DRAFT_BAA_PRE-PROPOSAL_CONFERENCE_DOCUMENTS.docx

Cancer Genomics Cloud Pilots Draft BAA Pre-Proposal Conference Documents December 23, 2013 45 of 57

TABLE OF CONTENTS

Document #1: BACKGROUND AND INTRODUCTION Document #2: RESEARCH AND TECHNICAL OBJECTIVES (RTO) Document #3: REPORTING REQUIREMENTS AND DELIVERABLES Document #4: MANDATORY QUALIFICATION CRITERIA Document #5: TECHNICAL EVALUATION CRITERIA Document #6: GENERAL PROPOSAL INSTRUCTIONS Document #7: TECHNICAL PROPOSAL INSTRUCTIONS Document #8: BUSINESS PROPOSAL INSTRUCTIONS Document #9: GOVERNMENT FURNISHED PROPERTY/INFORMATION Document #10: NIH INFORMATION AND PHYSICAL ACCESS SECURITY

Documents contained herein do not represent the Cancer Genomics Cloud Pilots BAA, but are draft versions of documents being used in the development of the forthcoming Cancer Genomics Cloud Pilots BAA.

DOCUMENT #1: BACKGROUND AND INTRODUCTION

CANCER GENOMICS CLOUD PILOTS

NCIP MISSION

The National Cancer Informatics Program (NCIP) supports NCI research initiatives through sustaining a multidisciplinary community of biomedical researchers, informaticists, and developers dedicated to improving informatics practices in the study of cancer and the translation of that knowledge into improved clinical interventions. The NCIP seeks to ensure that the cancer research community including NCI-designated cancer centers, the upcoming National Cancer Trials Network (NCTN), Specialized Programs of Research Excellence (SPORES), and individual scientists working in both intramural and extramural laboratories, have the necessary informatics capabilities to carry out their missions. To accomplish its goals, the NCIP engages in fostering community-driven open development of informatics capabilities designed to support specific research needs and providing access to well-described data collections to facilitate integrative cancer research. A critical element of the program is to maintain and extend informatics infrastructure and standards to improve interoperability among disparate information systems. The program also encourages collaborative relationships among researchers and provides training for the next generation of biomedical investigators to use informatics capabilities to accelerate biological discovery and clinical application.

BACKGROUND

The growth of large-scale DNA sequence data for cancer research and its routine use in translational science is rapidly out-stripping the required computational capacity for storage, processing, network transmission, and analysis. Groups ranging in size from single laboratories and investigators to large multi-institutional consortia are generating large-scale data at an exponential pace. The ability to access and analyze genomic data and associated clinical annotations collected from various studies is critical to accelerating research and making new discoveries.

Presently, investigators mine genomics data by locating and downloading data stored at a variety of locations, including project-specific repositories (e.g., The Cancer Genome Atlas (TCGA) and Therapeutically Applicable Research to Generate Effective Treatments (TARGET) Data Coordinating Centers, the Cancer Genomics Hub (CG-Hub), the National Center for Biomedical Informatics Sequence Read Archive (NCBI SRA), and/or International Cancer Genome Consortium (ICGC) repositories), often adding their own local data. They then compute over these data on local hardware using computational tools, many of which are locally developed and rapidly changing. This model has been successful for many years, but is becoming untenable given the enormous growth of biomedical data since the advent of large-scale scientific programs such as the Cancer Genome Atlas (TCGA) and Therapeutically Applicable Research to Generate Effective Treatments (TARGET) that use next generation sequencing technology. At its projected completion in 2014, it is expected that TCGA will generate approximately 2.5 Petabytes (PB) of data. The difficulties that are caused by such scale are three-fold:

1. Maintaining local copies of data at this scale is not cost effective and will continue to increase in cost as the data is growing faster than Kryder’s Law[footnoteRef:1] [1: Kryder’s law refers to the growth in storage capacity per unit cost and is an analog of the more commonly known Moore’s Law.]

1. Providing computational capacity to analyze the data is similarly constrained

1. Electronic transfer of data at this scale is not practical.

With regard to the final point, the 2.5 PB expected TCGA core data set would require weeks to months to download even if the organization that is transferring the data has access to point-to-point 10 Gigabit networks[footnoteRef:2]. Evidence from other NCI programs, as well as the results of a request for community input [footnoteRef:3] sent to all NCI grantees and intramural researchers indicates that with less than 0.5 PB of TCGA data available, much of the NCI-supported research community is already computationally limited by financial constraints and IT (network, storage, and computing) issues that exceed the capacity of individual investigators and most institutions.[footnoteRef:4] [2: 2.5 PB is 20,000,000 Gigabits (Gb). At 10 Gb/sec, this equates to a 23 day download time. As a practical matter, transfers over such lines are unlikely to exceed 1-3 Gb/sec given the necessity of sharing such links with other users and the latency associated with file transfer protocols.] [3: http://ncip.nci.nih.gov/nci-cloud-initiative] [4: https://wiki.nci.nih.gov/x/CILbBw]

Wider access to data and computational infrastructure utilizing new technological capabilities could potentially address these needs as well as offer an additional avenue for dynamic community engagement in biomedical research. Hence there is a critical need to support the exploration of alternate models to better facilitate broad-scale sharing and analysis of genomics datasets.

PROJECT SUMMARY

The purpose of this BAA is to support the development of a new model for computational analysis of biological data that has the potential to address the challenges described above. This model (which has been articulated recently in a series of NCI Precision Medicine Workshops[footnoteRef:5] and publications by experts in the field of biomedical informatics[footnoteRef:6]) involves the creation of a set of data repositories with co-located computational capacity and an Application Programming Interface (API) that provides security and data access for developers of analytic tools. In this model, applications are brought to the data, rather than bringing the data to the applications. Such a “Cancer Genomics Cloud” has the potential to democratize access to NCI-generated genomic data and provide a more cost-effective way to provide computational support to the cancer research community. [5: Precision Medicine Workshops were held on 4/24/2012 and 9/10/2012] [6: See, for example, Grossman, RL and White, KP, 2012, Journal of Internal Medicine 271:2, pp 122-130, Haussler, D, et al., EECS Department, University of California, Berkeley, Tech. Report UCB/EECS-2012-211.]

Towards this end, the NCI seeks to sponsor the development of multiple Cancer Genomics Cloud pilots that will be available for use and testing by the scientific community as part of a competitive evaluation that will include technical benchmarking and cost analysis. If successful, the NCI will consult with the cancer research community and relevant oversight committee(s) to define, and potentially construct, a production version of one or more of the pilot clouds, or a successor design informed by the results of the pilot evaluations. In spirit, and by design, this new initiative will be the first step toward the establishment of a full Cancer Knowledge Commons, along the lines called for in the National Academy report on Precision Medicine, and will be coordinated with The National Institutes of Health’s Big Data to Knowledge (BD2K) initiative and other relevant activities in large-scale data analysis.

2.5 PB is 20,000,000 Gigabits (Gb). At 10 Gb/sec, this equates to a 23 day download time. As a practical matter, transfers over such lines are unlikely to exceed 1-3 Gb/sec given the necessity of sharing such links with other users and the latency associated with file transfer protocols.

http://ncip.nci.nih.gov/nci-cloud-initiative https://wiki.nci.nih.gov/x/CILbBw Precision Medicine Workshops were held on 4/24/2012 and 9/10/2012 See, for example, Grossman, RL and White, KP, 2012, Journal of Internal Medicine 271:2, pp 122-130, Haussler, D, et al., EECS Department, University of California, Berkeley, Tech. Report UCB/EECS-2012-211.

DOCUMENT #2: RESEARCH AND TECHNICAL OBJECTIVES (RTO)

The primary Research and Technical Objective of the Cancer Genomics Cloud Pilot is to drive solutions to support the design, implementation, and documentation of a new model for computational analysis and sharing of very large biological data sets as well as learn about unforeseen obstacles. The ultimate goal is democratizing access to NCI-generated genomic data sets as well as providing sustainable computational support to the cancer research community. Pilot solutions are to overcome current data access limitations by bringing applications to the data rather than bringing the data to the applications. The models proposed could use commoditized cloud providers, private cloud providers, specialized hardware, and/or specialized configurations of commoditized hardware. The resulting pilots will enable authorized access to key NCI data sets as well as computing resources (i.e., storage, servers, high capacity networks). Key anticipated outcomes and benefits include the ability to:

It is not in the scope of these Research and Technical Objectives to serve as a “data coordinating center” for NCI datasets. Activities such as file processing, quality control, data harmonization (such as sequence realignments), and general provision of download and transfer services for these datasets will be provided through other mechanisms.

Core Data and Use Cases

Successful Cancer Genomics Cloud Pilot solutions must host a common core data set from The Cancer Genome Atlas (TCGA) project. This core data set must include: 1) All TCGA DNA-Seq binary alignment (BAM) files; 2) All TCGA RNA-Seq FASTQ and BAM files; 3) All TCGA SNP array (.cel) files; 3) Somatic and germline mutation calls for each sample (.vcf and .maf files); and 4) All TCGA clinical data. In addition, to promote diversity across the cloud pilots must include at least one additional TCGA data set. A complete description of all TCGA data types and their access is available at https://tcga-data.nci.nih.gov/tcga/tcgaDataType.jsp.

The TCGA data is currently stored at two specialized data centers, the Cancer Genomics Hub (CGHub) for lower level sequence data and associated metadata and the Data Coordination Center (DCC) for all other datatypes. CGHub (https://cghub.ucsc.edu) is a secure repository at the University of California Santa Cruz for storing, cataloging and accessing lower levels of sequence data such as sequences and alignments (i.e., BAM and FASTQ files), where they can be accessed by the research community. All of the TCGA sequence data on CGHub are under Controlled Access, meaning that user certification is required. Metadata are the exception, which are Open Access. All other genomic data (e.g., SNP6, array gene expression, methylation, sequence variant data) and all clinical data generated by TCGA are housed at the TCGA DCC. Both the Open Access and Controlled Access data stored in the DCC are accessible to the community through the TCGA Data Portal (https://tcga-data.nci.nih.gov/). More information on the Open and Controlled Access data from TCGA is available at: https://tcga-data.nci.nih.gov/tcga/tcgaAccessTiers.jsp. Successful solutions are expected to operate in a collaborative environment with the current TCGA data centers and any future TCGA data center for obtaining the required data.

The stated formats for the core data sets are minimum requirements. Solutions with innovative storage formats to support specialized compute-optimized needs are encouraged.

The core mutation call data will be provided by the TCGA data centers. Solutions with additional mutation call methods that run these methods on the core TCGA sequencing data, provide resulting data in through their cloud instance, and provide the methods to the TCGA data centers for re-use are encouraged, but not required.

To facilitate community input about the data types and analyses that should be prioritized for the Cancer Genomic Cloud pilots, NCI has conducted a Request for Information (RFI), implemented as a portal for community comment at http://ncicloud.ideascale.com. Through this portal, individuals have commented and voted on use cases and data types they deem critical for the pilots. Use of this information is encouraged, but not required in the development of proposed solutions.

Architecture

A key technical objective is the exploration of alternative models to better facilitate broad-scale sharing and analysis of genomic data sets. As such, the NCI does not anticipate placing substantive proscriptions on the architecture that is utilized to develop the cloud pilots. The only requirement is that NCI must be able to replicate the design using technology and services that are available on the standard commercial market (i.e. there are standard terms under which the service is offered to the Government or the public).

Computational Services

Cancer Genomics Cloud pilots must provide end users with access to significant compute capacity to support the large-scale analytical capabilities anticipated for the core data set. Importantly, solutions should consider support for diverse types of large-scale computing. Examples of computing modalities may include, but are not limited to big-graph analysis and large-scale statistical analysis.

A key technical objective of the Cancer Genomics Cloud pilots is a highly usable application programming interface (API) that is accessible by the technical members of the research community. The interface must support services for data access as well as direct analysis and computation against the data store. A set of core services – such as security, logging, and entitlements - must be jointly established by the cloud pilot awardees and implemented in each pilot cloud. The ability to initiate and terminate compute services capable of accessing a data store through programmatic interfaces is an important feature.

In addition to supporting analysis over core data sets described herein, cloud pilots must also provide users the ability to access cloud resources for the analysis of their own private data in conjunction with hosted data through the API(s).

Analysis Capabilities

Cancer Genomics Cloud pilot solutions must collaboratively identify a common set of query and analysis tools and/or workflows that will be utilized for each pilot implementation. When selecting these priorities it is strongly encouraged that solutions take into account community input at http://ncicloud.ideascale.com. Each pilot team must also implement analysis capabilities specific to the additional data type(s) and/or their expertise hosted in their cloud instance. The analysis capabilities implemented must use the same API provided for community use. In addition to the query and analysis capabilities implemented, each cloud pilot must support users’ ability to securely run their own tools on the hosted cloud data using the API(s). Clouds must therefore support tools developed in diverse coding languages. It is encouraged, but not required to review community input at http://ncicloud.ideascale.com for priority use cases to support.

Access and Security

The cloud pilots will be considered federal electronic information systems and as such, must meet the relevant federal regulations. This includes adopting and implementing the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal Information and the Federal Information system. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer’s (OCIO) Website, http://www.hhs.gov/ocio/index.html. This policy is in accordance with the Federal Information Security Management Act (FISMA).

The core data set defined for the pilots are categorized as Federal Information Management Security (FISMA) Low. However, additional data types incorporated by individual pilots may elevate security requirements to FISMA moderate. Solutions must plan the system controls accordingly taking into consideration a Moderate categorization. The security requirements for these pilot implementations include, but are not limited to, preparation of an IT Security Plan, IT Risk Assessment, FIPS 199 Assessment, and performance of security control testing and evaluation. The awardees will be responsible for attaining the Authority To Operate (ATO) from the relevant security officer.

Protection of data in the Cancer Genomics Cloud pilots must be consistent with that established for these data in the NCI CGHub, the TCGA DCC and any future data coordinating center. Proposed solutions must address the requirement for pilot teams to attain the status of a Trusted Partner and maintain all restricted data within a controlled environment. The current NIH policy requires authentication of user access with the NIH authentication services for approved users, complying with systems security requirements, and implementing contingency procedures for incidents related to data management.

Additionally, proposed solutions must demonstrate an understanding of FedRAMP requirements (http://www.fedramp.gov) and describe an approach for achieving compliance in the event of a production implementation.

Scalability and Extensibility

Solutions must demonstrate knowledge and understanding of the current and future data size, complexity and computational capacity needs and plan the pilots accordingly. For the purpose of these Research and Technical Objectives, assume a starting core dataset size of 2.5 PB and compute services in the range of 1000-5000 nodes. Solutions should consider increases in the range of 10- to 100-fold. As part of any design, solutions should provide an assessment of operational costs for the proposed pilot including a projection of costs for the proposed scale-up that meets the anticipated future needs.

The proposed design should describe how the system may be extended – without major refactoring - to support other data types beyond the core plus additional data sets scoped for the pilot implementations.

Data Standards To support a long term goal of interoperability among the clouds and computations that span one or more clouds, it is important that data in the Cancer Genomic Cloud pilots be represented using standard formats, data elements, and vocabularies. Pilot solutions must demonstrate how teams will work collaboratively with one another, with the TCGA data coordinating centers, and with the NCI staff to define the appropriate standards for raw and processed data that will be commonly applied across these resources. For each pilot, the information model must be described, discoverable and reusable to ensure that the community has shared understanding of the meaning of data to develop and share analytical tools.

OTHER CONSIDERATIONS

Cancer Genomics Cloud pilot solutions must demonstrate how they will work collaboratively with one another, and with the NCI staff in designing, building and evaluating the Cloud pilots. Although not required, additional features above and beyond the needs described within this Research and Technical Objectives are encouraged. These considerations should be based on demonstrable community need, either from the RFI or other reliable sources, and be able to be implemented with best value to the government.

It is anticipated that up to three contracts will be awarded in association with this BAA. Contracts for this acquisition will initially be awarded for a base period of six (6) months. The expectation for the base period will be to deliver an initial design and development. All deliverables required in this period are defined under post-award requirements contained herein. The deliverables due during the base period will be evaluated and based on this evaluation options may be exercised for a 9-month Option Period 1. Deliverables required during Option Period 1 are defined under post-award requirements, contained herein. In Option Period 1, awardees must complete their hosted instance of a Cancer Genomics Cloud pilot that meets the Technical Objectives and the requirements in their proposed Statement of Work. Upon successful completion of Option Period 1, Option Period 2 may be exercised. During this final 9-month period, awardees must complete the IT-SA&A process, after which NCI will evaluate the pilots and conduct a public evaluation of the implementations.

Evaluations During the evaluation period (Option Period 2), the Contractor will complete the IT-SA&A process. Following the IT-SA&A process, each cloud pilot will be tested independently and evaluated by NCI on the basis of how well it meets the Technical Objectives and the requirements outlined in the individual proposals and how effective the system is at supporting core analysis capabilities. In addition, it is the Government’s intention to make these cloud pilots available to the research community for broader evaluation. Innovative mechanisms proposed to support community-based testing of these cloud pilots are within the scope of this BAA. The expectation is that a production instance of one or more of these cloud pilots (or a successor design) will be constructed (or expanded from the pilot), and decisions about the production environment will be informed by the outcome of the community evaluation of the pilots. It is anticipated that the Contractor’s cost incurred during this period will be minimal and limited to system operations and support, user support, communications with the Government, involvement in testing, delivery of the reporting requirements following the IT-SA&A process, and the final transition.

POST-AWARD REQUIREMENTS

The following post-award requirements will apply to all awards made under this BAA. Offerors are instructed to address responsibility for complying with these requirements in the proposed Statement of Work for the Technical Proposal. Offerors are required to address these post-award requirements in their technical proposal.

Reporting Requirements and Deliverables The selected awardees must deliver a draft design document in the six (6) month base period per the delivery schedule as well as begin the implementation of the system. Selected Offerors will instantiate the hosted Cancer Genomics Cloud pilot as a deliverable such that it meets the requirements detailed in the Technical Objectives section of this BAA and the Offerors’ proposed Statement of Work. In addition to the hosted instance, the awardees must deliver sufficient documentation of the cloud pilot that will allow independent implementation of the final pilot. The Offerors should provide an assessment of operational costs including a projection of cost for scaled-up infrastructure as outlined in the technical guidelines in this BAA as well as the proposed Statement of Work. Reporting requirements and deliverables are detailed in other sections of this BAA.

Communications & Meetings The awardee must provide for and maintain effective communications with any subcontractors, the Contracting Officer’s Representative (COR) and the Contracting Officer (CO) as necessary to implement the proposed SOW, including periodic teleconferences as indicated with the COR and CO to discuss technical aspects of ongoing activities, anticipated problems, obstacles, proposed approaches to solve problems, and overcome challenges. The contractor must plan for the following meetings:

1. Post award Contract Initiation Meeting (virtual);

1. Monthly meeting (virtual);

1. Regular on-site meetings at contractor facilities with the COR and such other experts as needed by the COR to assess progress;

1. Quarterly on-site meetings at the NCI facilities;

1. Ad hoc meetings as required and called for by the COR.

Intellectual Property All data, documentation and software delivered under any resulting contract will be delivered with unlimited rights as set forth in FAR 52.227-14 for the Government. All software developed under this solicitation must be released under an approved non-viral open source license as set forth in FAR 52.227-17. To clarify, the software must be released under an Open Source Initiative-approved, non-viral, open source license. See http://opensource.org/licenses Inventions are the result of intellectual input which cannot be determined in advance. While the Bayh-Doyle law may not apply to inventions under this contract, FAR 52.227-11 clearly documents the rights and obligations of the Contractor and Government with respect to inventions.

To the extent that an Offeror intends to use or include commercial products in its designs, the products must be available both to the Government and the public through standard commercial terms.

Final Transition Offerors must plan and implement an orderly and efficient transition to a subsequent contractor or to the Government, by the expiration date of the contract, including a comprehensive inventory of all the data and resources and the transfer all other relevant equipment, databases, software applications, SOP’s, algorithms, technologies and other resources generated and/or purchased under this contract.

DOCUMENT #3: REPORTING REQUIREMENTS AND DELIVERABLES

Format of Cover page: All reports shall be submitted in Contractor format, but include a cover page containing the following information:

· Contract Number and Project Title

· Title of Report

· Period of Performance Being Reported

· Contractor’s Name and Address

· Author(s)

· Date of Submission

· Delivery Address

Type and Number of Copies:

Electronic Copy to Project Officer and Contracting Officer Original Hard Copy to Contracting Officer

1) Monthly Progress Report This report shall include a description of the activities during the reporting period and the activities planned for the ensuing reporting period. The first reporting period consists of the first full month of performance plus any fractional part of the initial month.

Thereafter, the reporting period shall consist of each calendar month. Reports are due on or before the __10th __ calendar day of the month.

In addition, the contractor shall provide monthly Earned Value Reporting. The Earned Value Reporting requirements for the purposes of this acquisition shall be similar to, but will not require compliance with, ANSI/EIA Standard 748, OMB Circular A-11, FAR 34.2, and HHSAR 334.2. The Contractor shall provide, as part of the Monthly Progress Report, monthly Earned Value Reports after the issuance of the contract award. Earned Value Reporting requirements shall be applied to subcontractors using the same rules as applied to the prime contractor.

The Monthly Earned Value Reports shall include analysis and reporting comprised of the following elements:

1. Budget at Completion (BAC)

2. Budgeted Cost for Work Performed (BCWP – also known as Earned Value (EV))

3. Actual Cost for Work Performed (ACWP)

4. Budgeted Cost for Work Scheduled (BCWS – also known as Planned Value (PV))

5. Estimate at Completion (EAC)

6. Schedule Variance (SV)

7. Cost Variance (CV)

8. Schedule Efficiency (SPI)

9. Cost Efficiency (CPI) Current period values and cumulative values for data, variances, efficiencies, indices, and forecasts shall be provided in numerical format showing values AND in graphical format showing trends. Causal analysis shall be conducted on any variances. Each month a summary of variance causes for that reporting period and variance causes to date shall be provided. The summary shall include a breakdown of causes that identifies:

• Size of the variance by cause (some variances may have multiple causes)

• Corrective actions either taken or recommended in reaction to the variance

• Success or expected success of any corrective actions

• Recommended changes to the project that might prevent the causes, mitigate the impacts, and/or provide remediation in terms of each variance.

2) Period of Performance Completion Report This report is to include a summation of the work performed and the results obtained for the each contract period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved.

3) Final Project Completion Report This report is to include a summation of the work performed and the results obtained for the entire contract period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved. The Final Report shall be submitted in accordance with the DELIVERIES Article in SECTION F of the contract. An annual report will not be required for the period when the Final Report is due. The Contractor shall submit, with the Final Report, a summary (not to exceed 250 words) of salient results achieved during the performance of the contract.

b. Other Technical Reports

1) Source Code and Binaries - Unless otherwise specified herein, the Contractor shall deliver to the Government, within 15 calendar days of the expiration date of the contract, all source code and binaries developed, modified, and/or enhanced under this contract.

2) Section 508 Report The contractor shall submit an annual Section 508 report in accordance with the schedule set forth in the ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY. The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/od under "Vendor Information and Documents."

3) The offeror will provide the following deliverables in compliance with the Enterprise Performance Life Cycle (EPLC) requirements. The offeror will be provided reporting templates during the final negotiations. These deliverables will be submitted as per the delivery schedule.

· Requirements Document

· Use Case Definition Document

· Design Plan

· Project Implementation Plan –The plan must include a Risk Management Plan and a Communications Plan.

· Project Schedule

· Test Plan

· Test Report

· User and Implementation Documentation

· In addition to the hosted instance, the selected teams must deliver sufficient documentation of the prototype to support end-users and administrators of the system and to allow independent implementation of the final prototype.

3) Operations Metrics Plan A Contactor-created plan that includes the description of metrics that will be collected during the Operations and Evaluations Period for assessing usage, performance, uptime, and other relevant metrics. The Government will evaluate and approve this plan to be utilized for the Metrics Reports.

4) Metrics Report The offeror must provide periodic reports of the metrics collected in accordance with the delivery schedule.

5) The Hosted Cancer Cloud Prototype Selected offerors will instantiate the hosted instance of a Cancer Genomics Cloud prototype as a deliverable such that it meets the requirements detailed in the technical objectives section of this BAA and the proposed Statement of Work. Delivery must include a report summarizing the content and technical features of the system (as defined in the proposed Statement of Work) and administrator-level access for the Contracting Officer’s Representative.

6) Operational Costs Report The selected offerors must provide an assessment of operational costs including a projection of cost for scaled-up infrastructure as outlined in the technical objectives in this BAA as well as the proposed Statement of Work. The report must take into consideration and describe scalability and extensibility plans for which the costs have been estimated.

7) Evaluation Plan This deliverable must outline plans that include community engagement as described in the Research Technical Objectives.

8) Trusted Partner Status Certificate The certificate for attaining a NIH Trusted Partner Status in order to be able to redistribute any controlled data sets.

9) Transition Plan Offerors must plan and implement an orderly and efficient transition to a subsequent contractor or to the Government, by the expiration date of the contract, including a comprehensive inventory of all the data and resources and the transfer all other relevant equipment, databases, software applications, SOP’s, algorithms, technologies and other resources generated and/or purchased under this contract.

c. Other Reports and Deliverables Other Reports and Deliverables may be required. This may include special reports required by regulation or policy and interim deliverables, and/or documentation, etc. These will be developed after proposal receipt as a result of finalization of the Statement of Work during negotiations. Below is a list of some of the reporting/deliverables that may apply based upon an offeror’s proposed SOW.

1) Information Security and Physical Access Reporting Requirements The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Section of any resultant contract, as applicable.

2) Roster of Employees Requiring Suitability Investigations The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access, or host and/or maintain a Federal information system(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract. (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY). Reporting New and Departing Employees will be provided thereafter along with each Monthly Status Report.

3) Employees Non-disclosure Agreements Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non-Public Information – Contractor Employee Agreement. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

4) Online Security Awareness Training All employees having access to (1) Federal information or a Federal information system or (2) personally identifiable information, shall complete the NIH Information Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

5) IT Security Assessment and Accreditation (IT-SA&A) In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the Contractor shall submit written proof to the Contracting Officer that an IT-SA&A was performed as per the delivery schedule. The Contractor shall perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SA&A remains valid. (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY) The following deliverables follow from the IT-SA&A process.

a) IT Security Plan (IT-SP) In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the contractor shall submit the IT-SP as per the delivery schedule. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis. (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY)

b) IT Risk Assessment (IT-RA) In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the contractor shall submit the IT-RA as per the delivery schedule. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. The Contractor shall update the IT-RA on an annual basis. (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY)

c) FIPS 199 Assessment In accordance with HHSAR Clause 352.239-72, Security Requirements For Federal Information Technology Resources, the Contractor shall submit a FIPS 199 Assessment as per the delivery schedule. The FIPS 199 Assessment shall be consistent with the cited NIST standard. (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY).

d) Privacy Impact Assessment (PIA) Titles II and III of the E-Government Act of 2002 require that agencies evaluate systems that collect personally identifiable information (PII) to determine that the privacy of this information is adequately protected. The mechanism by which agencies perform this assessment is a privacy impact assessment (PIA).

e) E-Authentication Threshold Analysis/Risk Assessment See the INFORMATION AND PHYSICAL ACCESS SECURITY

f) IT Contingency Plan See the INFORMATION AND PHYSICAL ACCESS SECURITY

g) IT Contingency Plan Test and Results Analysis See the INFORMATION AND PHYSICAL ACCESS SECURITY

h) IT Security Control Assessment Testing and Evaluation Report (SAR) See the INFORMATION AND PHYSICAL ACCESS SECURITY

i) Plan of Actions and Milestones (POA&M) See the INFORMATION AND PHYSICAL ACCESS SECURITY

j) Authority to Operate Letter (NCI-ATO) See the INFORMATION AND PHYSICAL ACCESS SECURITY

3. DELIVERY SCHEDULE

Delivery of other reports and deliverables will be proposed by the offerors in their technical proposal. They will be developed further after receipt of proposals as a result of finalization of the Statement of Work and other terms and conditions of any resultant contract during negotiations. Specific instructions, if applicable, will be provided to offerors in the Attachment entitled “Additional Technical Proposal Instructions.”

DOCUMENT #4: MANDATORY QUALIFICATION CRITERIA

Proposals must meet the Mandatory Qualification Criteria by the due date and time for receipt of proposals in order for a proposal to be considered for further evaluation beyond the Mandatory Qualification Criteria. The primary basis for selecting proposals for acceptance shall be technical, importance to agency programs, and fund availability.

1. Technical Merit The prime contractor must have a demonstrated capability in a biomedical research project involving at least 100 TB of data.

The prime contractor and/or the institution that is hosting the data must have the ability and commit to making these resources available to the community outside the hosting institution. This must include: (a) a minimum of 10 Gb/sec current connectivity from the commodity internet to the cloud infrastructure, with a capacity up to 40 Gb/sec; and (b) evidence from the hosting entity that the organization will allow access to the solution and that it will either support an existing, open authentication capability such as inCommon, or they will provide the resources necessary to do remote identity proofing and credential distribution as per NIST Special Publication 800-63-1 for any community researcher that desires access to the cloud. Such provisioning must be accomplished within seven (7) days of receipt of necessary documents.

The prime contractor must meet the intellectual property requirements of this solicitation, as outlined in the Research and Technical Objectives.

2. Importance to Agency Programs A major goal of this project is to develop capabilities that support precision medicine, that is, the ability to classify and treat a patient based on the underlying molecular characteristics of their tumor. Several NCI-funded programs continue to create large amounts of high-dimensionality data and the primary deliverable of this project is the development of powerful computational and analytic capabilities to support the conversion of that data into the knowledge required to achieve this goal. Offerors should provide clear explanations of how their particular approach is likely to achieve the NCI’s goal to enable precision medicine.

In addition, the NCI supports community-driven open development of informatics capabilities designed to support specific research needs, provide access to well-described data collections, and support interoperability, with the goals of democratizing access to information and facilitating integrative cancer research. Offerors should explain how their proposal will support these goals.

3. Fund Availability Subject to availability of funds, NCI anticipates the award, through this BAA, of up to three contracts as indicated in the following table. Proposals are to adhere to these parameters to be considered.

DOCUMENT #5: TECHNICAL EVALUATION CRITERIA

Proposals are evaluated against these criteria and not against each other as there is no common SOW. Proposals will be scored against the following evaluation factors in descending order of importance: 1) technical design/approach; 2) scientific and technical personnel; 3) project management, past performance, and organizational experience; 4) facilities and resources; and 5) small business subcontracting utilization. Although technical factors are of paramount consideration in the award of any contract, other factors are also important to the trade-off process and the overall contract award decision. All evaluation factors, other than cost or price, when combined are significantly more important than cost or price. The estimated cost of an offer must be reasonable for the tasks to be performed and will be subject to analysis by the Government.

The merit of each qualified technical proposal (those proposals that have met the Mandatory Qualification Criteria) will be evaluated by a peer review group. The Government reserves the right to convene multiple peer review groups to evaluate proposals. Offerors must demonstrate in their proposals that they have the necessary expertise and capabilities for conducting the proposed research. The evaluation will be based on the demonstrated capabilities of the Offerors in relation to the needs of the project as set forth in the BAA. Each proposal must demonstrate the feasibility of successful implementation of its approach and its relevance to the Research and Technical Objectives of the BAA. Offerors must submit information sufficient to evaluate their proposals based on the detailed criteria.

Following the peer review, the Government will establish an Order of Merit Ranking of all qualified proposals. Negotiations are conducted with Offerors selected from the Order of Merit Ranking to address identified weaknesses, questions, and areas for clarification, as well as to refine the proposed Statement of Work and Performance Measurement Baseline.

The Technical Evaluation criteria are used by the peer review group when reviewing an offeror’s technical proposal that has met the Mandatory Qualification Criteria. The elements listed in the Mandatory Qualification Criteria will not be re-evaluated as part of the Technical Evaluation. The elements evaluated in the Technical Evaluation are in addition to the Mandatory Qualification Criteria.