Request for Information -KR2i TFF System.docx

Request for Information (RFI)

Pilot Bioproduction Facility: Walter Reed Army Institute of Research

This is an RFI as defined in FAR 15.201(e) to ascertain whether a commercial item exists that provides the capabilities described herein.

This RFI is issued solely for information and planning purposes and does not constitute a solicitation. All information received in response to this RFI will be treated as business confidential information. Nonetheless, submitters should properly mark their responses if the information is confidential. Responses to the RFI will not be returned. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expense associated with responding to this RFI.

RFI Response and due date: 31 October 2023 10:00AM ET

Instructions to Responders:

Responses from all capable and qualified sources are encouraged to respond to this request.

White papers should adhere to the following formatting and outline instructions:

1. All submissions shall be made electronically and be in one of the following formats: Microsoft Word or Adobe PDF.

2. Cover Page (1page)

· Title

· Organization

· Responders technical and administrative points of contact (names, addresses, phone, fax number and email addresses)

· Topic area(s) addressed.

3. Please note that the response shall provide sufficient technical data to determine how you fully meet the requirements as specified in the DRAFT Performance Work Statement.

Please note that responses are due no later than 31 October 2023 10:00AM ET. The preferred method of submission is via email. The point of contact for this action is Ms. Flodean Billings, Contract Specialist flodean.p.billings.civ@health.mil . Only electronic responses are requested. No evaluation letters and/or results will be issued to the respondents. At this time no solicitation exists; therefore, please do not request a copy of the solicitation.

DRAFT STATEMENT OF WORK (SOW)

Contents

DRAFT STATEMENT OF WORK (SOW)

Title: KR2i Tangential Flow Filtration (TFF) System Requiring Activity Name: Walter Reed Army Institute of Research (WRAIR), Pilot Bioproduction Facility (PBF)

1. INTRODUCTION

The WRAIR aims to conduct biomedical research that is responsive to Department of Defense (DoD) and United States (U.S.) Army requirements and to deliver life-saving products including knowledge, technology, and medical material that sustain the combat effectiveness of the Warfighter.

The WRAIR headquarters is dedicated to Senator Daniel E. Inouye and is located in Silver Spring, Maryland. The WRAIR is the largest biomedical research facility currently serving the DoD. Established in 1893, WRAIR’s Research and Development (R&D) activities now reach around the world to include Germany, Thailand, and Kenya.

WRAIR’s mission is to discover, design, develop, and deliver globally impactful solutions for military infectious diseases, brain health, and performance optimization through innovative research. WRAIR’s vision is to be the premier DoD biomedical research organization that executes constantly relevant, integrated basic research and advanced technology that protects, projects, and sustains the Warfighter today, invents global medical solutions for the future, and keeps the Warfighter on point for the Nation. The WRAIR hosts three Centers of Excellence for Military Psychiatry and Neuroscience Research, Military Infectious Disease Research, and Enabling Capabilities Research with efforts ranging from blast induced neurotrauma to malaria vaccine development.

2. PURPOSE AND BACKGROUND

The PBF is a current Good Manufacturing Practice (cGMP)-compliant pharmaceutical manufacturing facility at WRAIR. The PBF specializes in developing vaccines and biologics for military-relevant infectious disease threats. PBF support has been critical to the development efforts of the DoD in the advancement of numerous vaccines. These vaccines include those for hepatitis A, meningitis, dengue fever, malaria, adenovirus, Japanese encephalitis, shigellosis, zika, and, most recently Covid-19. Conventional as well as recombinant and other genetically engineered vaccines are undergoing development and production at WRAIR. Other types of biological products (e.g., therapeutics) are capable of being produced as well under the right circumstances.

The PBF conducts research, development, production, and testing of vaccines and other biological products. Production is performed and products are tested in compliance with cGMP. Production is pilot-scale with 500 – 2,000 doses per finished lot of products. Products are released for use in Phase I - IIb clinical studies under Investigational New Drug (IND) applications.

The WRAIR PBF performs manufacturing process development in order to facilitate the technology transfer of R&D products into Good Manufacturing Practice (GMP) manufacturing for clinical trial use. The primary goal of the PBF Biologics Process Development (BPD) team is to adapt closed systems and single-use materials to minimize product contact while providing well characterized scalable processes to reduce risk during transfer to GMP production.

3. SCOPE

This requirement is to procure the KR2i TFF system and associated components and parts for process development of ultrafiltration and microfiltration at the 100mL to 10L scale. The KR2i TFF system is the direct smaller scale counterpart to the KMPi TFF system that the PBF currently utilizes within the cGMP suites for efficient technology transfer of processes developed by the BPD team. This equipment is proprietary to the manufacturer and is required in order to provide closed system GMP manufacturable processes for downstream processing steps of concentration and buffer exchange for a variety of products, to include, but not limited to, recombinant proteins, viral vaccines, and monoclonal antibodies. The equipment shall be supplied with a two-year warranty (one-year factory warranty followed by one-year extended warranty). Additionally, the Contractor shall perform on-site installation and qualification, as well as provide basic user training. The objective of this requirement is to provide the PBF BPD team the capability to develop and characterize closed system manufacturing processes that can be readily transferred to the GMP manufacturing suite (KMPi) to provide safe and effective vaccines and biologics for use in clinical studies.

4. PERIOD OF PERFORMANCE (POP)

The POP for this contract is as follows:

The equipment and associated materials shall be delivered no later than 10 weeks from contract award/purchase order acceptance with on-site Installation Qualification/Operational Qualification (IQ/OQ) completed within 10 days of equipment delivery and training on equipment provided within five days of the completed qualification. Additionally, the vendor shall include a two-year warranty for the KR2i TFF system.

5. WORK SCHEDULE AND LOCATION

The delivery location is 503 Robert Grant Ave., Building 503, Silver Spring, MD 20910. The Contracting Officer’s Representative (COR) will coordinate with the Contractor for any WRAIR access that may be required. Scheduled on-site visits shall occur during business hours between the hours of 0800 to 1600 Eastern Standard Time (EST), Monday through Friday.

6. PERFORMANCE REQUIREMENTS

6.1. Objectives

6.1.1. The KR2i TFF system shall meet WRAIR’s need for development scale downstream ultrafiltration and microfiltration.

6.1.2. To prevent instrument downtime, a two-year warranty (one-year factory warranty followed by one-year extended warranty) to include parts and labor shall be provided with repair or replacement to fully operational status within two working days of notification of need for warranty service.

6.1.3. Installation qualification and operational qualification of machinery is required to confirm full functionality of the equipment.

6.1.4. Basic user training shall allow Government personnel to be proficient in the proper use and care of the equipment.

6.2. Tasks

6.2.1. KR2i TFF System Procurement (Deliverable 1)

6.2.1.1. KrosFlo KR2i TFF Complete System

6.2.1.1.1. Contractor shall provide the KrosFlo KR2i TFF complete system along with associated KrosFlo KF Comm software, two 20Kg scales, required modules, and auxiliary component octopus connection cables that fits on a laboratory benchtop with a width of no more than 28.5 inches and a height of no more than 19 inches.

6.2.1.2. Single-use Filter Housing

6.2.1.2.1. Contractor shall provide one 2-bolt manual clamp (0.5m2).

6.2.1.2.2. Contractor shall provide one torque wrench and socket suitable for measuring torque on filter clamp.

6.2.1.2.3. Contractor shall provide one SIUS single-use process development filter plate insert with ½” tri-clamp (9 Liters Per Minute (LPM) max flow rate).

6.2.1.2.4. Contractor shall provide one SIUS single-use low holdup volume filter plate insert with female luer lock connection (0.48 LPM max flow rate).

6.2.1.3. KR1 Pump

6.2.1.3.1. Contractor shall provide two KR1 pumps providing flow rates up to 2.3LPM.

6.2.1.3.2. KR1 pumps shall communicate with the central control system and pressure sensor to maintain flow rates in the range of 0.01 to 13.0 LPM to maintain proper back pressure.

6.2.1.4. Pressure Sensors and Pressure Transducers

6.2.1.4.1. Contractor shall provide six single-use, sterile pressure sensors.

6.2.1.4.2. Contractor shall provide nine pressure transducers with ½” TCx ½” TC ports, 42” sterile cord, range of -10 to 75 psi with accuracy of ±2% from 0 to 6 psi and ±3% from 3 to 30 psi.

6.2.2. Warranty and Repairs (Deliverable 2)

6.2.2.1. Contractor shall provide one-year factory warranty to include parts and service.

6.2.2.2. Contractor shall provide one-year extended warranty (beyond factory warranty) to include parts and service.

6.2.2.3. Contractor shall provide unlimited service visits, Monday through Friday (excluding Federal holidays), to perform repairs that apply to instrument defects. The Contractor shall make arrangements to provide the parts and labor for all necessary repairs. The Contractor shall provide emergency on-site repair services with a 48-hour response time. The Contractor shall provide documentation (e.g., service report) detailing all repair services performed upon completion of services.

a) The Contractor shall respond within 48-hours (Monday through Friday).

b) Prior to reporting to a service call, the contract’s services representation shall notify medical maintenance via email (usarmy.detrick.medcom-wrair.mbx.medical-maintenance@health.mil) and shall report in person or telephonically notify the maintenance manager of the building, room number, and telephone number prior to commencing services during normal duty operating hours (0800 to 1600 EST). During other than normal operating hours, the contractor's representative shall report to the Administrative Officer of the Day (AOD) and notify medical maintenance via email.

c) The Government and the Contractor's service representative will exchange hazard communication information before the commencement of any repair.

d) When required, the Contractor's service representative will comply with the Occupational Safety and Health Administration (OSHA) lockout/tag-out standards while performing maintenance on Medical Devices/Medical Device Systems (MD/MDS).

e) Upon completion of services by the Contractor's service representative, a service report shall be provided to the COR or the AOD with an electronic copy of the service report submitted to medical maintenance at usarmy.detrick.medcom-wrair.mbx.medical-maintenance@health.mil. The service report shall provide detailed information regarding the cause of the MD/MDS malfunction and corrective action taken. It shall include, at a minimum, the time required to complete the work and a list of parts replaced with part numbers prior to leaving the facility.

f) In the event all information is not available to the Contractor's service representative when services are performed, the initial service report shall include all available information to close work order within five days. The Contractor shall provide the balance of the required information to the clinical engineering manager no later than ten days after services are completed.

g) The Contractor's service representative shall be factory trained and have a minimum of two years of experience working on the contracted MD/MDS.

h) The Contractor shall furnish all software updates/patches issued by the MD/MDS manufacturer.

i) The Contractor shall have access to all necessary diagnostic software (if applicable). The Contractor shall use only Original Equipment Manufacturer (OEM) new or OEM refurbished repair parts.

j) For all contracts that require calibration of systems, the Contractor shall complete DD Form 2163 or DD Form 2164 (Verification/Certification Worksheet) in accordance with the instructions provided in Army Regulation (AR) 40-61. Additionally, a continuation sheet shall be attached to the DD Form 2164 indicating the manufacturer, model, Serial Number (SN), and date of calibration expiration of all items of Test, Measurement, and Diagnostic Equipment (TMDE) used to perform the calibration.

6.2.3. Installation Qualification/Operational Qualification (IQ/OQ) (Deliverable 3)

6.2.3.1. Contractor shall perform full installation of the equipment and accessories in the space designated by the COR at the WRAIR.

6.2.3.2. Contractor shall perform operational qualification to verify system operability after installation.

6.2.3.3. Contractor shall execute on-site installation qualification and operational qualification and provide all related documentation. Documentation shall be provided for review and approval by WRAIR PBF Quality Assurance prior to execution.

6.2.3.4. Contractor shall verify that the machine can maintain proper flow rate, controlled back pressure, and accurate weight measurement to ensure the instrument is operational for properly controlled TFF operations.

6.2.4. Basic User Training (Deliverable 4)

6.2.4.1. Contractor shall provide a licensed technician to perform on-site user training.

6.2.4.2. All available instruction manuals and user guides associated with the delivered equipment shall be provided to the COR.

6.2.4.3. Contractor shall provide on-site training to approximately five personnel covering all applications, uses, functions, and basic cleaning, maintenance, and care of the delivered equipment.

7. DELIVERABLES

The Contractor shall complete and submit deliverables in accordance with the “Deliverables Table” below.

DELIVERABLES TABLE

7.1. Inspection and Acceptance

The COR is delegated with oversight of specific technical and functional responsiblities to include inspection and acceptance of all products, incoming shipments, documents, and services.

Certification by the Government of satisfactory performance provided is contingent upon the Contractor adhering to the performance standards contained in the SOW and all terms and conditions of this order, including all modifications.

7.2. COR Information

TBD

7. CONTRACT MANAGEMENT

7.1. Government Management

The COR for this contract will be appointed by the Contracting Officer (KO). The COR will serve as the primary point of contact for all activities and issues that occur under this contract. Only the KO has the authority to enact changes to this award.

7.2. Contractor Organization

The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The Contractor shall ensure that all Contractor personnel are advised of their chain of command and who they should contact if they have questions.

8. COMPLIANCE DOCUMENTS

8.1. General Compliance

8.1.1. Federal Law

The products and services provided under this contract must be provided in accordance with all Federal, DoD, Department of the Army (DA), and United States Army Medical Research and Material Command (USAMRMC) laws, as well as command laws, regulations, policies, and procedures that govern the conduct of regulated research.

8.1.2. DoD Compliance Documents

A complete list of DoD compliance documents providing specifications, standards, or guidelines can be found at https://www.defense.gov/Resources/Forms-Directives-Instructions/.

a) AR 25-22, The Army Privacy and Civil Liberties Program https://armypubs.army.mil/epubs/DR_pubs/DR_a/ARN38442-AR_25-22-001-WEB-2.pdf

b) AR 25-1, Army Information Technology https://armypubs.army.mil/epubs/DR_pubs/DR_a/ARN37510-AR_25-1-001-WEB-3.pdf

c) AR 25-2, Army Cybersecurity https://armypubs.army.mil/epubs/DR_pubs/DR_a/ARN37506-AR_25-2-003-WEB-4.pdf

d) Department of Defense Instruction (DoDI) 8500.01, Cybersecurity https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodi/850001_2014.pdf

e) DoDI 8510.01, Risk Management Framework For DoD Systems https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf

f) DoD 5400.11-R, DoD Privacy Program https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodm/540011r.pdf

9.2. Information Technology Compliance

9.2.1. Cybersecurity Requirements

9.2.1.1 System Security Requirements - The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment provided by the Government.

9.2.1.2. Key System Attributes - Failure to meet any key attribute is considered a breach of contract.

9.2.1.2.1 . The vendor device or system shall pass a pre-validation screening conducted by the Government and administered within six months of contract award that meets the criteria listed below:

a) No unmitigated Category I (CAT I) findings as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located at https://public.cyber.mil/stigs/

b) No unmitigated Category II (CAT II) findings as described in the appropriate DISA STIGs located at https://public.cyber.mil/stigs/

c) No unmitigated critical or high CAT I findings from Nessus vulnerability scans.

d) No unmitigated CAT II findings from Nessus vulnerability scans.

9.2.1.2.2. The vendor shall mitigate all CAT I and CAT II findings discovered during the Assessment and Accreditation (A&A) process according to a schedule published by the Government.

9.2.1.2.3. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials in accordance with required deliverable timelines.

9.2.1.2.4. The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within 12 months of contract award.

9.2.1.2.4.1. Government will defer delivery of, and payment for the system for 12 months, or until the ATO is granted.

9.2.1.2.4.2. The vendor shall, after the award of an ATO to vendor’s device or system, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by the Government.

9.2.1.3. Post Award Cybersecurity Requirements

9.2.1.3.1. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

9.2.1.3.2. The vendor shall provide anticipated costs and timelines required to address any inability to meet any of the security requirements.

9.2.1.4. Cybersecurity Regulations and Guidance

9.2.1.4.1. The vendor shall use and comply with the most recently published versions of the following references as well as all regulations or guidance referenced within those publications:

a) United States Law

i. The Health Insurance Portability and Accountability Act (HIPAA) of 1996

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

b) Office of Management and Budget (OMB) - The following publications are located at https://www.whitehouse.gov/omb/information-for-agencies/circulars/

i. Circular A-130

ii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Contractors

c) National Institute of Standards and Technology (NIST) - The following publications are located at http://www.nist.gov/publication-portal.cfm

i. NIST Special Publication (SP) 800-37, Risk Management Framework (RMF) for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

ii. NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

d) Federal Information Processing Standards (FIPS) - The following publications are located at https://csrc.nist.rip/publications/PubsFIPS.html

i. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

ii. FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems

iii. FIPS PUB 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors

e) DoD - The following publications are located at https://www.esd.whs.mil/DD/

i. DoDI 5200.02, DoD Personnel Security Program (PSP)

ii. DoDI 8500.01, Cybersecurity

iii. DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

iv. DoDI 8510.01, RMF for DoD Systems

v. DoDI 8551.01, Ports, Protocols, and Services Management (PPSM)

vi. DoDI 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

vii. DoDI 6025.18, HIPAA Privacy Rule Compliance in DoD Health Care Programs

viii. DoD Directive 5400.11, DoD Privacy Program

ix. DoD Manual 5400.11-R, DoD Privacy Program

9.2.1.5. Assessment and Accreditation (A&A)

9.2.1.5.1. The vendor shall submit all RMF required documentation, as specified by the Government for review and approval, no later than four months after request by the Government.

9.2.1.5.2. The vendor shall obtain approval from the Government prior to implementing any vendor developed policies, plans, and procedures.

9.2.1.5.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within 30 business days of request by the Government.

9.2.1.5.4. The vendor shall provide technical scans within one month of the A&A kickoff meeting.

9.2.1.5.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

9.2.1.6. Continuous Risk Management

9.2.1.6.1. The vendor shall maintain a duplicate of the fielded device or system in a vendor supplied laboratory environment at the vendor location for as long as the system is operated by the Government.

9.2.1.6.2. The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

9.2.1.6.3. The vendor shall maintain the authorized security configuration and notify the Government within 48 hours of any major changes.

9.2.1.6.4. The vendor shall ensure the vendor’s device or system is in compliance with the DoD Information Assurance Vulnerability Management (IAVM) program upon each deployment.

9.2.1.6.5. The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a laboratory environment.

9.2.1.6.6. The vendor shall make the duplicate device or system available for periodic security reviews, within 45 business days of notification by the Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

9.2.1.6.7. The vendor shall maintain the system and perform necessary updates to comply with updated STIGS as made available by the Government within three months of notification by the Government.

9.2.1.6.8. The vendor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) scan results to the Government on a monthly basis.

9.2.1.6.9. The vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

9.2.1.6.10. The vendor shall close all discovered vulnerabilities within three months of discovery.

9.2.1.6.11. The vendor shall submit to the Government detailed explanations for the inability to close discovered vulnerabilities.

9.2.1.6.12. The vendor shall submit any mitigation that addresses any open vulnerabilities to the Government for approval.

9.2.1.6.13. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

9.2.1.6.14. The vendor shall use Government approved methods and procedures for remote access administration of the system or device.

9.2.1.7. Intrusion Detection and Prevention, Antivirus, and Anti-malware

9.2.1.7.1. The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and anti-malware applications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support, either fully or partially, the operation without performance degradation of the medical system/device. In cases where the operation of security applications is not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

9.2.1.7.2. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes), by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

9. OTHER TERMS, CONDITIONS, AND PROVISIONS

9.1. Invoices

The Contractor shall submit invoices monthly and/or annually to Wide Area Work Flow (WAWF) with sufficient documentation to provide certification of invoice.

The Contractor is responsible for properly preparing and forwarding to the appropriate Government official the invoice and receiving report for payment. Invoices submitted for payment which do not contain Contract Line Item Number (CLIN) and Accounting Classification Reference Number (ACRN) information will be rejected. Other Direct Costs (ODCs) are not authorized under this contract. The WAWF – Receipt and Acceptance application is the required method of submission.

9.2. Anti-Terrorism (AT) and Operational Security (OPSEC) - RESERVED

9.3. Compliance with Relevant DoD, Service, and Institutional Policy Regulations - RESERVED

9.4. Personally Identifiable Information (PII) and Protected Health Information (PHI) - RESERVED

10. ATTACHMENTS

Attachment 1 - Acronyms List

ATTACHMENT 1 – ACRONYMS LIST