RFP_NIEHS2019-DNA-702.pdf

COMBINED SYNOPSIS/SOLICITATION

Synopsis:

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

The combined synopsis/solicitation number is NIHES2019- and is issued as a Request for Proposal (RFP). The combined synopsis/solicitation and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-02 May 2019. This solicitation is issued as a Small Business Set-Aside under NAICS 541714, Research & Development in Biotechnology (except Nanobiotechnology). The size standard is 1000 employees.

The information set forth in Section A - Solicitation/Contract form, herein contains important information for any offeror interested in responding to this solicitation. Any contract resulting from this solicitation will include in its Section A - Solicitation/Contract form, accounting, appropriation and general information applicable to the contract award.

The contract schedule set forth in Sections B through H, herein, contains contractual information pertinent to this solicitation. It is not an exact representation of the contract document that will be awarded as a result of this solicitation. The contract cost or price and other contractual provisions pertinent to the offeror (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) will be included in the resultant contract. The enclosed contract schedule is intended to provide the offeror with the necessary information to understand the terms and conditions of the resultant contract.

https://www.acquisition.gov/far/current/html/Subpart%2012_6.html#wp1088488 https://www.acquisition.gov/far/current/html/Subpart%2012_6.html#wp1088488

DNA Sequencing Services RFP No: NIEHS2019-DNA-702

SECTION A – SOLICITATON AND CONTACT FORM

1.Requisition or other Purchase Authority: FAR Part 13.5

2. Request for Proposal Number: NIEHS2019-DNA-702

3. Issue Date:

July 16, 2019

4. Set Aside:

[ ] No [ X] Yes, 100% Small Business Set-Aside

5. Title : DNA Sequencing Services for the NIEHS

6. NAICS: 541714, Research & Development in Biotechnology (except Nanotechnology, Size

Standard: 1000 employees 7.a. ISSUED BY:

Kristina Filardo, Contract Specialist Office of Acquisitions National Institute of Environmental Health Sciences

NIEHS

530 Davis Drive, Morrisville, NC 27560

7.b. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposal," until 4:00 pm EST local time on August 14, 2019. Offers will be valid for 90 days unless a different period is specified by the offeror.

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "PACKAGING

AND DELIVERY OF THE PROPOSAL."

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS

DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS,

THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH

subparagraph (f) of FAR Clause 52.212-1, Instructions to Offerors--Commercial Items

LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Acquisition Management (SAM) at http://sam.gov prior to award of the contract.

11. FOR INFORMATION CONTACT: Kristina Filardo e-MAIL: filardok@niehs.nih.gov

Submit all questions IN WRITING VIA EMAIL TO: filardok@niehs.nih.gov.

ALL QUESTIONS MUST BE SUBMITTED NO LATER THAN 4:00 P.M. EST on July 26, 2019.

TELEPHONE INQUIRIES WILL NOT BE ACCEPTED.

http://sam.gov/ mailto:filardok@niehs.nih.gov

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

This contract will provide high quality DNA sequencing of individual samples and accompanying bioinformatics support. The majority of the biological samples will be yeast colonies, plasmid DNA and Polymerase Chain Reaction (PCR) generated samples from a variety of species that include, but are not limited to, human, rodent and recombinant DNA isolated from various tissue sources and cell lines. The contractor shall provide sample storage and preservation which are critical for subsequent nucleic acid analysis. Information needed to assist the contractor in their ability to perform the service correctly will be provided prior to sequencing; data analysis will be performed by NIEHS.

ARTICLE B.2. PRICES/COSTS

The final contract will contain the price provisions agreed upon by the Government and the Offeror(s).

a. This is an Indefinite Quantity contract as contemplated by FAR 16.504. The Contractor shall be reimbursed by the Government in an amount not less than a total of $100 (minimum) nor more than a total of $1,500,000 (maximum) for successful performance of this contract.

b. The prices set forth in this ARTICLE will cover the contract ordering period of September 27, 2019 through September 26, 2024.

c. The Government will issue Delivery Orders based on the work described in the Statement of Work (SOW), Attachment 1 of this solicitation. Upon delivery and acceptance of the items/services provided under each delivery order period, the Government shall pay to the Contractor the unit prices/costs set forth in the Contractor’s catalog and/or price list, less any applicable negotiated discount, as below:

Description of Services Units Discount Price/Unit

Refer to Attachment 1-SOW and Attachment 7-Business Proposal Instructions. Article B.2 shall be completed at the time of award based on the negotiated pricing and discount structure of the successful offeror.

IDIQ TBD TBD

d. Ordering procedures are described in ARTICLE G.2 of this contract.

ARTICLE B.3. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

Other provisions of this contract notwithstanding, the Contractor and the Government agree as follows:

a. Immediately upon publication or revision, the Contractor shall submit an electronic copy of their most current product catalog and/or price list to the Contracting Officer or Contract Specialist, and the cognizant Contracting Officer’s Representative (COR). The catalog and/or price list shall be incorporated into the contract with the same discounts stated in Section B. of this contract.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. - STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated July 1, 2019, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format unless otherwise noted or requested.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

a. Progress Reports

In addition to the required reports set forth elsewhere in this Schedule, the Statement of Work describes the preparation and submission of regularly recurring Progress Reports during the contract period. Please refer to the Statement of Work for additional details on the content and frequency of those reports.

b. Other Reports/Deliverables

1. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth by the Contracting Officer (CO)/Contracting Officer's Representative (COR). The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/web/508/contracting/technology/vendors.html under "Vendor Information and Documents."

http://www.hhs.gov/web/508/index.html http://www.hhs.gov/web/508/contracting/technology/vendors.html

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications.

Any samples returned by the Contractor to the Government shall be shipped in a manner to ensure that they do not suffer any degradation as a result of temperature changes or other shipping conditions.

The contractor shall:

a. Provide all necessary sample collection material for the shipment of samples including but not limited to: sample collection plate or vial, refrigerated sample storage method of samples prior to sequencing analysis, appropriate pre- paid shipping containers, and a sample record tracking system/method.

b. Provide a reliable method of sample transport both to and from the NIEHS campus and contractor’s laboratory/facility. This may be achieved by: in-house courier, local contracted courier, or through FedEx or UPS.

c. Package, mark, and ship all samples required under this contract in accordance with the shipping specifications outlined in the Statement of Work.

d. At a minimum, mark all deliverables with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable conditions.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, the Contracting Officer’s Technical Representative is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

NIEHS, 111 T.W. Alexander Drive, Building 101, Research Triangle Park, NC 27709

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

FAR Clause 52.246-16, Responsibility for Supplies (April 1984).

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The ordering period of this IDIQ contract shall be five (5) years from 9/27/2019 through 9/26/2020.

**exact dates to be determined at time of contract award**

b. The period of performance for each delivery order awarded under this contract shall be specified in the order. Delivery orders must be awarded during the ordering period specified herein and may extend beyond the expiration of the ordering period, but in no event shall extend more than 12 months beyond the ordering period.

c. After the ordering period expires, the IDIQ contract shall continue to govern the terms and conditions with respect to active delivery orders to the same extent as if the order were completed during the contract's ordering period/term. Refer to Article I.4, FAR Clause 52.216-22, Indefinite Quantity, incorporated herein.

ARTICLE F.2. DELIVERIES

a. Satisfactory performance of this contract shall be deemed to occur upon performance of the work described in the Statement of Work in SECTION J of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the Services specified in the Delivery Schedule which are described in the SOW.

b. Deliveries required by the Contractor shall be made F.o.b. destination as set forth in FAR Clause 52.247-

35, F.o.b. Destination, Within consignees Premises (April 1984) [and any specifications stated in SECTION D, PACKAGING AND MARKING AND SHIPPING, of this contract] to the address/addressee listed below:

National Institute of Environmental Health Sciences

111 T.W. Alexander Drive Building 101

Research Triangle Park, NC 27709

c. Unless otherwise specified, deliveries shall be made to the Delivery Point specified above Mondays through Fridays (excluding Federal Holidays) between the hours of 8:30 a.m. and 5:30 p.m. EST only.

Supplies or services scheduled for delivery on a Federal holiday shall be made the following day.

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY 1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar .

https://www.acquisition.gov/?q=browsefar

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is not applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract: To be specified prior to award.

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract.

Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract.

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title TBD Principal Sequencing Manager

ARTICLE G.3. METHOD OF ORDERING

a. Delivery orders shall be placed against the contract to provide funding for the associated delivery order period of performance, up to a maximum dollar value ceiling for that delivery order period. Ordering of services and/or items during the delivery order period shall occur on a frequent, sometimes daily, basis per the fixed unit prices established under Article B.2.

b. Orders issued under this contract may be placed as follows:

[X] via telephone [X] in writing [ ] via facsimile (fax) [X] via electronic mail (e-mail) [X] Oral [Oral Orders will be confirmed in writing within 2 days of issuance].

[X] Other, Specify: Electronically through the vendor website (this is the preferred method).

b. The Contracting Officer Representative and any authorized laboratory personnel are approved to issue orders and provide written confirmation of oral orders, if applicable, under the contract.

ARTICLE G.4. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

b. One copy of the invoice shall be submitted to the following approving official:

Contracting Officer Office of Acquisitions E-mail: To be identified at award

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

[Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

Central Point of Distribution: (To be provided at award)

The Contractor shall submit an electronic copy of the payment request to the Central Point of Distribution mailbox. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

[Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the

Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is the

National Institute of Environmental Health Sciences.

b. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid

TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

c. DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

d. Invoice Matching Option. This contract requires a two-way match.

e. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

f. The Contract Title is: DNA Sequencing Services for NIEHS

g. Contract Line Items as follows:

Line Item # Line Item Description

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

ARTICLE G.5. PROVIDING ACCELERATED PAYMENT TO SMALL BUSINESS SUBCONTRACTORS, FAR 52.232-40 (December 2013)

a. Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

b. The acceleration of payments under this clause does not provide any new rights under the prompt Payment Act.

c. Include the substance of this clause, include this paragraph c, in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

ARTICLE G.6. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually as follows on TBD [Insert Dates].

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address: http://www.cpars.gov

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. HUMAN SUBJECTS

It is hereby understood and agreed that research involving human subjects shall not be conducted under this contract, and that no material developed, modified, or delivered by or to the Government under this contract, or any subsequent modification of such material, will be used by the Contractor or made available by the Contractor for use by anyone other than the Government, for experimental or therapeutic use involving humans without the prior written approval of the Contracting Officer.

ARTICLE H.2. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.3. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.4. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

ARTICLE H.5. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

ARTICLE H.6. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

ARTICLE H.6.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1. Applicability- The requirements herein apply whether the entire contract or order (hereafter

"contract"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

http://www.cpars.gov/

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information

Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an

HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X ] Low [ ] Moderate [ ] High Integrity: [ X ] Low [ ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Risk Level: [ X ] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ X ] Yes PII

Personally Identifiable Information (PII). For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

PII Confidentiality Impact Level has been determined to be: [ X ] Low [ ] Moderate [ ] High

4. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140- 2 validated solution.

5. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with

HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6. Internet Protocol Version 6 (IPv6)- All procurements using Internet Protocol shall comply with OMB

Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7. Contract Documentation- The Contractor shall use provided templates, policies, forms and other agency documents provided by NIH or NIEHS to comply with contract deliverables as appropriate.

8. Standard for Encryption- The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module

Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR within 15 days of implementation.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

9. Contractor Non-Disclosure Agreement (NDA)- Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

B. INCIDENT RESPONSE

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIEHS ISSO teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for any other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140- 2 validated encryption.

2. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications approved by the NIEHS ISSO and NIEHS Privacy Coordinator to affected individuals within 1 business day of communication approval.

3. Report all suspected and confirmed information security and privacy incidents and breaches to the

NIEHS ISSO Team isso@niehs.nih.gov, COR, CO, NIH SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable

Information HHS/NIH and NIEHS incident response policies when handling PII breaches.

5. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

C. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

D. CONTRACT INITIATION AND EXPIRATION

1. General Security Requirements- The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology or related NIH guidance and in accordance with the HHS Contract Closeout Guide (2012).

2. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to NIST SP

800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Contractor Responsibilities Upon Physical Completion of the Contract- The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

5. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the

NIH Contractor Employee Separation Checklist when an employee terminates work under this contract within 3 business days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

E. RECORDS MANAGEMENT AND RETENTION

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/NIH/NIEHS policies and shall not dispose of any records unless authorized by HHS/NIH/NIEHS.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/NIH/NIEHS policies.

ARTICLE H.7. ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY NOTICE HHSAR 352.239-73 (December 2015)

a. Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

b. Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and standards/communications-and-it/about-the-section-508-standards.

c. The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239- 74, Electronic and Information Technology Accessibility. In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards.

The template allows offerors or developers to self-evaluate their supplies and document--in detail--whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://www.hhs.gov/web/508. In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

d. Respondents to this solicitation must identify any exception to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

• The "HHS Section 508 Product Assessment Template" is included in SECTION J - List of Attachments, of this solicitation.

ARTICLE H.8. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is: http://oig.hhs.gov/fraud/hotline/ and the mailing address is:

US Department of Health and Human Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489 Washington, D.C. 20026

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

ARTICLE I.1. CONTRACT TERMS FOR COMMERCIAL ITEMS

Refer to Attachment 5 - FAR 52.212-4, Contract Terms and Conditions - Commercial Items (January 2017) - With Addenda [Stop Work Order], FAR 52.242-15 (August 1989).

Refer to Attachment 6 - FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (November 2017).

ARTICLE I.2. AUTHORIZED SUBSTITUTIONS OF CLAUSES

Any authorized substitutions and/or modifications other than the General Clauses which will be based on the type of contract/Contractor will be determined during negotiations.

It is expected that the following substitution(s) will be made part of the resultant contract:

a. Alternate I (February 2002), of FAR Clause 52.232-25, Prompt Payment (Jan 2017)

ARTICLE I.3. ADDITIONAL CONTRACT CLAUSES

Additional clauses other than those listed below which are based on the type of contract/Contractor shall be determined during negotiations. Any contract awarded from this solicitation will contain the following:

This contract incorporates the following clauses by reference, (unless otherwise noted), with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

a. FEDERAL ACQUISITION REGULATION (FAR) (48 CFR CHAPTER 1) CLAUSES

1. FAR Clause 52.204-9, Personal Identity Verification of Contractor Personnel (January 2011).

http://oig.hhs.gov/fraud/hotline/

2. FAR Clause 52.204-15, Service Contract Reporting Requirements for Indefinite-

Delivery Contracts (October 2016).

3. FAR Clause 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (November 2015).

4. FAR Clause 52.219-6, Notice of Total Small Business Set-Aside (November 2011).

Alternate I (November 2011) is not applicable to this contract.

Alternate II (November 2011) is not applicable to this contract.

5. FAR Clause 52.219-14, Limitations on Subcontracting (November 2011).

6. FAR Clause 52.219-28, Post-Award Small Business Program Rerepresentation (July

2013).

7. FAR Clause 52.227-14, Rights in Data - General (May 2014).

8. FAR Clause 52.244-5, Competition in Subcontracting (December 1996).

b. DEPARTMENT OF HEALTH AND HUMAN SERVICES ACQUISITION REGULATION (HHSAR) (48 CHAPTER 3)

CLAUSES:

1. HHSAR Clause 352.208-70, Printing and Duplication (December 2015)

ARTICLE I.4. ADDITIONAL FAR CONTRACT CLAUSES INCLUDED IN FULL TEXT

Additional clauses other than those listed below which are based on the type of contract/Contractor shall be determined during negotiations. Any contract awarded from this solicitation will contain the following:

This contract incorporates the following clauses in full text.

a. FEDERAL ACQUISITION REGULATION (FAR) (48 CFR CHAPTER 1) CLAUSES

1. FAR Clause 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (July 2013)

a. The Contractor shall update the information in the Federal Awardee Performance and Integrity

Information System (FAPIIS) on a semi-annual basis, throughout the life of the contract, by posting the required information in the System for Award Management (SAM) database at http://www.acquisition.gov .

b. As required by section 3010 of the Supplemental Appropriations Act, 2010 (Pub. L. 111-212), all information posted in FAPIIS on or after April 15, 2011, except past performance reviews, will be publicly available.