N01DA-16-8931_RFP_Amendment_01.pdf

“Non-Clinical ADME Studies”

AMENDMENT OF SOLICITATION NO.: RFP-N01DA-16-8931

AMENDMENT NO.: 01

EFFECTIVE DATE: June 02, 2016

ISSUED BY:

National Institute on Drug Abuse, NIH Office of Acquisitions NIDA R&D Contracts Management Branch 6001 Executive Boulevard Suite 4211 MSC 9559 Bethesda, Maryland 20892-9559

Point of Contact: Kenneth Janosko, Contract Specialist (E-mail: kenneth.janosko@nih.gov)

NAME AND ADDRESS OF CONTRACTOR: To All Offerors

The above numbered solicitation is amended as set forth below. The hour and date specified for receipt of Offers is NOT extended. Offerors must acknowledge receipt of this amendment on each copy of the offer submitted. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO

THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter, provided each letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

All other terms and conditions of the RFP remain unchanged.

DESCRIPTION OF AMENDMENT (Organized by UCF section headings, including solicitation contract subject matter where feasible.)

PURPOSE: To amend the RFP and to clarify the RFP requirements by responding to questions submitted. Unless specifically noted, all specifications remain unchanged.

Request for Proposal Amendment 01 N01DA-16-8931 Page 2 of 17

Part I. The RFP is amended as follows:

SECTION C – DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SUBSECTION 2. REPORTING REQUIREMENTS

PARAGRAPH b. 2. Information Security and Physical Access Reporting Requirements is amended to read:

The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract. Note: Each report listed below includes a reference to the appropriate subparagraph of this article.

a. Roster of Employees Requiring Suitability Investigations

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access, or host and/or maintain a Federal information system(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract. (Reference subparagraph A.d. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

b. IT Security Plan (IT-SP)

The contractor shall submit the IT-SP within thirty (30) days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

The Contractor shall review and update the IT-SP in accordance with NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations, on an annual basis.

(Reference subparagraph B.c.1. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

c. IT Risk Assessment (IT-RA)

The contractor shall submit the IT-RA within thirty (30) days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy.

N01DA-16-8931 Page 3 of 17

The Contractor shall update the IT-RA on an annual basis.

(Reference subparagraph B.c.2. of the INFORMATION AND PHYSICAL ACCESS

d. FIPS 199 Assessment

The Contractor shall submit a FIPS 199 Assessment within thirty (30) days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard.

(Reference subparagraph B.c.3. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECITON H of this contract.)

e. Reporting of New and Departing Employees

The Contractor shall notify the Contracting Officer's Representative (COR) and Contracting Officer within five working days of staffing changes for positions that require suitability determinations as follows:

a. New Employees who have or will have access to HHS Information systems or data: Provide the name, position title, e-mail address, and phone number of the new employee. Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

b. Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in the "Employee Separation Checklist", attached in Section J.

ATTACHMENTS of this contract, when a Contractor/Subcontractor employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

(Reference subparagraph C.3.a-c. of the INFORMATION AND PHYSICAL ACCESS

f. Contractor - Employee Non-Disclosure Agreement(s)

The contractor shall complete and submit a signed and witnessed "Commitment to Protect Non-Public Information - Contractor Agreement" form for each contractor and subcontractor employee who may have access to non-public Department information under this contract. This form is located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/ Nondisclosure.pdf.

(Reference subparagraph C.3.d. of the INFORMATION AND PHYSICAL ACCESS

N01DA-16-8931 Page 4 of 17

SECTION F – DELIVERIES OR PERFORMANCE

SUBSECTION 2. DELIVERIES

PARAGRAPH b. is amended to read:

The above items shall be addressed and delivered to:

Item Description Qty. Delivery Date Place of Delivery

(1) Draft Individual Study/Task

Report* 2 Within 15 business days of study completion

COR

(2) Final Individual Study/Task Report*

3 Within 5-10 business days after receiving comments from Project Officer

COR

(3) Monthly Progress Reports*

2 Within 5 days of end of each calendar month

COR

(4) Annual Progress Reports*

5 Within 15 days of end of contract year

4 to COR, 1 to CO

(5) Final Contract Report*

5 On or before end of contract 4 to COR, 1 to CO

(6) All data, etc. in accordance with "End of Contract" special requirements

-- On or before contract expiration

To be designated by COR

(7) Reporting of Financial Conflict of Interest (FCOI)

1 See Article C.2(b)(1) CO

(8) Final Invention Statement 1 On or before end of contract

CO

(9) FIPS 199 Assessment 2 30 calendar days after contract award

1 to COR, 1 to CO

(10) Roster of Employees Requiring Suitability Investigations

2 14 days after contract award; 15 calendar days after staffing revisions

1 to COR, 1 to CO

(11) Information Security Training Report

1 Within 3 months of contract award COR

(12) Reporting of New and Departing Employees

2 Within 5 days of any staffing changes

1 to COR, 1 to CO

(13) Contractor-Employee Non- Disclosure Agreement(s)

1 14 days after contract award; 15 calendar days after staffing revisions

COR

(14) IT Security Plan (IT-SP) 2 30 calendar days after contract award and updated annually from contract award date

1 to COR, 1 to CO

(15) IT Risk Assessment (IT-RA)

2 30 calendar days after contract award and updated annually from contract award date

1 to COR, 1 to CO

* One electronic copy of the report shall also be provided to the COR. The electronic files shall be in the form of a Microsoft Word document and a PDF format preferably on a CD.

N01DA-16-8931 Page 5 of 17

Hard copies of the above items shall be addressed and delivered to:

Contracting Officer's Representative (COR) National Institute on Drug Abuse Division of Therapies and Medical Consequences (DTMC) 6001 Executive Boulevard, Room 4123, MSC 9551 Bethesda, MD 20892-9551

Contracting Officer (CO) National Institute on Drug Abuse NIDA R&D Contracts Management Branch 6001 Executive Boulevard, Room 4211, MSC 9559 Bethesda, MD 20892-9559

SECTION H – SPECIAL CONTRACT REQUIREMENTS

SUBSECTION 12. INFORMATION AND PHYSICAL ACCESS SECURITY is amended to read:

A. HHS-Controlled Facilities and Information Systems Security

a. To perform the work specified herein, Contractor personnel are expected to have routine

(1) physical access to an HHS-controlled facility; (2) physical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

b. To gain routine physical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-05-24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigations procedures contained in the following documents:

1. HHS-OCIO Information Systems Security and Privacy Policy ( http://www.hhs.gov/ocio/policy/#Security)

2. HHS HSPD-12 Policy Document, v. 2.0 ( http://www.whitehouse.gov/sites/default/files/omb/assets/ omb/memoranda/fy2005/m05-24.pdf)

3. Information regarding background checks/badges ( http://idbadge.nih.gov/background/index.asp)

c. Position Sensitivity Levels:

This contract will entail the following position sensitivity levels:

N01DA-16-8931 Page 6 of 17

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

d. The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions - i.e., those above non-sensitive, require more extensive documentation and investigation.

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to access and/or maintain a Federal Information System(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days after the effective date of the contract. The Contracting Officer shall notify the Contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_ 10-15-12.xlsx.

Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

e. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR

N01DA-16-8931 Page 7 of 17

52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

f. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

g. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

h. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

i. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

B. Security Requirements For Federal Information Technology Resources

a. Applicability. This clause applies whether the entire contract or order (hereafter "contract"), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term "information technology (IT)", as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

b. Contractor responsibilities. The Contractor is responsible for the following:

1. Protecting Federal information and Federal information systems in order to ensure their –

a. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

b. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

N01DA-16-8931 Page 8 of 17

c. Availability, which means ensuring timely and reliable access to and use of information.

2. Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

3. Adopting, and implementing, at a minimum, the policies, procedures, controls and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

c. Contractor security deliverables. In accordance with the timeframes specified, the

Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance.

1. IT Security Plan (IT-SP) - due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

a.The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the EGovernment Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

i. Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automation Information Resources.

ii. National Institutes of Standards and Technology (NIST) Special

Publication (SP) 800-18, Guide for Developing Security Plans for Information Systems, in form and content, and RFP Number :

N01DA-16-8931 with any pertinent contract Statement of Work/Performance Work Statement (SOW/ PWS) requirements.

The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the

N01DA-16-8931 Page 9 of 17 requirements of Federal Information Processing Standard (FIPS) 200, Recommend Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

iii. HHS-OCIO Information Systems Security and Privacy Policy.

2. IT Risk Assessment (IT-RA) - due within 30 days after contract award. The IT-

RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

3. FIPS 199 Standards for Security Categorization of Federal Information and

Information Systems Assessment (FIPS 199 Assessment) - due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

d. Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in "HHS-Controlled Facilities and Information Systems Security" requirements specified in the SOW/PWS of this contract.

e. Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

f. Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), N01DA-16-8931 Page 10 of 17 investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

g. Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that -

1. Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

2. Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

h. Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

i. Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

j. Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

k. Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

Note: The NIST Special Publication SP-800-26 cited in subparagraph c.1.a.(ii) of this clause has been superseded by NIST SP 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations" for use for the assessment of security control effectiveness. See http://csrc.nist.gov/publications/PubsSPs.html to access NIST Special Publications (800 Series).

C. Additional NIH Requirements

1. SECURITY CATEGORIZATION OF FEDERAL INFORMATION AND

INFORMATION SYSTEMS (FIPS 199 Assessment)

a. Information Type:

[ ] Administrative, Management and Support Information:

N01DA-16-8931 Page 11 of 17

[X] Mission Based Information: Research and Development Information Type

b. Security Categories and Levels:

Confidentiality Level: [X] Low [ ] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [X] Low [ ] Moderate [ ] High Overall Level: [ ] Low [X] Moderate [ ] High

c. The contractor shall submit a FIPS 199 Assessment within 30 days after contract award. Any differences between the contractor's assessment and the information contained herein, will be resolved, and if required, the contract will be modified to incorporate the final FIPS 199 Assessment.

2. INFORMATION SECURITY TRAINING

The contractor shall comply with the below training:

a. Mandatory Training

1. All Contractor employees having access to (1) Federal information or a Federal information system or (2) sensitive data/information, shall complete the NIH Computer Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, Contractor employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

2. The Contractor shall maintain a listing by name and title of each Contractor/Subcontractor employee working on this contract and having access of the kind in paragraph 1.a(1) above, who has completed the NIH required training. Any additional security training completed by the Contractor/Subcontractor staff shall be included on this listing. The list shall be provided to the COR and/or Contracting Officer upon request.

b. Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance about "NIH Information Security Awareness and Training Policy," at:

https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final- InfoSecAwarenessTrainPol.doc.

N01DA-16-8931 Page 12 of 17

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this contract. The list shall be provided to the COR and/or Contracting Officer upon request.

c. Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior ( https://ocio.nih.gov/InfoSecurity/ training/Pages/nihitrob.aspx), which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov.

3. PERSONNEL SECURITY RESPONSIBILITIES

The contractor shall comply with the below personnel security responsibilities:

a. The Contractor shall notify the Contracting officer and the COR within five working days before a new employee assumes a position that requires access to HHS information systems or data, or when an employee with such access stops working on this contract. The Government will initiate a background investigation on new employees assuming a position that requires access to HHS information systems or data, and will stop pending background investigations for employees that no longer work under the contract or no longer have such access.

b. New contractor employees who have or will have access to HHS information systems or data: The Contractor shall provide the COR with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and position sensitivity level held by the former incumbent.

If an employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate position sensitivity level.

c. Departing contractor employees: The Contractor shall provide the COR with the name, position title, and position sensitivity level held by or pending for departing employees. The Contractor shall perform and document the actions identified in the Contractor Employee Separation Checklist ( https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/ Emp-sep-checklist.pdf) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the COR upon request.

d. Commitment to Protect Non-Public Departmental Information and Data.

N01DA-16-8931 Page 13 of 17

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- Public Law 96-511 (Paperwork Reduction Act)

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/N ondisclosure.pdf. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the COR prior to performing any work under this acquisition.

4. LOSS AND/OR DISCLOSURE OF PERSONALLY IDENTIFIABLE

INFORMATION (PII) - NOTIFICATION OF DATA BREACH

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team (IRT) via email ( IRT@mail.nih.gov ) within one hour of discovering the incident. The Contractor shall follow up with IRT by completing and submitting one of the applicable two forms below within three (3) work days of incident discovery:

NIH PII Spillage Report at:

https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.do c

NIH Lost or Stolen Assets Report at:

https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device- Media_Handling_Procedures.doc

The due date of proposals submission of June 27, 2016 is unchanged as stated in the Request for Proposal Package.

N01DA-16-8931 Page 14 of 17

PART II. The following responds to questions received under this solicitation.

Q001. The Contract says that this is a non-clinical ADME contract but also stated that the bioanalytical method has to be GLP compliant. Since FDA does not require bioanalysis to be GLP compliant for preclinical ADME studies, it is unclear why this is needed. Is it also used to analyze FDA compliant TOX study samples?

A001. Validations performed under Task 1 that are either for toxicology or human studies should be GLP-compliant as per the FDA Guidance for Industry: Bioanalytical Method Validation (May 2001).

Validations used for Tasks 2 (BA/PK studies) and 3 (ADME studies) should be done in-the-spirit of GLP, using the FDA regulations as a guidance. Documentations should be done so that a reviewer can follow what was done and why decisions were made.

The bioanalysis in Task 5 is to be GLP-compliant as per FDA regulations if the samples are generated from a toxicology study. Samples from human studies should be done under the appropriate FDA regulations for human samples.

Samples from other studies that are not toxicology studies should be done in-the-spirit of GLP, using the FDA regulations as guidelines as to how the analysis is to be conducted. Documentations should be done so that a reviewer can follow what was done and why decisions were made.

Q002. Is there a page limit for the Technical Proposal and Business Proposal?

A002. There is no page limit for the Technical and Business Proposals.

Q003. Are there limits on the number of appendices that can be submitted?

A003. There is no limit on the number of appendices that can be submitted.

Q004. For in vitro metabolism studies, do they include the following:

1. apparent clearance determination

2. metabolic pathway identification

3. metabolite identification

4. metabolite reference standard synthesis or biosynthesis

5. interspecies differences in metabolism

6. drug-drug interaction: inhibition

7. drug-drug interaction: induction

8. efflux transporter identification

A004. There will be no in vitro studies looking at the items listed above with the exception of #8 (efflux transporter identification).

The in vivo ADME studies (Tasks 2 and 3) list the relevant PK parameters that should be calculated (eg, t½, AUC, CL if IV dose or CL/F if oral). We are asking for the normal PK parameters using non-compartmental analysis.

Task 4 consists of calculations using concentrations supplied by NIDA.

N01DA-16-8931 Page 15 of 17

Task 5 consists of assay of samples that are sent from another lab.

For Task 6, the transporters to be studied will be indicated by NIDA in discussion with the CRO.

Task 7 is as described.

Q005. For elimination, is there the need to identify the efflux transporters involved in the disposition of the molecules?

A005. Information on the elimination of a drug or its metabolites generated in Tasks 2 and 3 will be used to determine if there is a need to identify efflux transporters. If it is determined that there is a need, it will be studied in a separate task order under Task 6 of the RFP.

Q006. For costing purposes, please clarify which specific tasks (Tasks 1 to 7) in the SOW will need to be performed under FDA’s guidelines for GLP studies, and which do not.

A006. Tasks 1 and 5 should be GLP-compliant as per FDA guidelines for GLP studies if the samples are from a toxicology study. Samples from human studies should be analyzed under the appropriate FDA guidelines, as indicated In A001 above.

The other tasks should be performed in-the-spirit of GLP regulations. Documentations should be done so that a reviewer can follow what was done and why decisions were made.

Q007. The proposed allocation of 1.2 hr for Task 5 (Quantification of Potential Medication and Metabolites) seems very low; hence, please confirm that we can justify an appropriate number of labor hours based on our experience for each task, with a total of 1,511 hr for all nine tasks.

A007. The cost listed for Task 5 is the approximate time and cost per sample.

Q008. A task order has been included in Attachment 21 for Statement of Work Task Area 2.

Please clarify if we also need to provide a separate technical and business proposal for this task order or do we provide technical and cost information only for the tasks outlined in the SOW (Attachment 3).

A008. All Offerors’ Technical Proposals should respond to the Statement of Work included in the Solicitation as Attachment 3 indicating the approach for each task. Offerors should provide a separate technical and pricing proposal based on the Sample Task Order included in the Solicitation as Attachment 21.

Q009. Please clarify if all the nine task areas are to be priced just for Year 1 or do we price them each year for the five years of the contract. Do we price each of the nine task areas one time per year or price per specific quantities (to be provided by NIDA) per year.

A009. Offerors should only perform pricing for the Sample Task Order included in the Solicitation as Attachment 21.

N01DA-16-8931 Page 16 of 17

Q010. Article I.3a.8 52.227.14 P.32. Will the Government confirm that Alternate IV will be made part of the contract? Without this modification, we will not have the right to copyright protection as is typically required for research activities at universities.

A010. Per FAR 27.409(b)(5), FAR 52.227-14 -- Rights in Data – General (Alternate IV) would be incorporated if the successful offeror proposes that research under the resulting contract be performed solely by a university or college. Note that the restrictions of FAR 52.227-17 would still apply.

Q011. Article I.3a.9 52.227.17 P.32. Incorporation of this clause will restrict the publication of the research results and such clause will prevent us from submitting a proposal. Will the Government eliminate this restrictive clause?

A011. To protect the rights of collaborating parties and to promote the rapid, efficient, and cost effective development and commercialization of compounds for the treatment of substance abuse, NIDA must restrict the successful offeror's rights in subject inventions and data. The successful Offeror will be required to perform confidential screening of potential treatments that may be proprietary in nature. Allowing publication may adversely affect the ability of collaborators to obtain patent protection. As such, any potential publication would need to be approved by the contracting officer in accordance with FAR 52.227-17(d) and HHSAR 352.227-14(d).

Q012. Article I.6. P.45 Will the Government exclude the Service Contract Labor Standards from contracts with universities? University professional employees are not subject to the Service Contracts Labor Standards Act.

A012. All Offerors should complete and submit FAR 52.222-52 – Exemption From Application of the Service Contract Labor Standards to Contracts for Certain Services

– Certification (May 2014) and submit with the Representations and Certifications listed in Attachment 4 of the Solicitation. Per FAR 52.222-52(b), a positive certification and a determination by the Contracting Officer that the Service Contracting Act does not apply will result in inclusion of FAR Clause 52.222-53 – Exemption From Application of the Service Contract Labor Standards to Contracts for Certain Services – Requirements (May 2014) in place of the Solicitation language in Article I.6.

Q013. Will the government allow a proposal that contains percent of effort by individuals instead of labor hours? Our effort management system can capture and certify percent of effort, not labor hours.

A013. Yes. Please note that a successful offeror’s accounting system will need to meet CAS standards (see Attachment 4, Section 4, Cost Accounting Standards Notices and Certification (October 2015), FAR Provision 52.230-1)

Q014. Section L,2.a.7. P.55 Will the government confirm that discussions will be permitted with the potential awardee?

A014. Per Section L, Article 1 a.(f)(4), the Government intends to award a contract without discussions. Discussions may be held if the Contracting Officer determines them to be necessary.

N01DA-16-8931 Page 17 of 17

Q015. Is it possible to use an internal site within our proposal as a firm fixed price cost if the bulk of our proposal is cost reimbursement?

A015. Yes.

END OF AMENDMENT 01