HT9425-25-RFI-LBA02.pdf

Request for Information (RFI)

1. RFI Number: HT9425-25-RFI-LBA02

2. RFI Title: Validation Lifecycle Management System (VLMS) with Maintenance, Technical Services and Support

3. Agency: United States Army Medical Research and Development Command

(USAMRDC)

4. Office: United States Army Medical Research and Development Command (USAMRDC), Enterprise Information Technology Project Management Office (eIT PMO)

5. Contracting Office: United States Army Medical Research Acquisition Activity (USAMRAA), Fort Detrick, Frederick, MD.

6. Location: Fort Detrick, Maryland 21702

7. Background:

The eIT PMO requires the procurement of a Validation Lifecycle Management System (VLMS) to streamline and improve its approach to validation lifecycle management and FDA compliance. Currently, this work is accomplished using a variety of applications and manual processes. Information is stored in different locations and formats making audits and overall regulatory compliance more challenging. The eIT PMO requires a single integrated solution to streamline the process and has found Software as a Service (SaaS) as a solution. Professional services are also required to properly configure the product for use.

8. Minimum Essential Characteristics:

a. Software License & Maintenance

• Software shall be able to cover the entire FDA computing system validation lifecycle.

• Software shall be a paperless solution for electronic management of validation execution and approval.

• Software shall be able to accept test scripts in MS Word and convert them to paperless testing.

• Software shall be a central system and provide web-based interface.

• Software shall support the following:

o Content lifecycle management o Change control and management o Risk-based validation o Electronic test case execution o GxP Asset management o Validation projects o Periodic review management o Dynamic trace matrix o Requirements management and full traceability to all testing and configurations o Retirement and Decommissioning process

• Software shall provide a secure central repository to make document retrieval quick and easy.

• Software shall have the ability to create and track deviations.

• Software shall have the ability to create and track problems found in the production systems.

• Software shall have role-based security to ensure only authorized users gain access.

• Software shall be available as a SaaS solution.

• Software shall be capable of automated reminders for alerting users of late, delayed, or impending tasks.

• Software solution shall be fully compliant with U.S. FDA 21 CFR Part 11 requirements.

• Software shall be capable of managing both regulated and non-regulated systems for the eIT PMO.

• Software shall provide a holistic and real-time view of project status and validation deliverables.

• Software shall have common Interfaces to provide integrations with other software packages such as Gitlab, Leapwork, and Jira.

b. Professional services

• The vendor shall offer professional services for the initial setup and configuration of the systems.

• The vendor shall offer professional services for the addition of new processes or changes in configurations.

c. Training

• Vendor shall provide Product basic end user training.

• Vendor shall provide Product Administration training.

d. Future enhancements & Maintenance

• Software shall be continuously maintained with Major and Minor releases as well as patch management.

e. Performance metrics:

• The solution shall have an Availability of 99.5% of the time in a given calendar month.

• The eIT PMO shall be notified of scheduled downtimes 4 business days prior to allow the eIT PMO to coordinate with its users.

• The eIT PMO shall be notified of any unscheduled downtime as soon as it occurs. A follow up review explaining the reasons will be provided within 5 business days.

• The eIT PMO shall be notified of any incidents within 3 business days.

Section 2: Directives

• FDA Compliance: FDA compliant software products used for clinical trial research must support the stringent security controls and compliance with U.S. Food & Drug

Administration (FDA) 21 CFR Part 11 electronic records and signature requirements.

• Defense Health Agency (DHA) compliance: The vendor of the SaaS product must be able to complete the requirements for the DHA National Institute of

Standards & Technology (NIST) compliance review. This includes:

o DHA NIST Certificate of Compliance Checklist.

o Annual recertification of the above-mentioned checklist.

• Information management o Data protection: The vendor will comply with all applicable laws, regulations, and governmental orders relating to personally identifiable information (PII) as defined by the applicable law, regulation, and governmental order with respect to any such PII that the vendor receives from the eIT PMO or to which it gains access.

o Backups & Retention: The vendor will provide a backup strategy to meet the back and retention requirements for paperless testing.

▪ Retention: The eIT PMO requests the data to be kept indefinitely.

▪ Backups: A standard operating procedure that defines a daily backup process that is sufficient to protect against data loss.

• Connectivity o The solution shall be web-accessible, password protected, complaint with prescribed DHA standards.

o Page Load times for the solution shall be less than 4 seconds.

• Termination: Upon termination of the contract, the vendor shall provide all data to the eIT PMO upon request. The data shall be in a format capable of being loaded into a similar system.

9. Information Requested in Capability Statement:

• Confirm availability of the requested products and maintenance, as specified in the MECs.

• Provide verification for DHA NIST Certificate of Compliance Checklist.

10. North American Industry Classification System (NAICS) Code: The NAICS code for this potential action is: 541511 – Custom Computer Programming Services http://www.fda.gov/regulatoryinformation/guidances/ucm125067.htm http://www.fda.gov/regulatoryinformation/guidances/ucm125067.htm

11. Response Due Date: Interested parties should submit their RFI response electronically by 12:00 pm Eastern on 18 October 2024 via e-mail to Ms. Lindsey Arthur at lindsey.b.arthur2.civ@health.mil.

12. Instructions to Responders:

12.1 The Government appreciates responses from all capable and qualified sources.

12.2 The Government welcomes input and will accept questions pertaining to this RFI;

however, the Government reserves the right to answer or not answer all questions pertaining to this RFI. Only one set of questions per vendor will be accepted. Telephone requests will not be entertained.

12.3 The subject header of the e-mail for submission of questions and/or the RFI response shall be: HT9425-25-RFI-LBA02.

12.4 Interested firms should submit a response (Capability Statement) that demonstrates the Offeror’s capabilities identified in this RFI. The Capability Statement shall not exceed five (5) typed pages; additional sheets for cover page, table of contents, tables, and charts will not be counted toward page limitation.

12.5 Fill in the below table when responding to this Sources Sought / RFI.

Question Answer

RFI Number

Company Name

Company Address

Point of Contact

Phone Number

E-mail Address

Tax Identification Number (TIN)

Cage Code

DUNS

Company Web Page

Company Location(s)

Company is / is not a Small Business

Company is / is not SAM Registered

Other Classifications (e.g. 8(a), HubZone, Woman-Owned, Veteran-Owned, Service- Disabled Veteran-Owned)

If 8(a), date that the company graduates from the program.

13. Disclaimer and Important Notes:

In accordance with Federal Acquisition Regulation (FAR) 15.201, "Exchange with industry before receipt of proposals," and FAR 52.215-3, "Request for information (RFI) mailto:lindsey.b.arthur2.civ@health.mil or Solicitation for Planning Purposes (SFP)," this RFI is for information and planning purposes only, at this time, and shall not be construed as a solicitation or obligation on the part of the USAMRDC. The purpose of this RFI notice is to gain market knowledge.

This RFI is not expected to be a Request for Proposal or Invitation for Bid, nor does it restrict the Government to an ultimate acquisition approach. The Government is not obliged to award a contract or otherwise pay for the information provided in the responses received.

The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its responses are complete and sufficiently detailed to allow the Government to determine the organization's solution. Responders are advised that the Government is under no obligation to acknowledge receipt of the information received, or to provide feedback to respondents regarding any information submitted.

After a review of the responses received, a pre-solicitation synopsis and solicitation may be published on SAM.gov. At this time, no solicitation exists; therefore, please do not request a copy of the solicitation. NO PHONE CALLS PLEASE. It is the responsibility of any potential vendor to monitor SAM.gov for the release of any solicitation or synopsis.

Responses to this notice will not be considered adequate responses to a solicitation.

14. Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in submitted responses. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

Original Point of Contact (POC): Lindsey Arthur, lindsey.b.arthur2.civ@health.mil mailto:lindsey.b.arthur2.civ@health.mil