RFP_N02PC85015-34_07.27.18(with_PDF-Att).pdf

- 1 -

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: Public Law 92-218 as amended

2. Request for Proposal (RFP) Number:

N02PC85015-34

3. Issue Date:

July 27, 2018

4. Set Aside:

[X] No

[ ] Yes See Part IV Section L

5. Title : Scientific and Technical Services for the Automated Self-Administered 24-hour (ASA24) Dietary Assessment System

6. ISSUED BY:

Office of Acquisitions (OA) National Cancer Institute (NCI) National Institutes of Health (NIH) Dept. of Health and Human Services (DHHS) 9609 Medical Center Drive, Room 1E640

MSC 9705

Bethesda, MD 20892-9705

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposal," until 3:00PM EST local time on August 27, 2018. Offers will be valid for 120 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING AND DELIVERY OF THE PROPOSAL." If proposals are required to be delivered to two different locations, the OFFICIAL POINT OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF ACQUISITIONS.

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors--Competitive Acquisition," LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) prior to award of a contract. Offerors must access the CCR through The System for Award Management (SAM) at http://www.sam.gov

11. FOR INFORMATION CALL: Linda Park, Contracting Officer

PHONE: 240-276-7655

e-MAIL: linda.park@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

Submit all questions in writing to: linda.park@nih.gov. Responses to questions will be provided via Amendment to the Solicitation. Questions received after 3:00PM EST on August 13, 2018 may not be addressed.

Linda Park Contracting Officer

PCPSB

Office of Acquisitions, NCI, NIH, DHHS http://www.sam.gov

RFP Number : N02PC85015-34

- 2 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. BRAND NAME OR EQUAL

e. COMMITMENT OF PUBLIC FUNDS

f. COMMUNICATIONS PRIOR TO CONTRACT AWARD

g. RELEASE OF INFORMATION

h. PREPARATION COSTS

i. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

5. Alternate Proposals

6. Evaluation of Proposals

7. Potential Award Without Discussions

8. Use of the Metric System of Measurement

9. Specific Copyright Provisions Applicable to Software Development and/or Enhancement(s)

10. Privacy Act - Treatment of Proposal Information

11. Selection of Offerors

- 3 -

12. Certification of Filing and Payment of Taxes

13. Past Performance Information

15. Electronic Information Technology Accessibility Notice, HHSAR 352.239-73 (December 2015)

16. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

4. Obtaining and Disseminating Biomedical Research Resources

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Information Other than Cost or Pricing Data

4. Requirements for Cost or Pricing Data or Information Other than Cost and Pricing Data

5. Salary Rate Limitation

6. Small Business Subcontracting Plan

7. Mentor Protege Program, HHSAR 352.219-70

8. HUBZone Small Business Concerns

9. Total Compensation Plan

10. Other Administrative Data

11. Qualifications of the Offeror

12. Subcontractors

13. Proposer's Annual Financial Report

14. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. EVALUATION OF OPTIONS

4. TECHNICAL EVALUATION FACTORS

5. EVALUATION OF ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY- SECTION

6. PAST PERFORMANCE FACTOR

- 4 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The Contractor shall provide services to support, update, maintain, further develop, and refine the existing Automated Self-Administered 24-hour Dietary Assessment System (henceforth referred to as the ASA24 System or System).

The tasks involve keeping the software current (such as updating technology systems as needed, and updating food list, nutrient, food group and supplement databases), supporting users, adding new features, and running a functioning user-friendly and Section 508-compliant ASA24 System for Respondents and Researchers. The System requires nutrition knowledge, to use and manipulate multiple dietary intake databases and systems as well as dietary assessment research methods for population-based research. The System is comprised of: 1) A Respondent website that is device responsive to mobile technology. It includes versions in multiple languages for the United States, Canada and Australia and could include other potential population- or country-specific versions in the future; 2) A Researcher website; and 3) An informational website. The System includes help documents in multiple languages.

ARTICLE B.2. PRICES/COSTS

a. This is an Indefinite Quantity contract as contemplated by FAR 16.504. The Contractor shall be reimbursed by the Government in an amount not less than a total of $10,000 (minimum) nor more than a total of $9,900,000 (maximum) for successful performance of this contract.

b. The costs set forth in this ARTICLE will cover the [anticipated] contract period February 16, 2019 through February 15, 2024.

c. The Government will issue Task Orders based on the work described in SECTION C of this contract.

ARTICLE B.3. PROVISIONS APPLICABLE TO DIRECT COSTS

This article will prohibit or restrict the use of contract funds, unless otherwise approved by the Contracting Officer. The following is a list of items that may be included in the resultant contract as applicable. 1) Conferences & Meetings, 2) Food for Meals, Light Refreshments & Beverages, 3) Promotional Items, 4) Acquisition, by purchase or lease, of any interest in real property; 5) Special rearrangement or alteration of facilities; 6) Purchase or lease of any item of general purpose office furniture or office equipment regardless of dollar value; 7) Travel Costs including Foreign Travel; 8) Consultant Costs; 9) Subcontract Costs; 10) Patient Care Costs; 11) Accountable Government Property; 12) Printing costs; and 13) Research Funding.

- 5 -

ARTICLE B.4. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

- 6 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. DESCRIPTION-SPECIFICATION- STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated July 27, 2018, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

b. The applicable Privacy Act System of Records Number will be specified and shall be used in any design, development, or operation work to be performed under the resultant contract. Disposition of records shall be in accordance with SECTION C of the contract, and by direction of the Contracting Officer's Representative (COR).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format via email as attachments to the following designated NCI Branch Distribution Mailbox: ncibranchbinvoices@mail.nih.gov.

Each email submission shall contain only one deliverable. If the attached file for the deliverable exceeds 50 MB, the Contractor shall divide the deliverable into files of 50 MB each. All deliverables shall be limited to five file attachments or less.

The subject line of the email and file attachment name shall read as follows:

Deliverable_ContractNumber_TaskOrderNumber_Vendor'sName_DeliverableDescription_DueDate

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible." All paper/ hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30% post consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

a. Technical Progress Reports

1. In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract and/or task order resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award. [Note: Beginning May 25, 2008, the Contractor shall include the applicable PubMed Central or NIH Manuscript Submission reference number when citing publications that arise from its NIH funded research.]

A. Monthly Task Order Progress Report

The Contractor shall provide Monthly Task Order Progress Reports. These reports shall include, but are not limited to:

i. Progress in the past month for each Statement of Work area;

ii. Deliverables that have been completed, the completion date, and all source code related to that deliverable;

http://www.hhs.gov/web/508/index.html

- 7 -

iii. Deliverables in progress and whether or not these projects are on schedule;

iv. Funds spent on individual projects throughout the month;

v. Whether any problems were encountered in the collection, handling or processing of data, including resolution of the problems;

vi. Suggestions for solutions to problems and operational improvements;

vii. Discussion of progress, accomplishments, and plans for future work;

viii. Log of bug reports and ASA24 System breakdowns, action taken to resolve each one, and/or proposed plan with timeline for resolution of problem;

ix. Usage report that includes studies registered, number of days of intake data collected, by month, by version, by recall vs. record;

x. Vulnerability Scanning report of on all systems being used.

The first reporting period consists of the first full month of performance plus any fractional part of the initial month. Thereafter, each reporting period shall consist of one (1) calendar month. An electronic copy of the report shall be delivered within a fifteen (15) calendar days of the end of each reporting period. The Monthly Progress Report is not required for the month that the Annual Progress Report is due.

B. Annual Task Order Progress Report

The Contractor shall provide Annual Task Order Progress Reports. These reports shall include, but are not limited to, a summary of:

i. Progress in the past year for each Statement of Work area;

ii. Deliverables that have been completed, the completion date, and all source code and documentation related to that deliverable;

iii. Deliverables in progress and whether or not these projects are on schedule;

iv. Funds spent on individual projects throughout the year;

v. Whether any problems were encountered in the collection, handling or processing of data, including resolution of the problems;

vi. Suggestions for solutions to problems and operational improvements;

vii. Updated Probebuilder database;

viii. Log of all portion size images and modifications to the ASA24 image database;

ix. Quality Control Plan for the food probe, food term and image databases used in conjunction with the ASA24 Respondent User software;

x. Software Evaluation Plan to evaluate ASA24 System performance for purposes of improving and updating software.

Each reporting period shall consist of a twelve (12) month period, and the report shall be due fifteen (15) calendar days following the reporting period. An Annual Report will not be required for the period when the Final Report is due.

- 8 -

C. Draft Final Task Order Progress Report

The Contractor shall provide a Draft Final Task Order Progress Report to include a summation of the work performed for the entire task order period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved. This report shall include all of the items required in the Final Task Order Progress Report deliverable.

Sixty (60) calendar days prior to the expiration date of the task order, the Contractor shall provide a Draft Final Task Order Progress Report. The Draft Final Task Order Progress Report shall also include, as appropriate, any databases.

D. Final Task Order Progress Report

The Contractor shall provide a Final Task Order Progress Report to include a summation of the work performed for the entire task order period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved. This report shall include:

i. Progress in the entire period of performance for each Statement of Work area;

ii. Detailed listing of each deliverable that has been completed, its contents, the completion date, and all source code and documentation related to that deliverable;

iii. Documentation developed/updated during performance, including databases, specifications;

iv. Funds spent on individual projects;

v. Whether any problems were encountered in the collection, handling or processing of data, including resolution of the problems;

vi. Suggestions for solutions to problems and operational improvements;

vii. Any other information specifically requested by the Contracting Officer's Representative, or which the Contractor determines to be relevant to the project.

After incorporating comments received from the Government to the Draft Final Task Order Progress Report, the Contractor shall submit the Final Report prior to the expiration date of the task order. The Final Task Order Progress Report shall also include, source coding and databases.

b. Other Reports/Deliverables

1. Source Code and Object Code

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract and task orders, if specified, all source code and object code developed, modified, and/or enhanced under this contract.

2. Transition-In Plan

a. The Contractor shall submit a draft Transition-In Plan to occur no later than thirty (30) days from the effective date of the task order. The draft Transition-In Plan shall include a timeline of how all necessary manuals, databases, specifications, source code, documentation, software, and all

- 9 -other associated ASA24 System elements will be obtained and implemented to provide continuous uninterrupted performance of the ASA24 System. The Contractor shall also indicate how it will implement all elements of the current system and database architecture to be transferred from the Government, or its designee, at the time of transition, along with all existing developed programs, source codes, system documentation, working papers, and all related information gathered or developed during the previous contract's period of performance.

b. Within fifteen (15) calendar days of receipt of comments from the Government regarding the draft Transition-In Plan, the Contractor shall submit a Final Transition-In Plan and implement the Plan into action.

3. Project Plans

The Contractor shall submit Project Plans for individual projects within a deadline as agreed upon by the Contracting Officer's Representative. Plans shall include a detailed approach, draft outline of the project with deadlines established for document review and corrections. In consultation with the COR, the final project plan shall be delivered with final delivery of the project, accomplishments, and all associated project deliverables, not limited to source code, specifications, documentation, and databases.

4. Publications Database

The Contractor shall provide the database of publications using of ASA24 in data collection, and update the publications webpage on NCI informational website, every three (3) months of performance, unless otherwise specified by the COR.

5. Transition-Out Plan

a. The Contractor shall submit a Draft Transition-Out Plan six (6) months prior to the expiration of the contractand/or task order. The draft Transition-Out Plan shall include all manuals, specifications, databases, source code,documentation, software, and all other associated elements necessary to continue the performance of the ASA24System. The Contractor shall also indicate all elements of the then-current database architecture to be transferred tothe Government, or its designee, at the time of transition, along with any newly developed programs, source codes,system documentation, working papers, and all related information gathered or developed during the contract's periodof performance.

b. Within thirty (30) calendar days of receipt of comments from the Government regarding the draft Transition-OutPlan, the Contractor shall submit a Final Transition-Out Plan.

HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

INFORMATION AND/OR PHYSICAL SECURITY

The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.

A. IT Risk Assessment (IT-RA) - The Contractor shall submit the IT-RA within thirty (30) days after task order award, unless otherwise specified by the COR. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. The Contractor shall update the IT-RA on an annual basis.

(Reference the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

- 10 -

B. Roster - The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this contract.

Any revisions to the roster as a result of staffing changes shall be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. Reference the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract for additional instructions. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/ Documents/SuitabilityRoster_10-15-12.xlsx

C. Reporting of New and Departing Employees - The Contractor shall notify the Contracting Officer's Representative (COR) and Contracting Officer within five (5) business days, or as otherwise specified, of staffing changes for positions that require suitability determinations as follows: (Reference the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract for additional instructions):

i. New Employees: who have or will have access to HHS Information systems or data: Provide the name, position title, e-mail address, and phone number of the new employee. Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

ii. Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in the "Employee Separation Checklist", attached in Section J, ATTACHMENTS of this contract, when a Contractor/ Subcontractor employee terminates work under this contract within two (2) business days of the employee's exit from the contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

D. Project/Inventory/ Package System Reports -

i. Project System Report - due as requested by the COR. The Contractor shall provide a report which shall consist of written summaries of the high points undertaken during the project. The report shall should have a beginning target date, intermediate milestones, and a final disposition of the project. Tools such as Gantt charts, milestone development, important features and other project descriptions.

ii. Inventory System Report - due as requested by the COR. The Contractor shall provide a completed itemization of the entire repository inventory. This report shall include: quantities, manufacturer's, expiration date, and most recent testing.

iii. Package Tracking System - due as requested by the COR. The Contractor shall utilize the tracking system to ensure that all materials are delivered only to the intended recipient. In addition, complete logistic tracking for disposition of all materials.

E. Security Assessment and Authorization (SA&A) - A valid Authority To Operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) shall work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) as agreed upon by the COR. The SA&A shall be completed and the system shall be authorized in writing by the federal Authorizing Official (AO) prior to the system going live (i.e., into production mode). The Contractor shall conduct the SA&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision). For an existing ATO, Contracting Officer Representative will make a determination if the existing ATO provides appropriate safeguards or if an additional ATO is required for the performance of the contract and state as such.

NIH acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

SA&A Package Deliverables - The Contractor (and/or any subcontractor) shall provide an SA&A package within ninety (90) calendar days of task order award, unless otherwise specified by the COR. For new systems, the SA&A Package shall be submitted prior to the system going live, within the specified timeline as agreed upon with the COR. The Contractor shall ensure the Package receives formal authorization from https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

- 11 -the federal AO prior to the system going live. SA&A deliverables should be submitted as a complete package when possible, but may also be submitted as completed to expedite the approval process. The following SA&A deliverables are required to complete the SA&A package:

i. System Security Plan (SSP) - due within ninety (90) calendar days after task order award, unless otherwise specified by the COR. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and NIH policies and other guidance. The SSP shall be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

ii. Security Assessment Plan/Report (SAP/SAR) - due ninety (90) calendar days after the task order award, unless otherwise specified by the COR. The security assessment shall be conducted by the assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and NIH policies. The assessor will document the assessment results in the SAR.

iii. FIPS 199 Assessment - due within thirty (30) days after task order award, unless otherwise specified by the COR. The FIPS 199 Assessment shall be consistent with the cited NIST standard. (Reference subparagraph D.c.3. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECITON H of this contract.

The NIH should determine which security control baseline applies and then make a determination on the appropriateness/necessity of obtaining an independent assessment. Assessments of controls can be performed by contractor, government, or third parties, with third party verification considered the strongest.

If independent assessment is required, include statement below. Thereafter, the Contractor, in coordination with the NIH shall conduct/assist in the assessment of the security controls and update the SAR at least annually.

iv. Independent Assessment - due ninety (90) calendar days after the task order award, unless otherwise specified by the COR. The Contractor (and/or subcontractor) shall have an independent third-party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. All remaining deficiencies must be documented in a system Plan of Actions and Milestones (POA&M).

F. Plan of Action and Milestones (POA&M) - due ninety (90) calendar days after task order award, unless otherwise specified by the COR. The POA&M shall be documented consistent with the HHS Standard for Plan of Action and Milestones and NIH policies. All high-risk weaknesses must be mitigated within thirty

(30) calendar days and all medium weaknesses must be mitigated within sixty (60) calendar days from the date the weaknesses are formally identified and documented. The NIH will review the provisional risk ratings assigned by the assessor and determine if they are appropriate based on the data provided in the SAR. The NIH may recommend that provisional risk ratings be adjusted and/or closed before the POA&M is accepted, if mitigating factors warrant. Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, shall be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, NIH may require designated POAM weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M shall be updated at least quarterly.

G. Contingency Plan and Contingency Plan Test - due ninety (90) calendar days after task order award. The Contingency Plan must be developed in accordance with NIST SP 800-34, Contingency Planning Guide for Federal Information Systems, and be consistent with HHS and NIH policies. Upon acceptance by the System

- 12 -

Owner, the Contractor, in coordination with the System Owner, shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. Thereafter, the Contractor shall update and test the Contingency Plan at least annually.

H. E-Authentication Questionnaire - due thirty (30) calendar days after task order award, unless otherwise specified by the COR. The contractor (and/or any subcontractor) shall collaborate with Government personnel to ensure that an E-Authentication Threshold Analysis (E-Auth TA) is completed to determine if a full E- Authentication Risk Assessment (E-Auth RA) is necessary. System documentation developed for a system using E-Auth TA/E-Auth RA methods shall follow OMB 04-04 and NIST SP 800-63, Rev. 2, Electronic Authentication Guidelines. Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

I. Business Impact Analysis (BIA) - (Note: BIA content may be documented directly in Information System Contingency Plan) - due within thirty (30) calendar days after task order award, unless otherwise specified by the COR. A Business Impact Analysis predicts the consequences of disruption of a business function and process and gathers information needed to develop recovery strategies. Potential loss scenarios should be identified during a risk assessment. Operations may also be interrupted by the failure of a supplier of goods or services or delayed deliveries. There are many possible scenarios which should be considered. Identifying and evaluating the impact of disasters on business provides the basis for investment in recovery strategies as well as investment in prevention and mitigation strategies.

J. Privacy Impact Assessment (PIA) - due within sixty (60) calendar days after task order award, unless otherwise specified by the COR. A Privacy Impact Assessment, or PIA, is an analysis of how personally identifiable information is collected, used, shared, and maintained. The purpose of a PIA is to demonstrate that program managers and system owners have consciously incorporated privacy protections throughout the development life cycle of a system or program. PIAs are required by the E-Government Act of 2002, which was enacted by Congress to improve the management and promotion of Federal electronic government services and processes.

K. Configuration Management Plan (CMP) - due within ninety (90) calendar days after task order award, unless otherwise specified by the COR. A Configuration Management establishes the technical and administrative direction and surveillance for the management of configuration items (i.e., software, hardware, and documentation) associated with an information system that are to be placed under configuration control.

L. Contractor Non-Disclosure Agreement (NDA) - Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf, as applicable.

A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer and/or CO Representative prior to performing any work under this acquisition.

M. Vulnerability Scanning Reports - The Contractor shall report the results of the required monthly special vulnerability scans no later than fifteen (15) calendar days following the end of each reporting period. If required monthly, this report may be included as part of the Monthly Task Order Progress Report. Otherwise, this report shall be submitted under a separate cover on monthly basis.

6. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer's Representative (COR). The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/web/508/ contracting/technology/vendors.html under "Vendor Information and Documents."

http://www.hhs.gov/web/508/contracting/technology/vendors.html http://www.hhs.gov/web/508/contracting/technology/vendors.html

- 13 -

7. Service Contract Report (SCR)

In accordance with FAR clause 52.204-15, Service Contract Reporting Requirements for Indefinite Delivery Contracts, the Contractor shall enter and submit the following Service Contract Report data elements into System for Award Management (SAM), with a copy to the Contracting Officer annually, by October 31st for services performed under this contract during the preceding Government fiscal year (October 1 - September 30). SCR data elements:

a. Contract Number.

b. The total dollar amount invoiced for services performed during the previous Government fiscal year under the contract.

c. Total number of Contractor direct labor hours expended on the services performed during the previous Government fiscal year.

d. Data reported by first-tier subcontractors that have provided services under this contract, as applicable.

1) First-tier Subcontract number (including subcontractor name and DUNS number).

2) The number of first-tier subcontractor direct-labor hours expended on the services performed during the previous Government fiscal year.

ARTICLE C.3. INVENTION REPORTING REQUIREMENT

All reports and documentation required by FAR Clause 52.227-13, Patent Rights-Ownership by the Government including, but not limited to, the invention disclosure report, the confirmatory license, and the Government support certification, shall be directed to the Division of Extramural Inventions and Technology Resources (DEITR), OPERA, OER, NIH, 6705 Rockledge Drive, Suite 310, MSC 7980, Bethesda, Maryland 20892-7980 (Telephone: 301-435-1986). In addition, one copy of an annual utilization report, and a copy of the final invention statement, shall be submitted to the Contracting Officer. The final invention statement (see FAR 27.303(b) (2)(ii)) shall be submitted to the Contracting Officer on the expiration date of the contract.

For fixed-price task orders: The annual utilization report shall be submitted in accordance with the DELIVERIES Article in SECTION F of this contract. Thereafter, reports shall be due on or before the TBD Calendar day following the reporting period. The final invention statement (see FAR 27.303(b)(2)(ii)) shall be submitted on the expiration date of the task order. All reports shall be delivered as specified in the task order.

If no invention is disclosed or no activity has occurred on a previously disclosed invention during the applicable reporting period, a negative report shall be submitted to the Contracting Officer as specified in the task order.

To assist contractors in complying with invention reporting requirements of the clause, the NIH has developed "Interagency Edison," an electronic invention reporting system. Use of Interagency Edison is required as it streamlines the reporting process and greatly reduces paperwork. Access to the system is through a secure interactive Web site to ensure that all information submitted is protected. Interagency Edison and information relating to the capabilities of the system can be obtained from the Web ( http://www.iedison.gov), or by contacting the Extramural Inventions and Technology Resources Branch, OPERA, NIH.

http://www.iedison.gov

- 14 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

- 15 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the Contracting Offiicer's Representative (COR) is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

Department of Health and Human Services National Institutes of Health National Cancer Institute 9609 Medical Center Drive Bethesda, MD 20892

USA

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 calendar days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

FAR Clause 52.246-5, Inspection of Services - Cost-Reimbursement (April 1984).

- 16 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

The [anticipated] period of performance of this contract shall be from February 16, 2019 through February 15, 2024.

ARTICLE F.2. DELIVERIES

Satisfactory performance of the final contract shall be deemed to occur upon performance of the work described in the Description Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the stated delivery schedule:

a. The items specified below as described in the REPORTING REQUIREMENTS Article in SECTION C of this contract will be required to be delivered F.o.b. Destination as set forth in FAR 52.247-35, F.o.b. DESTINATION, WITHIN CONSIGNEES PREMISES (APRIL 1984), and in accordance with and by the date(s) specified below, and any specifications stated in SECTION D, PACKAGING, MARKING AND SHIPPING, of this contract:

Item No. Deliverable Due Date Technical Progress Reports

1 Monthly Task Order Progress Reports Due no later than fifteen (15) calendar days following each full month, or as specified in the Task Order.

2 Annual Task Order Progress Reports Due no later than the thirty (30) calendar days following the anniversary date of each task order. The Annual Report is not required when the Final Task Order Progress Report is due.

3 Draft Final Task Order Progress Report Due sixty (60) calendar days prior to the expiration date the task order.

4 Final Task Order Progress Report including all source codes, documentation and databases needed to run the System.

Prior to the expiration date of the task order.

Other Reports/Deliverables 5 Draft Transition-In Plan Due no later than thirty (30) calendar days from the effective date of the task order.

6 Final Transition-In Plan Due fifteen (15) calendar days after receipt of COR comments on Draft Transition-In Plan.

7 Draft Transition-Out Plan Due six (6) months prior to the expiration date of the task order and/or contract.

8 Final Transition-Out Plan Due thirty (30) calendar days after receipt of COR comments on Draft Transition-Out Plan.

9 Project Plans for individual projects to include a draft outline of the project with deadlines, and final delivery of the project deliverables

Due by a deadline as agreed upon by the COR.

10 Publications Database Due every three (3) months, unless otherwise specified by the COR.

11 IT Risk Assessment (IT-RA) Due no later than thirty (30) calendar days after the effective date of the task order, unless otherwise specified by the COR, and annually thereafter.

12 Roster of Employees Requiring Suitability Investigations

Due no later than fourteen (14) calendar days the effective date of the task order. Roster revisions due to staffing changes are due within seven (7) calendar days of the change.

13 Reporting of New and Departing Employees Due no later than (5) business days after staffing changes.

- 17 -

14 Project/Inventory/ Package System Reports As requested by COR.

15 Security Assessment and Authorization

(SA&A)

Due within ninety (90) calendar days of task order award, unless otherwise specified by the COR.

16 System Security Plan (SSP) Due within ninety (90) calendar days after task order award, unless otherwise specified by the COR.

17 Security Assessment Plan/Report (SAP/SAR) Due ninety (90) calendar days after the task order award, unless otherwise specified by the COR.

Thereafter, the SAR shall be updated at least annually.

18 FIPS 199 Assessment Due within thirty (30) calendar days after task order award, unless otherwise specified by the COR.

19 Plan of Action and Milestones (POA&M) Due ninety (90) calendar days after task order award, unless otherwise specified by the COR. Thereafter, the POA&M shall be updated at least quarterly.

20 Contingency Plan and Contingency Plan Test Due ninety (90) calendar days after task order award, and annually thereafter.

21 E-Authentication Questionnaire Due thirty (30) calendar days after task order award, unless otherwise specified by the COR.

22 Business Impact Analysis (BIA) Due within thirty (30) calendar days after task order award, unless otherwise specified by the COR.

23 Privacy Impact Assessment (PIA) Due within sixty (60) calendar days after task order award, unless otherwise specified by the COR.

24 Configuration Management Plan (CMP) Due within ninety (90) calendar days after task order award, unless otherwise specified by the COR.

25 Contractor-Employee Non-Disclosure Agreement

Due prior to commencement of work.

26 Vulnerability Scanning Reports Due with Monthly Task Order Progress Report.

27 Independent Assessment Due ninety (90) calendar days after the task order award, unless otherwise specified by the COR.

28 Employee Separation Checklist Due no later than two (2) business days upon employee's exit.

29 Invention Report As applicable and specified in the task order.

30 List of Completion of Online Security

Awareness Training As requested by COR, or as otherwise specified.

31 Section 508 Annual Report Due no later than thirty (30) after the end of each twelve (12) month period.

32 Service Contract Report (SCR) Annually by October 31 st.

b. The above items shall be addressed and emailed to ncibranchbinvoices@mail.nih.gov. The following addresses are provided for general correspondence and other deliveries:

Address Deliverable Item No.

Contracting Officer

National Cancer Institute

Office of Acquisitions, Room 1E640

9609 Medical Center Drive, MSC 9705

Bethesda, MD 20892-9705

All items to be delivered to ncibranchbinvoices@mail.nih.gov, and specified in each task order.

mailto:ncibranchbinvoices@mail.nih.gov

- 18 -

Address Deliverable Item No.

COR

National Cancer Institute

Division of Cancer Control and Population Sciences

9609 Medical Center Drive, MSC 9705

Bethesda, MD 20892-9705

All items to be delivered to ncibranchbinvoices@mail.nih.gov, and specified in each task order.

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY

1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

https://www.acquisition.gov/?q=browsefar

- 19 -

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be specified prior to award.

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract.

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

To be Determined To be Determined

ARTICLE G.3. TASK ORDER PROCEDURE

This contract provides for the issuance of Task Orders on a negotiated basis as follows:

a. General

- 20 -

Only the Contracting Officer may issue Task Orders to the Contractor, providing specific authorization or direction to perform work within the scope of the contract and as specified in the Statement of Work. Unless specifically authorized by the Contracting Officer, the Contractor shall not commence work until a fully executed Task Order has been awarded. The Contractor may incur costs under this contract in performance of task orders and task order modifications issued in accordance with this ARTICLE.

No other costs are authorized unless otherwise specified in the contract or expressly authorized by the Contracting Officer.

b. Requesting Task Order Proposals.

The Contracting Officer or a designated individual may…