Operate (ATO) support, system security documentation maintenance/review, risk management, incident management, account/access control management, security consulting, systems Plan of Actions and Milestones (POA&M) management, (Enterprise Performance Life Cycle) EPLC/ Software Development Lifecycle

(SDLC) security support, and continuous monitoring.

• The Contractor’s cybersecurity responsibilities are focused on the applications because the

FOH Communication System (FCS) applications are hosted as PaaS in OCIO’s Cloud.

C.2.2.4 Application Hosting

• Web hosting is performed using Internet Information Services (IIS) on Windows 2019 or higher, and Apache on RHEL7 or higher. Application hosting is shared (multiple applications on the same machine), dedicated (one web/application server per system), or as load balanced web servers. Multi- server balanced configurations use a Cisco content switch, and/or

Microsoft Windows content management solutions.

• Data services are provided via Microsoft SQL Server and MariaDB. FOH also makes extensive use of Microsoft SQL Server Reporting Services.

• Advanced data system configurations make use of replication and/or log shipping to help balance system performance and provide for redundant systems.

C.2.2.5 Application Development

• Some corporate applications are developed as ASP.Net applications. Systems are developed as secure n-Tiered web applications using the ASP.Net 4.0 framework and C# Code. The remainder are using Linux Apache MariaDB C JS HTML.

• The application MERITS was developed in Visual Basic 6.

• The FOH intranet (Staff Portal) is running on Microsoft Office SharePoint Online.

• Microsoft Access is used as a “desktop” database in limited cases to develop and integrate with corporate data systems and ETL is handled in a bespoke fashion including cygwin command line tools like AWK, SED, and PERL.

• All Service Tracking and Management System (STM) development is done in Visual Studio

(VS). We use VS2005, VS2008, and VS2013 depending on the server.

• The code repository for STM is in Microsoft Team Foundation Server 2012. We will be redeploying the source code repository as time permits and shall migrate to Global Information

Tracker (GIT) source code repository, when appropriate.

• Datatables.net is a commercial component used in the FOH billing application STM. It is used as the mechanism for replacing the Infragistics ASP.Net library.

C.2.2.6 Office and Health Center Desktops/Laptops

• Desktop and laptop hardware is provided and supported by HHS / OCIO.

• FOH uses the following standard applications on client PCs:

o Windows 11 Enterprise or higher o Microsoft Office 365 Enterprise 16.16731.20810 or higher o Adobe Acrobat Reader 2024.003.20180 or higher o Adobe Acrobat Pro 2024.002.20857 or higher o Microsoft Edge Version 129.0.2792.89 (Official build) (64-bit) or higher o Google Chrome Version 129.0.6668.101 (Official Build) (64-bit) of higher o CrowdStrike Windows Sensor 6.28 7.16.18613.0 or higher o PKWARE SecureZIP 14.50.0010Java Runtime Environment -14.50.0030 or higher o Adobe Flash Player o Cyberlink DVD (if PC equipped with DVD drive) o Laptop images use Endpoint Security to encrypt the entire drive (an HHS requirement).

• FOH uses the following specialized applications. These applications are provided on an as needed/approved basis, based on written approval from the COR:

o Microsoft Project 16.0.16731.20810 or higher o Microsoft® Visio® Plan 2 MSO (Version 2308 Build 16.0.16731.20796) 32-bit or higher o FOH will provide the systems and tools as Government Furnished Equipment (GFE).

Any new tools requested by the Contractor must be approved by the COR prior to use.

C.2.2.7 FCS - STM

• Users access the system using a Microsoft Internet Explorer browser, using a Transport Layer

Security (TLS)/Secure Socket Layer (SSL) connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

Prior to application access, users are redirected to the appropriate AMS server for MFA authentication.

• The browsers running the web application connect to the scalable web server operating with

Internet Information Services, and in-turn to the database servers.

• Microsoft SQL Server provides the database technology for the applications. The SQL

Servers are scalable. Currently, there is a core database server, Data Mart server for reporting, and a reporting server, one of which is dedicated for queued reports. Each server may be scaled with additional processors, memory and/or storage devices as needed.

• The web servers are hosted on a Secure Subnet in the C-MAHC; this area of the network is isolated from the Internet by the External Firewall and the OCIO network infrastructure.

• The Windows 2019 based IIS web server provides an application hosting platform for the

ASP.Net application. Note: The system is designed so that if traffic becomes excessive for one web server to support, it will be possible to scale to multiple web servers.

• The Windows Server 2019 based SQL Server platform serves as the database that supports the ASP.Net applications. The system is designed to use multiple database servers; one for the core data system, one for SQL Reporting Services, and one to provide a data mart for queued reports to be developed from. If this component needs to be scaled, more processors, memory and/or storage devices will be added to those platforms.

• The web server is hosted on the Screened Subnet – this is an area of the network that is logically isolated from the rest of the FOH application servers and the HHS Wide Area

Network (WAN) by a Virtual Local Network (VLAN) with access controlled via ACLs.

• Since the data system contains Personally Identifiable Information (PII), the database servers are placed on the Secure LAN. The Secure LAN is an area that is logically isolated from the

HHS LAN/WAN by an internet firewall within the C-MAHC.

• Users that access the STM application do so via a TLS 1.2 connection. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

• Users of the Employee Assistance Program (EAP) Chart Review Record (CRR) application use Secure Remote access directly to the CRR Terminal Server and have access only to

Exchange email to manage distribution of the case audit reports. This application is a data repository.

• The FOH Central Site System (CSS) application is used by only a few FOH Staff, who access this application via the CRR/CSSTerminal Server. There are no external users of CSS. This application is a data repository.

• Users access the data system via a Microsoft Edge browser.

• There is limited documentation for FCS- STM.

C.2.2.8 FCS - FOH Staff Portal Website (Staff Portal)

• The FOH Staff Portal is currently hosted in the HHS 365 SharePoint Cloud instance.

• Users that access the Staff Portal application do so via any modern web browser using a

TLS/SSL connection. Users must be on the HHS network and authenticate via personal identification verification (PIV) card. The use of TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

C.2.2.9 FCS - FOH Public Website (Public Web)

• The Public Web consists of one (1) primary Linux RHEL7 server using Apache.

• Users access the data system via a Microsoft Edge browser, managed by Assistant Secretary for Public Affairs (ASPA) with content and formatting support from the IT support team.

C.2.2.10 FCS - Medical Evaluation/Requirements Information Tracking System

(FMERITS)

• The operating system for MERITS is Microsoft Windows. Visual Basic 6.0 (SP6) provides an interactive communications interface between users and MERITS.

• The source code for the programs that process MERITS data is developed in Visual Basic and

Transact-SQL (T-SQL).

• Internal HHS users access the MERITS application via the Microsoft Remote Desktop terminal server application with PIV Authentication for Multi-Factor Authentication (MFA).

• External users are currently unable to access applications without PIV credentials. Extra-agency users are currently unable to access MERITS until a suitable replacement for Pulse

Secure is stood up. FOH is currently exploring options for a pulse-secure replacement.

• OCIO manages the firewalls and routers that connect the FMERITS system to the Internet.

Once the user gains access to the Terminal Server, user can access the MERITS application through a desktop shortcut.

• The desktop application connects to the SQL database and to a file server that are located behind a secure subnet firewall.

• The MERITS sub-components share authentication, and are all accessed by accessing the

MERITS application, then using a dashboard to connect to the sub-component that needs to be used.

C.2.2. 11 FCS - FedHealth

• FedHealth is a web-based system that is accessible by all authorized FOH personnel.

FedHealth is built upon the Commercial off the Shelf (COTS), Enterprise Health products.

• Users access the system using an internet browser, using an TLS/SSL connection. The use of

TLS/SSL helps ensure that data transmitted between the browser and the web server is not susceptible to interception.

• The browsers running the web application connect to the scalable web server farm operating with Apache web services and in-turn to the database servers.

• Maria database in RHEL provides the database technology for the applications. The Maria

DB servers are scalable. Currently there is a core database server; a cloned server for reporting;

and one is dedicated for queued reports. Each server may be scaled with additional processors, memory and/or storage devices as needed.

• The web servers are hosted on the Secure Subnet; this area of the network is isolated from the

Internet by the External Firewall within the C-MAHC.

• The data system contains PII on the database server on the Secure LAN. The Secure LAN is an area that is isolated from the FOH LAN/WAN by an Internal Firewall.

• The RHEL based Apache provides an application hosting platform for the FedHealth

WebChart based application. Note: the system is designed so that if traffic gets to be excessive for one web server to support, it will be possible to scale to multiple web servers.

• End users can send and receive large or numerous files that would not be practical via OCIO provided methods and allow for simple retrieval by recipients. Files are sent via HHS File

Sharing Platform built on Box secure cloud content management.

C.2.2.12 Software-as- a Service (SaaS) and Platform-as-a Service (PaaS) Systems / Owned /

Contractor-Operated Systems (COCO)

• Private Provider Network Client Portal (PPN-CP) - PPN is a web-based application and system that is accessible by all authorized FOH personnel. PPN contains PII and PHI.

• Clinical Labs (CL) – CL is a web-based application is accessible by all authorized FOH personnel. CL contains PII and PHI.

• Online Medical Evaluation Tool (OME) – OME is a web-based system accessible by authorized FOH personnel. OME contains PII and PHI.

• Wellness Health Promotion Portal (WHPP) – WHPP is a web portal accessible by federal employees.

C.2.2.13 Government Provided Tools

• IT Service Management: OneView (built on Salesforce Service Cloud), Jira, ServiceNow.

• Collaboration tools: SharePoint, HHS File Sharing Platform (built on Box).

C.3.0 STAFFING REQUIREMENTS

The Contractor shall accomplish the assigned work by employing and utilizing qualified personnel who meet the minimum labor category descriptions in Attachment J.3 Labor

Categories. Staff must have experience and proficiency in the tools that are necessary to perform their responsibilities, and where defined, will be expected to use the HHS standard enterprise tool sets HHS IT Policy Archive | HHS.gov. The Contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The

Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

Employee retention is highly valued as the Contractor is expected to accumulate business specific knowledge. The Contractor shall take necessary steps to limit the turnover of the employees assigned to this contract.

Conflict of Interest. Neither the Contractor nor its employees shall utilize their knowledge of access to information, sensitive or otherwise, for individual or company gain.

C.3.1 Proposed Candidates

a. The Contractor shall provide fully screened, experienced, and qualified candidates to perform the work identified. Proposed candidates should meet educational, training, competency, licensure and experience requirements, appropriate health status to perform the physical requirements of the position, as well as the ability to obtain and maintain the level of security clearance required for the position as identified in section verified by the

Contracting Officer’s Representative (COR). All proposed candidates shall be able to read, write, speak, and understand English, shall possess good written and verbal communications skills, and shall have sufficient knowledge of proper English grammar, spelling, capitalization, and punctuation rules to identify errors and make corrections.

b. FOH retains the right to determine the adequacy of a Contractor’s proposed staff to meet evolving FOH customer needs throughout the life of this contract. FOH has the authority to disapprove any proposed staff based on qualifications, experience, peer references, and/or performance.

c. Upon COR notification of the Government’s need for a new position within the scope of the contract, the Contractor shall provide to the COR within thirty (30) business days of notification, the name of a proposed candidate(s) for a position along with other required documentation for the specific labor category to be filled by the staff. The COR will review the candidate’s documentation and provide feedback to the Contractor.

C.3.2 Vacant Positions – Contractor’s Staff

The Contractor shall maintain a stable workforce. The Contractor shall hire and obtain FOH

Security Clearance package acceptance as complete for each new Contractor staff from date of contract award and / or receipt date of a staff resignation letter/email or termination in accordance with section F.3 Deliverables and Delivery Schedule. It is unacceptable to FOH to have a greater than 30% turnover rate of Contractor staff annually. If Contractor staff is not hired and obtained FOH Security Clearance package acceptance in accordance with section F.3

Deliverables And Delivery Schedule, a disincentive equal to 20% of the daily billable rate for an eight (8) hour work day, for each vacant position, will be assessed to the Contractor as described in the Quality Assurance Surveillance Plan (QASP).

The thirty (30)-business day clock will stop once the Contractor submits to FOH an FOH

Security Clearance package for a candidate. The clock will resume if the FOH Security

Clearance package is rejected/returned to the Contractor and will stop again once a new/revised package is submitted to FOH. The clock will be assessed final upon FOH Security Clearance package acceptance as complete.

The Contractor shall provide written notification to COR of all staff resignations/terminations within the same business day of the Contractor having received notification or termination. The

Contractor shall start recruiting immediately and submit proposed candidates in accordance with section F.3 Deliverables and Delivery Schedule to minimize having the position vacant.

C.3.3 Vacant Positions – Non-Key Personnel

The Contractor shall hire and obtain FOH Security Clearance package acceptance as complete for each new staff from contract award and receipt date of a staff resignation letter/email or termination, in accordance with section F.3 Deliverables and Delivery Schedule. If the

Contractor fails to obtain FOH Security Clearance package acceptance as complete in accordance with section F.3 Deliverables and Delivery Schedule, then a daily disincentive equal to 10% of the daily billable rate for an 8-hour workday, for each vacancy will be assessed to the Contractor, as described in the QASP, until the FOH Security Clearance package is accepted as complete.

The Contractor shall report staff vacancy fulfillment within the Monthly Progress, Status and

Management Reports and weekly reports. NOTE: The resignation/termination of a staff member does not relieve the Contractor of the obligation to properly staff. The clock will stop once the Contractor submits to FOH an FOH Security Clearance package for a candidate. The clock will resume if the FOH Security Clearance package is rejected/returned to the Contractor and will stop again once a new/revised package is submitted to FOH. The clock will be assessed final upon FOH Security Clearance package acceptance as complete.

C.3.4 Reassignment of Contractor Staff

The Contractor shall not reassign/move any Contractor staff within the contract without prior notice to and receipt of approval from the COR in accordance with section F.3 Deliverables and Delivery Schedule. If the Contractor believes a reassignment/move of a staff is necessary, the Contractor shall provide to the COR a written justification for the reassignment. The request shall identify the staff to be reassigned, why a reassignment is deemed necessary and the new proposed location for the reassigned staff. The request should also describe plan to backfill position and how the current requirements will be fulfilled until position is backfilled.

C.3.5 Removal of Staff

FOH has a zero-tolerance policy for issues that FOH determines could cause serious harm or physical injury to the staff or another person or taint the reputation of FOH possibly leading to

FOH losing business. The COR will notify the Contractor in writing that a Contractor staff member needs to be immediately removed from the contract. The Contractor shall have the

Contractor staff member removed immediately after notification.

C.3.6 Changes to Levels of Effort

FOH may expand and contract services based on need which may affect the Work Plan.

Examples of changes include but are not limited to hours of operation and/or labor categories.

Any changes to the contract are not authorized to the extent that it results in an increase beyond the ceiling price specified in the contract until a contract modification is issued providing additional obligation.

C.3.7 Adding/Deleting of Labor Categories

During the performance of this contract, the Government may require additional labor categories not identified in this Performance Work Statement (PWS) or listed in the Work Plan.

The COR will provide to the Contractor the name of the required labor category, number of estimated hours. The position shall be identified as a vacant position from the date of written notification by the COR to provide staff. The Contractor shall upon COR notification, hire staff for the new labor category and obtain FOH Security Clearance Package acceptance as complete in accordance with section F.3 Deliverables and Delivery Schedule. The pricing methodology will be applied from Section B to determine the fully burdened hourly rate, and a contract action will be executed. If the Contractor fails to hire and obtain FOH Security

Clearance package acceptance as complete in accordance with section F.3 Deliverables and

Delivery Schedule, then a daily disincentive will be assessed to the Contractor, as described in the QASP, until staff is hired and FOH Security Clearance Package is accepted as complete.

Any formal contract action required will occur with the next contract modification.

The COR will notify the Contractor as early as possible when a labor category will no longer be required. The Contractor shall comply with the request to remove the staff, in accordance with section F.3 Deliverables and Delivery Schedule. Any formal contract action required will occur with the next contract modification.

C.3.8 Training

The Contractor shall have processes and training programs in place to ensure that employees keep their skills current and continue to meet contract requirements.

The Government may determine that it has a requirement for additional training / certification of staff under this contract. The Government may pay for additional specialized training / certification on a one-time basis. The Contractor shall pay for all staff recertifications. If the staff, trained at Government expense, leaves the Contractor’s employment prior to the end of the current contract period, the Contractor shall provide an equally trained / certified staff at no additional expense to the Government.

FOH may require Contractor staff to participate in ongoing education and training. FOH will provide training whenever there are:

• Changes to Contractor staff responsibilities

• New FOH, PSC, or HHS policies

• New capabilities, and/or services

While FOH will provide training that is required for personnel to assume newly assigned responsibilities, the Government is not responsible for training personnel to meet the competency levels outlined in the contract, based on the minimum requirements.

Recurring FOH training requirements are outlined in FOH policy and will be provided by the

COR annually. Training shall occur during normal business hours unless authorized by the

COR.

C.3.9 Contractor Employee Conduct

The Contractor’s employees shall observe and comply with all applicable departmental and agency regulations, policies, and procedures (e.g., fire, safety, environmental protection, security, etc.). The Contractor shall ensure that all Contractor employees represent a professional appearance at all times, and that their conduct does not reflect badly or discredit the United States Government. The Contractor shall identify themselves as a Contractor in meetings, telephone conversations, all written communications and work situations, as they are not authorized to approve or make decisions on behalf or as a Government official. The

Contractor shall take no actions that bind the government to a final decision or results in the exercise of governmental discretion. The Government may, at its sole discretion, direct the

Contractor to remove any Contractor employee from Government facilities for misconduct or security reasons. Such removal does not relieve the Contractor of the responsibility to provide sufficient qualified personnel for adequate and timely service.

C.4.0 TRANSITION SERVICES

C.4.1 Contract Transition In

In accordance with section F.3 Deliverables and Delivery Schedule, the Contractor shall meet with the COR and FOH staff (as designated), to discuss the objectives of the contract and related projects deliver the following:

a. A written agenda including project roles and responsibilities, scope of work, schedule, change management and transition planning shall be prepared by the Contractor

b. The Contractor shall provide a proposed schedule, dependent upon onboarding, for meeting with the incumbent. The Contractor shall also provide a secure virtual platform for the kick-off meeting (e.g., Zoom, Webex).

c. Upon contract award, the Government will notify the Contractor when the transition period will begin. The Contractor shall execute the transition of operational responsibilities from the incumbent (outgoing) Contractor. During this phase, the Contractor shall develop and implement their proposed solution, as well as transition the services from the incumbent

Contractor. The Contractor shall meet with the incumbent Contractor, beginning on the earliest mutually agreeable date. The Contractor shall provide the virtual platform for the meetings. At the end of the transition period, the Contractor shall have full operational accountability of all PWS requirements. The Contractor shall exercise its best efforts to effectively, orderly, and efficiently transition with any incumbent or successor Contractor to ensure that the required services are performed without interruption.

d. The Contractor shall develop and deliver a draft detailed transition phase-in plan to be reviewed and approved by the Government prior to implementation. The phase-in shall include, at minimum, the following information:

i. A detailed work breakdown structure (WBS) with major milestones and tasks for all work areas in this performance work statement including applications support, telecommunications, asset management, and systems operations.

ii. A list of all major milestones and associated deliverables.

iii. Processes and standards.

iv. A list of all required items from the Government.

v. Testing procedures for verification of full operational capability

vi. The intentions, if any, concerning incumbent Contractor personnel.

vii. Resource matrix to include personnel, time commitments and functionality.

viii. Governance Methodology, to include regular and escalation reporting to the

Government. Escalations should be raised from the Contractor Program Manager to the

COR and IT Director.

ix. Transition management methodology, including methods for interacting with the

Government and primary points of contact.

x. Methodology for monitoring progress (milestone gates, task order initiation, implementation, transition, and transformation initiation).

xi. Risk Management Methodology to include methods for monitoring and mitigating risks to advise the Government.

xii. Change Management Methodology.

xiii. Methodology for ensuring a seamless transition of responsibilities and performance.

xiv. Methodology for communicating to and coordinating with the Government regarding overall contract activities.

C.4.2 Contract Transition Out

At the completion of the contract, the Contractor shall provide transitional services (transition in, transition out, training, and support to FOH and the successor Contractor (refer to Federal

Acquisition Regulation (FAR) Clause 52.237-3 Continuity of Services). In order to ensure continuity of services, the Government requires the Incumbent Contractor to provide transition services beginning on the earliest mutually agreeable date. The Contractor shall cooperate fully to effectively, orderly, and efficiently transition with any incumbent or successor Contractor to ensure that the required services are performed without interruption. In accordance with section

F.3 Deliverables and Delivery Schedule the Contractor shall:

a. Develop, coordinate, provide and implement a mutually agreed upon transition phase-out plan draft to the COR must at minimum:

i. Clearly demonstrate the Contractor’s plan to scale down staff consistent with the

Government priorities, the strategy for closing out and completing deliverables, and ensuring the return of all Government Furnished Equipment (GFE) and/or property.

ii. Provide the staffing to ensure uninterrupted service, be effectively and efficiently administered, and be completed through the current…