HPOP Solicitation Amendment 0001.docx

1. The purpose of this amendment is to extend the response due date and provide instructions to all offerors to submit an email notification to the Contracting Officer of their intent to submit an offer at least 24 hours prior to the solicitation closing.

2. This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in FAR subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. The solicitation number is 75A50524R00001 and the solicitation is issued as a request for proposal (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular(FAC) 2024-07. Inspection and acceptance will be at destination.

3. The U.S. Department of Health and Human Services (HHS), Administration for Strategic Preparedness and Response (ASPR) HHS Coordination Operations and Response Element (HCORE) has a requirement to maintain a response/product agnostic web-based order and distribution Software as a Service (SaaS) application deployed within Oracle Cloud Infrastructure as a service/Platform as a Service (IaaS/PaaS) for managing, monitoring, and reporting key metrics associated with the ordering and distribution of MCMs and public health resources to address public health threats. The Contractor shall be responsible to ensure that all computerized systems that create, modify, maintain, archive, retrieve, or transmit data that directly or indirectly may affect the quality of the cGMP products are 21CFR Part 11 compliant and are validated as per Software Development Life Cycle (SDLC) concept.

4. This acquisition is being set aside for small businesses.

5. NAICS Code: 541519 – Other Computer Related Services

6. Product Service Code: DH01 IT and Telecom—Platform Support Services: Database, Mainframe, Middleware (Labor)

7. Date(s) and place(s) of delivery and acceptance and FOB Destination requirements are described in detail in the Solicitation, Section C – Statement of Work.

8. The provision at FAR 52.212-1, Instructions to Offerors-Commercial Products and Commercial Services, applies to this acquisition.

9. The provision at 52.212-2, Evaluation-Commercial Products and Commercial Services, is applicable to the acquisition and the specific evaluation criteria are described in detail in the Solicitation, Section M – Proposal Evaluation.

10. Each Offeror shall include a completed copy of FAR 52.212-3, Offeror Representations and Certifications-Commercial Products and Commercial Services, with its offer.

11. The clause at FAR 52.212-4, Contract Terms and Conditions-Commercial Products and Commercial Services, applies to this acquisition.

12. The clause at FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Services, applies to this acquisition.

13. Contract requirements, terms and conditions are specified in the Solicitation that follows.

14. Proposals are due no later than September 12, 2024, at 1:30 pm Eastern Standard Time (EST).

15. For information regarding the solicitation, offerors must contact Ketwana Wright at Ketwana.Wright@hhs.gov or Sidnie Miranda at Sidnie.Miranda@hhs.gov.

SECTION B – SUPPLIES OR SERVICES AND PRICES

B.1 CONTRACT TYPE/TASK ORDER TYPES

This acquisition will result in a single firm fixed price (FFP) and time and materials (T&M) hybrid contract.

B.2 SERVICES AND SUPPLIES

The required supplies shall be provided in accordance with the requirements specified in Section 5 of the Performance Work Statement (SOW). The quality and quantities of supplies shall be delivered in accordance with the terms and conditions specified herein.

B.3 CONTRACT LINE ITEM NUMBER (CLIN) DESCRIPTION

Months Fixed Price

T&M

Staffing and development services to support ASPR response to Public Health Events

Lot T&M

Receive raw data and provide meaningful outputs for reporting and decision making

T&M

Development and Analytic Platform for Reporting and Decision Making

T&M

T&M

Fixed Price

T&M

Staffing and development services to support ASPR response to Public Health Events

T&M

Receive raw data and provide meaningful outputs for reporting and decision making

T&M

Development and Analytic Platform for Reporting and Decision Making

T&M

T&M

Fixed Price

T&M

Staffing and development services to support ASPR response to Public Health Events

T&M

Receive raw data and provide meaningful outputs for reporting and decision making

T&M

Development and Analytic Platform for Reporting and Decision Making

T&M

T&M

Fixed Price

T&M

Staffing and development services to support ASPR response to Public Health Events

T&M

Receive raw data and provide meaningful outputs for reporting and decision making

T&M

Development and Analytic Platform for Reporting and Decision Making

T&M

T&M

(Option) Transition out of contracted activities and services to a successor contract

Fixed Price

(Option) Transition to a new hosting environment and new subscription.

Fixed Price

SECTION C – Performance Work Statement (PWS)

C.1 BACKGROUND

COVID-19 presented an unprecedented challenge in modern U.S. history. In May 2020, ASPR set up a multi-agency effort conducted in collaboration with the private sector to protect the American public from future COVID-19 devastation by providing funding, coordination, and regulatory support to enable the rapid development and distribution of novel diagnostics, therapeutics, and vaccines.

ASPR/HCORE was tasked with managing the production, delivery, and administration of COVID-19 MCMs to the American public. This required a scalable ordering portal that allowed partners (jurisdictions, pharmacy chains, federal entities) to order MCMs for distribution and tens of thousands of provider sites to report inventory and usage of products. Additionally, it required a system that was flexible to meet the needs of the COVID-19 response (ex: allowing provider sites to self-select as Test-to-Treat locations). In March 2020, in response to the COVID-19 pandemic, HHS and the public sector responded to the COVID-19 pandemic by creating and operating the Health Partner Ordering Portal. The ordering portal was used for COVID-19 vaccine, therapeutics, and diagnostics ordering. As a result of this the partners and providers could easily order MCMs in response to their needs. Hundreds of millions of vaccines, therapeutics, and diagnostics were ordered, shipped, and delivered. At the height of the COVID-19 response approximately 80,000 providers were ordering and reporting COVID-19 MCMs in HPOP. Provider is the site where the product is administered/dispensed to a patient and where inventory may be stored for future patient use.

While the COVID-19 response was still ongoing, the escalating MonkeyPox (mpox) situation urgently required a system that could be rapidly scaled to meet the ordering and distribution needs of the ASPR response. As additional mpox MCMs were procured and made available to jurisdictions across the country, the initial process of jurisdictions emailing orders, manual verification of orders against allocations, and verified orders emailed to the Strategic National Stockpiles (SNS) for processing was insufficient for the scale of the USG to be responsive to the needs of jurisdictional partners. Partner is an entity with an administrative role in the platform whereby they can on-board provider sites, distribute product to their provider sites, approve product requests from provider sites, and other administrative actions. Partners can include jurisdictions, pharmacies, federal entities, etc. In response to this critical need, HPOP was configured to support the mpox response. ASPR/HCORE was able to leverage existing capabilities within the HPOP system and turn on electronic ordering for mpox MCMs within 3 weeks.

The current HPOP SaaS application is deployed within Oracle Cloud Infrastructure (OCI) Government Cloud IaaS/PaaS. The OCI Gov Cloud has achieved a FedRAMP High authorization. The implementation includes virtual cloud networks (VCN), subnets, virtual host machines, Load Balancing as a Service (LBaas), OCI Container Engine for Kubernetes (OKE), supporting applications, storage, databases, and security toolsets in the OCI Gov Cloud OC2 Realm. The current HPOP system includes one (1) cloud service instance, which consists of one (1) Production Environment built upon one (1) Oracle Database running on the Oracle Cloud Infrastructure platform. HPOP applications and any interface(s) are built using Oracle APEX technology. The success of this system has made it apparent that ASPR/HCORE requires an all-encompassing system for all future national emergencies or threats.

C.2 OJECTIVE

The objective of this requirement is to maintain and enhance a user-centric, response/product agnostic web-based order and distribution SaaS application (deployed within Oracle Cloud Infrastructure Government Cloud (IaaS/PaaS) as the portal for federal agencies, jurisdictions, territories, pharmacy chains, and providers to order US Government (USG) procured MCMs and public health resources in response to public emergencies. Specifically, the System will require to maintain and enhance:

· Capacity to accommodate a minimum of 80,000 users

· Capacity to process high volume of MCM and public health resources and provide real-time inventory status and data

· While cost data is not required for the users or to order the MCM and public health resources, the system should track outgoing and in stock inventories of MCM and public health resources costs

· Maintain a single picture of orders, distribution, delivery, inventory, wastage, and administration of MCMs

· Allow partners (ex: jurisdictions, pharmacies, federal agencies) to track their MCM allocations, orders, shipments, and administrations/usage.

· Allow partners and provider sites to seamlessly order product and report inventory, wastage, and/or usage.

· Validate, and disseminate MCM allocations in line with Federal and State policies.

· Have functionality to establish and monitor new MCMs and support customized programs tied to these MCM and public health resources

· Have functionality to establish and maintain different channels of partner types (ex: jurisdictions, pharmacies, federal agencies)

· Have functionality to manage ordering and reporting of MCMs and public health resources for multiple responses simultaneously

· Provide functionality to allow administrators to establish consistent metrics to benchmark the progress of partner and provider site ordering and reporting.

· Allow access to the system in accordance with HHS security standards and user permissions.

· Allow partner and provider access to data and analytics for decision making in accordance with HHS security and data use agreement standards.

Note: For the purposes of this PWS, the term MCM is inclusive of all medical countermeasures and any other product that ASPR/HCORE may need to allow ordering, distribution, delivery, inventory, wastage, and administration reporting.

C.3 SCOPE OF WORK

ASPR/HCORE aims to provide broad operational support to accelerate the ordering and distribution of MCMs and public health resources for public health responses. It is the stated objective of ASPR/HCORE to support concurrent efforts in MCM and public health resources ordering and distribution as a key mission requirement into the future. ASPR requires a response-agnostic, product-agnostic ordering portal that is flexible and scalable when faced with the next pandemic or large-scale national emergency.

To maintain and continue building out response-agnostic, product-agnostic ordering portal capabilities built on Oracle software, ASPR/HCORE is seeking a contractor to support the ordering platform engineering activities of the ASPR/HCORE MCM missions, as well as other national security or emergency events requiring rapid ordering and distribution of MCMs. In addition to the response-agnostic, product-agnostic ordering, and distribution portal, ASPR is seeking a highly skilled contractor team to provide strategic operational, program management, and technical support for the system to address national public health and security threats.

C.4 TECHNICAL REQURIEMENTS

The Government is seeking to maintain and enhance a user-centric, response/product agnostic web-based order and distribution SaaS application (deployed within Oracle Cloud Infrastructure Government Cloud (IaaS/PaaS) as the portal for federal agencies, jurisdictions, territories, pharmacy chains, and providers to order US Government (USG) procured MCMs and public health resources in response to public emergencies.

TECHNICAL REQUIREMENTS/TASKS (Fixed Price, CORE Effort, CLIN 0001, 1001, 2001, 3001)

C.4.1. Professional Services

C.4.1.1 Project Management The contractor shall provide project management services outlined in this PWS. The project management responsibilities include, but are not limited to:

· Participate in steering committee meetings

· Organize and conduct project meetings related to project’s tasks

· Conduct one kick-off meeting within 2 weeks post award

· Conduct at least one project status call every 2 weeks with the ASPR/HCORE program team

· Distribute meeting minutes and action items from the project status meetings

· Manage and coordinate the project resources, tasks and activities related to the creation, deployment and testing of the platform during the project

· Manage the project resources and activities through the term of this contract

· Create and maintain the Project Management Plan for the project activities (including the project governance plan)

· Provide system design/architecture diagrams, data structures, data dictionaries, workflow diagrams, etc. and will be the property of the USG

· Provide technical support for analytic and reporting needs including pulling metrics and generating queries

· Prepare a status report to include risks to schedule, cost, and performance; technical and management issues, lessons learned and forecast the next steps for the next monthly performance period

· A bi-weekly contract progress meeting will be conducted. At this meeting, discussion with the COR and/or CO of contract progress, issues of mutual concern regarding contract deliverables and performance, a formal agenda with action items, risk register update, problem reporting & resolution status, and discussion of quality assurance issues are typical of weekly progress meeting scope

· Prepare a final report to summarize all activities, salient findings, methodologies, conclusions, if requested by the Government

· Contracts services are requirements specifically for overall contract negotiation, administration and contract and subcontract administration.

· Financial administration services are required for planning and tracking contract costs and related data and financial reporting.

· Human Resource services are required for coordinating contractor staffing requirements, solicitation of qualified resources, market research, processing new hires and terminations.

C.4.1.2 Requirements Analysis The Contractor shall provide technical support for ASPR/HCORE decisions on the system development and administration, and document key decisions and technical changes under USG direction (e.g., limiting shipment sites, allocation threshold management, accounting for USG vs commercial products). Requirements analysis support should include:

· Identifying key stakeholders and end-users for gathering the requirements

· Capturing the requirements through methods such as (but not limited to) stakeholder interviews, focus groups, use cases, and suggestions through the HPOP support inbox or other internal HPOP ticketing systems

· Document requirements, categorize requirements, prioritize requirements, conduct impact analysis to understand consequences of the requirements, assess feasibility of the requirements, and secure sign off when final decisions are made on requirements

C.4.1.3 Development The Contractor shall provide personnel to support continued development of the HPOP System. The contractor staff shall use Agile methodology with sprints in development.

The contractor shall provide implementation support by working closely with the ASPR/HCORE team to ensure flexible and scalable ordering capabilities that are guided by extensive contractor staff experience in:

· Provide product deployment, configuration, usability, and outcome delivery from a technical perspective

· Support and provide customized configurations or applications as required by the needs of a response

· Provide Management and execution of regular upgrades and enhancement to meet mission needs

· Provide Enhancements to functionality to include new features implemented in response to feedback from across government and users or new features because of critical needs during an emergency response

· Provide Data ingestion & pipeline configuration

· Provide Application configuration/implementation

· Establish maintenance of data exchange pipelines with internal HHS systems as well as external systems

· Scale infrastructure to accommodate multiple emergency responses requiring multiple MCMs or other products

C.4.1.4 Testing and Maintenance The Contractor shall have staff to provide end-to-end support and maintenance, which includes:

· Maximize system availability to meet operational requirements, including proper planning of scheduled system maintenance

· Monitor and manage of the infrastructure stability and security

· Develop required backups for accessibility of info (in accessible format)

· Maintain a redundant or backup system to failover to if the production system is not available or having technical issues. The failover/backup system should have a mirror copy of the data and functionality in the production system to ensure end user availability to this critical response system

· Scale of infrastructure to provide ability for stakeholders (e.g., states and jurisdictions) to create and test customized modules (e.g., exercising modules)

· Provide technical support and develop data quality checks within the system for stakeholders to:

· Ensure data quality as relates to data integration with other system.

· Integrate data within disparate systems as appropriate to meet response needs.

· Coordinate with USG and other stakeholders (as defined by the USG) to do thorough testing before releasing into production to include feature and functionality testing, bug identification, performance testing, user experience/user acceptance testing, and security testing

C.4.1.4.1 User Experience/User Interface (UX/UI) Design The Contractor shall provide staff to conduct UX/UI sessions with stakeholders such as but not limited to federal, jurisdictional, provider, and other users of the system. The Contractor shall Incorporate UX/UI findings into design of product interface to include but not limited to ordering portal and analytic dashboards as appropriate.

C.4.1.5 Verification and Validation The Contractor shall provide staff responsible for verification and validation. Verification should include testing as it relates back to the approved requirements and should ensure the requirements are met. Validation should be conducted in a real or simulated environment and ensure that stakeholder intent has been met.

The Contractor shall provide staff responsible for verification and validation. Verification is the static process of analyzing documents, visual designs, computer programs, and codes. Validation is the dynamic process of checking the correct structure is being built for the user. Verification is checking planning while validation is checking execution.

Verification should include testing as it relates back to the approved requirements and should ensure the requirements are met. It is the Contractors responsibility to conduct in a real or simulated environment and ensure that stakeholder intent has been met. Verification is the static process of analyzing documents, visual designs, computer programs, and codes. In the context of software development, this would mean ensuring that the code is functional and meets the specifications upon which it's based.

Validation is the dynamic process of checking the correct structure is being built for the user. It is done by the testers. Validation refers to whether the program in question meets the demands of its end-users. Validation is concerned with quantifying the accuracy of the model by comparing numerical solutions to experimental data.

The Contractor shall engage an external expert for Independent Verification and Validation (IV&V) that can provide an unbiased assessment of the product, uncover issues that internal teams might overlook, and bring additional expertise to ensure higher level of confidence in the product’s quality.

C.4.1.6 Service Desk Support, Technical Assistance, and Training The Contractor shall provide staff to support the following:

· Respond to support requests in collaboration with the ASPR/HCORE

· Work with stakeholders including the ASPR/HCORE, CDC, states, pharmacy chains, providers, and others to assist with HPOP-related technical issues and support their ordering and reporting needs.

· Provide support for the HPOP platform to ASPR Help-desk users via the Oracle Support Cloud during the support period to cover a period of 13 hours x 5 days/week. There is a maximum of 1,600 new Service Requests annually included

· Develop automated connection between ASPR ServiceNow helpdesk to Oracle SR Ticketing system

· Provide training on using the Oracle Support Cloud to up to 5 ASPR Help-desk users. Trainings may be on-site or virtual at ASPR/HCORE discretion

· Provide an easy-to-use mechanism for reporting technical issues with the system

· Produce the system user guides, design and technical documents, and provide continued technical support for system capabilities

· Provide system training, to include but not limited to administrators/IT, partners, distributors, and providers site trainings. Trainings may be on-site or virtual at ASPR/HCORE discretion.

· The estimated duration is 4 hours and allow for participants to ask questions and engage in exercises related to the system.

· Provide materials in English and the facilitator will be able to communicate fluently in English to match the needs of the training participants.

C.4.1.7 Oracle PaaS and IaaS Universal Credits Cloud Services (Time and Material CLIN 0002, 1002, 2002, 3002) Contractor shall provide PaaS/IaaS services to include monitoring actual usage/access to the HPOP application on the OCI. Contractor will closely monitor usage/access debts monthly and ensure overages are avoided. Charges must remain under monthly estimates unless approval is received from USG. Notification of usage changes and significant increases in system access USG must be informed immediately.

C.4.1.8 Surge (Time and Material CLIN 0003, 1003, 2003, 3003)

The Contractor shall be able to provide staffing for surge support in response to request from ASPR/HCORE for additional support. The surge request may be specifically related to ASPR/HCORE’s request for change of requirements being developed or during each sprint cycle in response to a national emergency or other event requiring ordering and distribution of products from the HPOP system. Surge will be enacted in times of a natural disaster and/or public health emergency. During these events it may be necessary for the Contractor to escalate support of Core efforts identified in the PWS on an increased scale and or at an additional frequency. Contractor must have the ability to react quickly and to ramp up to meet the demand and ramp down rapidly once event concludes.

The Contractor shall provide support during normal Washington DC business hours (typically 8 am – 5:30 pm). The Contractor shall be able to provide 24/7 support if required by ASPR/HCORE within 24 hours after contract modification.

C.4.1.9 Analytics (Optional Time and Material CLIN 0004, 1004, 2004, 3004)

Provide the capability to ingest data from multiple sources regardless of data type, scale, schema, or format. Enable combining data sources via methods including but not limited to blends, merges unions, and joins. Ability to clean, transform, and manipulate data in platform. Provide capability to perform analytical processes on data including but not limited to summarization, characterization, geographical analysis, pivot, and graphing. Offer ability to export raw data sets, transformed data, analyses performed in platform, and static reports to multiple formats including but not limited to pdf, xlsx, csv, and jpeg. Provide ability to create interactive dashboards in platform to explore data and trends.

C.4.1.10 Oracle Analytics Platform (Optional Time and Material CLIN 0005, 1005, 2005, 3005) Analytics Oracle® cloud capabilities for the total analytics process including data ingestion, modeling, data preparation, enrichment, visualization, and collaboration. Contractor shall provide Analytics services to include monitoring actual usage/access on the OCI. Contractor will closely monitor usage/access debts monthly and ensure overages are avoided. Charges must remain under monthly estimates unless approval is received from USG. Notification of usage changes and significant increases in system access USG must be informed immediately.

C.4.2 System Requirements (Fixed Price, CORE Effort, CLIN 0001, 1001, 2001, 3001) The Contractor shall furnish SaaS, software operations and maintenance services, software upgrades, product technical support services, and operate a 24x7x365 MCM ordering platform. The contractor shall host the HPOP platform in a FedRAMP authorized high cloud environment.

C.4.2.1 System Capabilities The Contractor shall support data integration for interoperability between ASPR, CDC, HHS, and external systems as needed. Data connections with established systems (e.g., Tiberius, SNS systems, CDC systems, commercial distributors, and jurisdictional/ pharmacy partner systems, etc.) to share ordering, inventory, wastage, usage, and other data is already established and will be updated iteratively thereafter. The Contractor shall support future data connections as required for response operations. The Contractor shall be responsible for two host environments, one host production environment and one non-production environment. The Contractor shall provide at minimum eight (8) functional releases for the HPOP System platform during the period of performance. The HPOP system should be hosted on the Oracle Cloud environment. Specifically, the contractor will help enable ASPR/HCORE to:

· Manage infrastructure required for optimal data sharing and integration between HPOP and multiple systems

· Develop bidirectional data-sharing and interoperability of systems across HHS and external partners for a coordinated, scalable, and timely response to public health threats

· Provide SaaS product enhancements that optimize and improve functionality and include new fixes, patches, releases, updates, versions, and upgrades

· Allow ASPR/HCORE administrators to configure and maintain access roles and rights to data through individual and group administration, supporting access to the platform for ASPR/HCORE users as well as external partners

· Identify, design, and implement internal process improvements: automating manual processes, optimizing data delivery, re-designing infrastructure for greater scalability, and other process improvements identified by the USG

· Facilitate additional data ingestion and integration with the HPOP platform

· Work with other USG system owners and technical leads to improve functionality and interoperability between HPOP and other ASPR IT systems or other USG systems. Allow administrators to provision and configure new data connections that result in timely access to new data sources for platform users

· Ensure easy onboard and registration of users onto the system

· Develop Spanish user interface and provide translation services for user documents

· Provide analytics and data visualization capability for decision making

· Provide capability to transition from emergency operations/usage/utility to steady state operation.

· Develop data quality checks and deduplication capabilities within the system for stakeholders such as but not limited to USG, jurisdiction, partners and providers.

· Providing user interfaces that are responsive and page response time is kept under 3 seconds, especially when high end user usage is happening

· Provide a 24/7 search engine on the platform

· Provide data extracts from HPOP data at the direction of ASPR –up to 8 data extracts per month HPOP data shall be archived through the life of the contract, be owned by ASPR/HCORE, and be accessible to ASPR/HCORE.

C.5 DELIVERABLES

The following table identifies the required deliverable’s format and due date(s) for submission. Required time periods are measured in calendar days from date of award unless otherwise specified. All deliverables shall be electronic files sent via e-mail to the COR.

(ISA/DAU/MOU related) Scan reports due Quarterly

Not to exceed 10-page limit

13.

Req for Handling Sensitive/Proprietary Info:

· Mandatory

· Role Based

· Training records

· Rules of Behavior 30 days after contract award and then Annually or 30 days after new employee hire

· Compromise

· Information Security/Privacy incidents

Within 24 hours

ASAP - NLT one hour

· Sanitization of USG Files

· Notification – Empl Separation checklist

· Return all Information, IT resources acquired

10 days prior separation -Employee

2-High – 30 Days 3-Medium – 90 Days 4-Low – 365 Days

Monthly Continuous Monitoring reports (see 5.b)

Delivery Instructions

The contractor shall deliver all written work products to the Government designated COR via email by due date. The documents shall not exceed 20-page limit, excluding appendices. All page margins (top, bottom, left, and right) should be 1 inch, with 12-point font typed in Times New Roman.

C.6 Security Requirements

C.6.1 Security Requirements for GOCO and COCO Resources The Contractor’s facility shall meet the following security criteria:

Federal Policies. The Contractor (and/or any subcontractor) must comply with applicable federal laws and HHS policies that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P),; Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, latest revision, Security and Privacy Controls for Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

Assessment and Authorization (A&A) A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) must work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s). The Contractor must conduct the A&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Information Systems: A Security Life Cycle Approach (latest revision), NIST SP 800-53B, Control Baselines for Information Systems and Organizations, and the NIST SP 800-53A (latest revision).

Note to the Requiring Activity Representative: For an existing ATO, ASPR must make a determination if the system needs to be re-authorized to ensure all necessary safeguards are in place to protect the system and information for the performance of the contract and state as such.

ASPR acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

C.6.2 A&A Package Deliverables - The Contractor (and/or any subcontractor) must provide an A&A package [see deliverables table and timeline] to the CO and/or COR. The following A&A deliverables are required to complete the A&A package [see deliverables table and timeline]:

· System Security Plan (SSP) - due 90 days after contract award. The SSP must comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and ASPR policies and other guidance. The SSP must be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP must provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor must review and update the SSP at least annually thereafter and if requested, provide a copy of the updated SSP.

· Security Assessment Plan/Report (SAP/SAR) - due [180 days after contract award.] The security assessment must be conducted by third party assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and ASPR policies. The assessor will document the assessment results in the SAR.

· Thereafter, the Contractor, in coordination with ASPR must assist in the assessment of the security controls and update the SAR at least annually. A copy of the updated SAR should be provided if requested.

· Independent Assessment - due [180 days after contract award]. The Contractor (and/or subcontractor) must have an independent third-party validate the security and privacy controls in place for the system(s) commensurate with the risk levels per NIST SP 800-53B. The independent third party must review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The Contractor must address all "high" deficiencies before submitting the package to the Government for acceptance and document all remaining deficiencies in a system Plan of Actions and Milestones (POA&M).

· POA&M – Initial submission is due 90 days after contract award]. All critical-risk weaknesses must be mitigated within [90 days], high-risk weaknesses must be mitigated within [30 days], medium weaknesses must be mitigated within [60 days], and low weaknesses must be mitigated within [90 days], from the date the weaknesses are formally identified and documented. ASPR will determine the risk rating of vulnerabilities. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, flaws and security defect in a system (that require to create a patch for remediation), and other security reviews and sources, as documented in the SAR, must be documented and tracked by the Contractor for mitigation in the POA&M document consistent with the HHS Standard for Plan of Action and Milestones and ASPR policies. Depending on the severity of the risks, ASPR may require designated POA&M weaknesses to be remediated before an ATO is issued. Thereafter, continue to remediate weaknesses throughout the contract. The POA&M document must be updated at least quarterly.

· Contingency Plan and Contingency Plan Test - due [90 days after contract award]. The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS and ASPR policies. Upon acceptance by the System Owner, the Contractor, in coordination with the System Owner, must test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. Thereafter, the Contractor must update and test the Contingency Plan at least annually.

· E-Authentication Questionnaire - The contractor (and/or any subcontractor) must collaborate with government personnel to ensure that the E-Authentication requirements are implemented in accordance with OMB 04-04 and NIST SP 800-63 B.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS Guidance for Selection of e-Authentication Assurance Levels and any other applicable HHS policies.

· Information Security Continuous Monitoring. Upon the government issuance of an Authority to Operate (ATO), the Contractor (and/or subcontractor)-owned/operated systems that input, store, process, output, and/or transmit government information, must meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, HHS ISCM Strategy, and HHS IS2P.

· Annual Assessment/Penetration (Pen) Test - Assess the system security and privacy controls (or ensure an assessment of the controls is conducted) at least annually to determine the implemented security and privacy controls are operating as intended and producing the desired results (this involves penetration testing conducted by the agency or independent third-party. In addition, review all relevant A&A documentation (SSP, POA&M, Contingency Plan, etc.) and provide updates quarterly as specified by ASPR SPSO.

· Asset Management – Not applicable.

· Configuration Management – Related to ISA/DUA/MOU. Use available SCAP-compliant automated tools as per NIST IR 7511 and HHS Minimum Security Configurations Standards Guidance to scan all IT assets, including but not limited to: computers, servers, routers, databases, operating systems, application, etc., that store and process government information. Provide scan reports to HHS/ASPR quarterly. The contractor must maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

· Vulnerability Management - Contractors must actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS Policy for Vulnerability Management. Automated tools must be compliant with NIST-specified SCAP standards for vulnerability identification and management. The contractor must maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP-compliant automated tools and report to the agency at least monthly.

· Patching and Vulnerability Remediation - Install Contractor released security patches and remediate critical and high vulnerabilities in systems processing government information within an hour of the incident and provide summary reports quarterly.

C.6.3 Maintaining Performance with increased System usage by users

Contractor shall ensure the HPOP system can successfully handle increases in usage of the system without detracting from the user experience. Contractor shall take proactive steps to address system increase issues before they arise. Contractor shall have a plan in place that is shared with ASPR/HCORE for how they will handle increases in HPOP usage and other emergencies.

C.6.4 Key Personnel

The Contractor shall provide one full-time Program Manager (PM), one full-time Senior Subject-Matter Expert (SME), and one full-time Technical Lead. All these positions are designated as “key” personnel. Key personnel should be working in the US and have legal and valid residency documents. The PM shall serve in the senior position of the qualified personnel and shall be responsible for all Contractor work performed under this PWS. The PM shall provide oversight of the contractor team.

Program Manager. The Program Manager shall also monitor and assist in all day-to-day activities, ensure efficient and effective communication and collaboration between the CO, COR, USG technical team and the contractor team; and ensure appropriate channels of communication are established during all phases of the strategic communications continuum. The Program Manager is designated as “key” personnel. Their tasks range from defining success to overseeing collaboration and many things in between. A project manager implements programs into current systems and methodologies, like Agile or Scrum. The PM shall be a single point of contact for the Contracting Officer and the COR. The name of the PM, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the PM, shall be provided to the ASPR as part of the Contractor’s proposal. During any absence of the PM, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The PM and all designated alternates shall be able to read, write, speak, and understand English. Additionally, the Contractor shall not replace the PM without prior approval from the Contracting Officer.

The PM would be responsible for preparing invoices and management of contract personnel timekeeping requirements as deemed necessary by the contract company; and the PM shall develop or produce reports on a regular basis, to track the progress of each mission or event until completion. The PM should have experience in project management, system development, system engineering, and help desk support for technical implementation, data management, and engineering. PM required knowledge, skills, and abilities:

Technical Lead. The Contractor shall provide a technical lead with expertise in engineering and development capabilities essential to public health and medical countermeasures; rapid stakeholder coordination, data collection, technical review, and quantitative analyses; and prepare, present, and clearly explain and interpretate results, and analytic information to audiences with a wide range of technical backgrounds, including non-scientific. The technical lead will provide technical review of documents, both internal and external to HHS, provide coordination of on-site events to support HCORE’s operations. Given the nature of the preparedness and response environment, support must have the flexibility to be able to work in a response environment where the analytical requests could possibly increase in frequency and/or duration to support senior leadership decision making for the federal government in times of public health emergency.

The technical lead should have this: Engage in design, development, testing, and support for the Oracle Health Partner Order Portal (HPOP). Technologies utilized are Oracle APEX, HTML, CSS, JavaScript, PL/SQL, web services, etc. Software development life cycle is a month-long agile Scrum sprint, with three weeks of development and one week of User Acceptance Testing (UAT).

Senior SME. The contractor shall provide a Senior SME who has accumulated great knowledge in ORACLE® Cloud services and products. The SME is designated as “key” personnel. The SME provides the knowledge and expertise and is an authority in Oracle’s ® technology, process, function, services, etc. An information technology (IT) SME plays a prominent role in implementation projects and ongoing support. Using information technology, SME will be responsible for developing capabilities for managing information, intensive resources, enjoy reduced transaction costs, develop capacity for information gathering and dissemination of scale and gain access to rapid flow of information.

Replacing Key Personnel - Any key personnel the contractor offers as a replacement must have the ability and qualifications equal or better than the key personnel being replaced. Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer (CO) no less than fifteen (15) business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute. All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without approval from the CO.

C.6.5 Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

Contractor personnel performing under this contract require background checks for PIV cards and badge but will have no access to classified material and do not require SECRET or above clearance. Tier 2, Moderate Public Trust clearance is appropriate for contractor personnel with access to HHS information systems. However, SECRET or above clearance may be requested for key personnel, as needed.

C.6.6 Onsite presence

The contractor will provide on-site support in Washington DC if ASPR/HCORE requests to meet the demands of a critical HPOP release, a public health emergency or other disaster, or other event requiring on-site coordination or collaboration with the contract team.

C.6.7 Transition Out Services (Fixed Price (Optional) CLIN 2006 or 3006)

The Contractor shall execute the transition out of contracted activities and services to the Federal Government or to a successor Contractor by the end of the contract period of performance.

C.6.8 Transition Out Services (Fixed Price (Optional) CLIN 3007)

C.6.8.1 The Contractor shall execute the transition out of contracted activities and services to the Federal Government or to a successor Contractor by the end of the contract period of performance.

The Contractor shall provide a Transition Out Plan 60 days prior to the expiration of the contract. The contractor shall prepare and deliver transition out plan, including milestones, deliverables, timeline, roles, and responsibilities. The plan shall include migration and transfer of all HPOP data to ASPR/HCORE.