Addendum_to_FAR_52.212-4_Contract_Terms_and_Conditions.pdf

NIHES201900002

ADDENDUM TO FAR 52.212-4 CONTRACT TERMS & CONDITIONS–COMMERCIAL ITEMS

1. CONTRACT ADMINISTRATION DATA

(1) CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

• [To be designated after award]

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the SOW and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Alternate-COR (ACOR) is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned. The ACOR is authorized to handle all matters related to the monitoring and overseeing of the technical and programmatic aspects of the contract. The following ACORs will represent the Government for the purpose of this contract:

• [To be designated after award]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract.

Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract. The Government may unilaterally change its CO appointment and COR designation.

(2) INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original contract invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B- 432, MSC 8500 Bethesda, MD 20892-

b. One copy of the contract invoice shall be submitted to the following approving officials e-mail addresses:

• TBA

The Contractor shall submit an electronic copy of the payment request to the approving officials instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

Central Point of Distribution: The Contractor shall submit an electronic copy of the payment request to the Central Point of Distribution mailbox. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

b. Inquiries regarding payment of contract invoices shall be directed to the designated billing office, (301) 496-

6452.

c. In addition to the requirements of FAR Subpart 32.9, all invoices must contain:

1. Vendor/Contractor

a. Name and Address

b. Point of Contact for the invoice

c. Name, title, telephone number, e-mail and mailing address.

2. Remit-to address (Name and complete mailing address to send payment).

3. Remittance name must match exactly with name on original order/contract. If the Remittance name differs from the Legal Business Name, then both names must appear on the invoice.

4. Invoice date.

5. Unique invoice #s for all invoices per vendor regardless of site.

6. NBS document number formats must be included for awards created in the NBS:

• Contract Number

• Purchase Order Number

• Task or Delivery Order Number and Source Award Number (e.g., Indefinite Delivery Contract number; General Services Administration number)

• BPA Call Number and BPA Parent Award Number

7. Data Universal Numbering System (DUNS) or DUNS + 4 as registered in the System for Award Management (SAM).

8. Invoices submitted for payment against awards must include the contractor’s DUNS number and Federal Taxpayer Identification Number (TIN). In those exceptional cases where a contractor does not have a DUNS number or TIN, a Vendor Identification Number (VIN) must be referenced on the invoice. The VIN is the number that appears after the contractor’s name on the face page of the award document.

9. Description of supplies/services that match the description on the award, by line billed.

10. Freight or delivery charge must be billed as shown on the award. If it is included in the item price do not bill it separately. If identified in the award as a separate line item, it must be billed separately.

11. Quantity, Unit of Measure, Unit Price, and Extended Price of supplies delivered or services performed, as applicable, and that match the line items specified in the award.

2. SPECIAL CONTRACT REQUIREMENTS

H.1. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for quotes, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

H.2. LIMITATION ON USE OF FUNDS FOR PROMOTION OF LEGALIZATION OF CONTROLLED

SUBSTANCES

The Contractor shall not use contract funds to support activities that promote the legalization of any drug or other substance included in schedule I of the schedules of controlled substances established under section 202 of the Controlled Substances Act, except for normal and recognized executive-congressional communications. This limitation shall not apply when the Government determines that there is significant medical evidence of a therapeutic advantage to the use of such drug or other substance or that federally sponsored clinical trials are being conducted to determine therapeutic advantage.

H.3. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

H.4. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract.

Pursuant to FAR Clause 52.217-9, Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given any time prior to the expiration date of this contract and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

H.5. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is: http://oig.hhs.gov/fraud/hotline/ and the mailing address is:

US Department of Health and Human Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489 Washington, D.C. 20026

H.6. ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY, HHSAR 352.239-74

(DECEMBER 2015)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the

Workforce Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, or maintained under this contract or order must comply with the “Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance http://oig.hhs.gov/fraud/hotline/

Board (also referred to as the “Access Board”) in 36 CFR part 1194. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards.

(b) The Section 508 accessibility standards applicable to this contract are identified in the Statement of Work. The contractor must provide any necessary updates to the submitted HHS Product Assessment Template(s) at the end of each contract or order exceeding the simplified acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) The Section 508 accessibility standards applicable to this contract are:

• Section 508 Information: http://www.section508.gov/

• Guide to the Section 508 Standards: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/guide-to-the-section-508-standards

• Making Files Accessible: http://www.hhs.gov/web/section-508/making-files-accessible/index.html

(d) In the event of a modification(s) to this contract or order, which adds new EIT supplies or services or revises the type of, or specifications for, supplies or services, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found under Section 508 policy on the HHS website: (http://www.hhs.gov/web/508). If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) If this is an Indefinite Delivery contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include EIT supplies or services will define the specifications and accessibility standards for the order. In those cases, the Contractor may be required to provide a completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist the Government in determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found at http://www.hhs.gov/web/508. If it is determined by the Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(End of clause)

H.7. CONFIDENTIALITY OF INFORMATION

a. Confidential information, as used in this article, means information or data of a personal nature about individual, or proprietary information or data submitted by or pertaining to an institution or organization.

b. The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the "Disputes" clause.

c. If it is established elsewhere in this contract that information to be utilized under this contract, or a http://www.section508.gov/ https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/guide-to-the-section-508-standards https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/guide-to-the-section-508-standards https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/guide-to-the-section-508-standards http://www.hhs.gov/web/section-508/making-files-accessible/index.html portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

d. Confidential information, as defined in paragraph (a) of this article, shall not be disclosed without the prior written consent of the individual, institution, or organization.

e. Whenever the Contractor is uncertain with regard to the proper handling of material under the contract, or if the material in question is subject to the Privacy Act or is confidential information subject to the provisions of this article, the Contractor should obtain a written determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication.

f. Contracting Officer determinations will reflect the result of internal coordination with appropriate program and legal officials.

g. The provisions of paragraph (d) of this article shall not apply to conflicting or overlapping provisions in other Federal, State or local laws.

H.8. PUBLICATION AND PUBLICITY

In addition to the requirements set forth in HHSAR Clause 352.227-70, Publications and Publicity incorporated by reference in SECTION I of this contract, the Contractor shall acknowledge the support of the National Institutes of Health whenever publicizing the work under this contract in any media by including an acknowledgment substantially as follows:

“This project has been funded in whole or in part with Federal funds from the, National Institutes of Health, Department of Health and Human Services, under Contract No. “TBA”

H.9. INFORMATION AND PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The following requirements apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Federal Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, physical (entry and documentation) or logical (electronic) access to federal information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the FAR Subpart 2.1 definition of “information technology” (IT), the term as used in this section, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources.

2) Safeguarding Information and Information Systems. The Contractor (and/or any subcontractor) shall:

a. Protect federal information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security of any Contractor systems, and information contained therein, connected to an

HHS network or operated by the Contractor on behalf of HHS regardless of location per clause 52.239-1 of the Federal Acquisition Regulation (FAR) (https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html).

The Contractor is prohibited from subcontracting to companies to conduct HHS business in which foreign governments that support international terrorism have a “significant interest” per 10 U.S.C. § 2327 (https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE- 2011-title10-subtitleA-partIV-chap137-sec2327.htm).

c. Adopt, and implement the policies, procedures, controls, and standards required by HHS Information Security Program to ensure the confidentiality, integrity, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. The HHS Information Security Program security requirements are outlined in the HHS IS2P, which is accessible on the HHS Office of the Chief Information Officer’s (OCIO) website and can be obtained by contacting fisma@hhs.gov. Please see HHS HSPD-12 guidance.

3) Information Security Categorization. In accordance with FIPS-199

(http://csrc.nist.gov/publications/http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf) and the Federal Information Processing Standard NIST SP 800-60, “Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories”, Appendix C, Table C-2 at Vol 2 (http://csrc.nist.gov/publications/) and based on information provided by the ISSO, CISO, or other security representative, the Security Level for each Security Category and the Overall Security Level, which is the highest level of the three, factors (Confidentiality, Integrity, and Availability) of the information or information system is below.

Confidentiality Level: [x] Low [ ] Moderate [ ] High Integrity Level: [ ] Low [x] Moderate [ ] High Availability Level: [x] Low [ ] Moderate [ ] High Overall Level: [ ] Low [x] Moderate [ ] High

For additional information, see NIST SP 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendices C, and D.

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, the PII Confidentiality Impact Level has been determined to be:

Overall Level: [x] No PII [ ] N/A [ ] Low [ ] Moderate [ ] High

For additional information, see NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information.

4) Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol shall comply with FAR sections:

FAR 7.105(b)(5), FAR 11.002(g), and FAR 12.202(e) (https://www.acquisition.gov/?q=browsefar).

5) Controlled Unclassified Information (CUI). All information about the systems gathered or created under this contract shall be considered as Controlled Unclassified Information (CUI) and marked appropriately.

a. CUI, sensitive/proprietary data, and/or equipment will only be disclosed to authorized personnel on a Need-

To-Know basis.

b. Contractors (and/or any subcontractors) processing CUI incidental to developing a product or service for

NIEHS or storing government information on a system that has not been authorized by the agency must meet the requirements of NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (http://csrc.nist.gov/publications/).

c. When no longer required, this information and/or data will be returned to HHS control, destroyed, or held until otherwise directed. Destruction of information and/or data shall be accomplished by following NIST SP 800-88, Guidelines for Media Sanitization (http://csrc.nist.gov/publications/).

https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm http://www.hhs.gov/ocio/policy/index.html http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf https://www.acquisition.gov/?q=browsefar

6) Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Contracting Officer’s Representative (COR), with a copy to the Contracting Officer, within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

7) Contract Documentation. The Contractor shall use templates, policies, forms and other documents necessary, which will be provided by NIEHS, in order to comply with contract deliverables as appropriate. All contract deliverables shall be compliant with Section 508 (http://www.hhs.gov/ocio/policy/508_policy.html#3Scope).

8) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption Language in HHS Contracts

(http://www.hhs.gov/ocio/policy/index.html) to prevent unauthorized access to federal information.

b. Use FIPS 140-2, Security Requirements for Cryptographic Module (http://csrc.nist.gov/publications/) compliant encryption to protect all instances of HHS sensitive information during storage and transmission

c. Verify that the encryption product used by the Contractor has been validated under the Cryptographic Module Validation Program (http://csrc.nist.gov/publications/) to confirm compliance with FIPS 140-2.

The Contractor shall provide a written copy of the validation documentation to the COR.

d. Use the Key Management Key (http://csrc.nist.gov/publications/) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor (and/or any subcontractor) shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (OMB Encryption Guidance at http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the COR and/or Contracting Officer of personnel authorized to decrypt and recover all encrypted information.

e. Ensure that their equipment and devices meet HHS and NIEHS-specific encryption standard requirements (http://www.hhs.gov/ocio/policy/2009-0002.001s.html) or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive federal information (including PII).

f. Ensure that encryption keys are provided to the COR upon request and at the conclusion of the contract.

9) Protection of Sensitive Information. All federal information that is or may be sensitive (as defined in the Departmental Standard for the Definition of Sensitive Information) shall be protected in accordance with Office of Management and Budget (OMB) Memorandum (M) 06-16 (https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf), Protection of Sensitive Agency Information and encrypted with Federal Information Processing Standard (FIPS) 140-2 compliant solution.

10) Contractor Agreement. The Contractor (and/or any subcontractor), performing under this contract, shall not release, publish, or disclose non-public federal information to unauthorized individuals. The confidentiality, integrity, and availability of such information shall be protected by the Contractor in accordance with the governing laws and regulations listed as follows:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

(https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html)

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information) (https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf) http://www.hhs.gov/ocio/policy/508_policy.html#3Scope http://www.hhs.gov/ocio/policy/index.html http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://www.hhs.gov/ocio/policy/2009-0002.001s.html https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf

c. Public Law 96-511 (Paperwork Reduction Act) (http://ciog6.army.mil/Portals/1/Policy/Paper Reduction 1980.pdf)

11) Contractor Employee Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public federal information under this contract shall complete NIEHS Commitment to Protect Non-Public Information – Contractor Employee Agreement. A copy of each signed and witnessed NDA shall be submitted to the COR and Contracting Officer prior to performing any work under this acquisition (See Appendix C for the HHS Contractor Non-Disclosure Agreement).

12) Privacy or Security Safeguards (FAR Clause 48 CFR § 52.239-1). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.239-1 privacy and security requirements, which can be located at: https://www.acquisition.gov/?q=browsefar. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

13) Confidential Information (HHSAR Clause 48 CFR § 352.224-71). The Contractor (and/or any subcontractor) shall comply with HHSAR Clause 48 CFR § 352.224-71 requirements, which can be located at: http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

14) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment – The contractor will support the creation of new PTA forms and PIA forms as required.

a. The Contractor shall assist the NIEHS Privacy Officer (or his or her designee) with conducting a PTA (using the Privacy Impact Assessment [PIA] form) for the information system and/or information collection project to determine whether or not a full PIA needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor shall assist the NIEHS Privacy

Officer (or his or her designee) and other designated authorities with completing a PIA for the system or project within after completion of the PTA.

- The Contractor shall assist the NIEHS Privacy Officer in completing a PIA in accordance with

HHS policy, OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002(https://www.whitehouse.gov/omb/memoranda_m03-22) and shall be revised at each milestone during the system development lifecycle (SDLC).

- PIAs and PTAs are required in the early stages of system development. The Contractor shall assist the NIEHS Privacy Officer in reviewing PIAs within 3 years of the last PIA approval date and/or updated as needed based on a major change to the system or when new types of PII are collected, that introduces new or increased privacy risks.

B. Incident Response

1) In the event of a breach, the Contractor (and/or any subcontractor) shall report all suspected and confirmed information security and privacy incidents to the NIEHS ISSO (isso@niehs.nih.gov), COR, Contract Officer, SOP (or his or her designee), and other stakeholders, including incidents involving personally identifiable information (PII), in electronic or physical form, within 1 hour of discovery. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised.

2) In reporting a breach, the Contractor (and/or any subcontractor) shall:

a. comply with FAR 52.239-1(c) Privacy or Security Safeguards) and HHS/NIEHS Incident Response

Policy.

http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

b. not include any sensitive information in the subject or body of any reporting e-mail.

c. use a FIPS 140-2 validated encryption solution to protect sensitive information in attachments to email, media, etc.

3) The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

Incident response activities determined to be required by the Government may include, but are not limited to, the following:

a. Inspections,

b. Investigations,

c. Forensic reviews,

d. Containment and damage assessment, and

e. Data analysis and processing.

C. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, EPLC processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All IT systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology (http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf) and the HHS Contract Closeout Guide (2012).

2) Providing System Documentation at Contract Expiration. Contractors (and/or any subcontractors) must follow and adhere to National Institute of Standards and Technology NIST SP 800-64, Security Considerations in the System Development Life Cycle (latest revision), at a minimum, for system development. This requirement may include providing system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review.

3) Certification of Sanitization of Government and Government-Activity-Related Files and Information. As part of contract closeout, the Contractor shall submit the certification to the COR and/or Contracting Officer following the template provided in NIST SP 800-88, Guidelines for Media Sanitization (http://csrc.nist.gov/publications/) at the expiration of the contract.

4) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all federal information and IT resources (i.e., federal information in contractor-owned and/or sub-contractor-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all federal information has been properly sanitized and purged, in accordance with HHS and/or NIEHS policies, from Contractor-owned systems, including backup systems and media used during contract performance.

D. Audit Record Retention The Contractor (and/or any subcontractor) shall maintain all information in accordance with NARA records retention policies and NIEHS-specific policies.

E. Privacy Incident Handling and Notification

1) In an instance of a suspected or confirmed breach of PII, the Contractor (and/or any subcontractor) shall refer to instructions in the Incident Response section. In addition, the Contractor shall not notify affected individuals unless so instructed by the Contracting Officer. If so instructed by the Contracting Officer, the Contractor shall send notifications to affected individuals within 3 days.

2) The Contractor shall provide full access and cooperation for all activities determined by the Government to http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

a. Inspections,

b. Investigations,

c. Forensic reviews, and

d. Data analysis and processing.

F. Privacy Plan The Contractor (and/or any subcontractor) shall submit a privacy plan with its technical proposal, in accordance with the HHS IS2P, that safeguards data and protects the confidentiality of PII (NIST 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information, http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf and NIST SP 800-53, Revision 4, Appendix J http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf );the plan shall:

1) Verify the information categorization to ensure the identification of the PII requiring protection.

2) Verify the existing system risk assessment.

3) Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the PWS.

4) Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the PWS.

5) Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the PWS.

6) For PII to be physically transported to or stored at a remote site, verify that the security and privacy controls of NIST Special Publication 800-53, latest version, involving the encryption of transported information will be implemented.

7) When applicable, verify how the NIST Special Publication 800-53, latest version, security, and privacy controls requiring authentication, virtual private network (VPN) connections and other technical safeguards will be implemented.

8) When applicable, verify how the NIST Special Publication 800-53, latest version, security controls enforcing allowed downloading of PII will be implemented.

9) Identify measures to ensure subcontractor compliance with safeguarding PII and security and privacy controls in the NIST 800-53.

10) Be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels.

11) Be evaluated by the Government for appropriateness and adequacy.

G. Privacy Act

1) Privacy Act Notification (FAR Clause 48 CFR § 52.224-1). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.224-1 requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar.

2) Privacy Act (FAR Clause 48 CFR § 52.224-2). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.224-2 requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar.

3) Privacy Act (HHSAR Clause 48 CFR §352.224-70). The Contractor (and/or any subcontractor) shall comply with HHSAR Clause 48 CFR §352.224-70 requirements, which can be located at:

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

4) The contractor (and/or any subcontractor) are subject to criminal penalties for violations of the Act (5 U.S.C. 552a(i)) to the same extent as employees of the Department of Health and Human Services. The contractor does hereby agree and assures that each one of its employees know the prescribed rules of conduct, and each employee is aware that he/she can be subjected to criminal penalties for violations of the Act. A copy of the rules of conduct and other requirements are set forth in 45 CFR Part 5b.

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://www.acquisition.gov/?q=browsefar http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

H. Communications Materials and Services

To build and maintain public trust; promote credibility and consistency; minimize consistency and frustration; and contribute to efforts aimed at leveraging reduced resources and eliminating waste in Government, the Contractor shall ensure that all materials generated and/or services provided under this contract, comply with all applicable NIH policy and procedures published by the NIH Office of Management Assessment in conjunction with the NIH Office of Communications and Public Liaison as set forth below.

This acquisition requires the contractor to:

[X] Prepare, review, and/or distribute NIH Publications and Audiovisuals. NIH Policy Manual Chapter 1183, "NIH Publications & Audiovisuals: Preparation, Review, Approval & Distribution," is applicable to this contract. http://oma.od.nih.gov/manualchapters/management/1183/

[X] Use the NIH name and logo. NIH Policy Manual Chapter 1186, "Use of NIH Names and Logos," is applicable to this contract. http://oma.od.nih.gov/manualchapters/management/1186/

[ ] Create and/or Manage a Public Website which includes NIH hosted social media site(s), Web application(s) and mobile Web Site(s). NIH Policy Manual Chapter 2804, "Public-Facing Web Management," is applicable to this contract. http://oma.od.nih.gov/manualchapters/management/2804/

[ ] Create and/or Manage an NIH Website that maintains and disseminates personal information. NIH Policy Manual Chapter 2805, "NIH Web Privacy Policy," is applicable to this contract.

http://oma.od.nih.gov/manualchapters/management/2805/

[ ] Create and/or Manage an NIH hosted and/or funded social media site(s), Web application(s) and mobile Web site(s). NIH Policy Manual Chapter 2809, "NIH Social and New Media Policy," is applicable to this contract. http://oma.od.nih.gov/manualchapters/management/2809/

Additional Standards applicable to this contract are identified in the Statement of Work. If it is determined by the Government that products, services, and deliverables provided by the Contractor do not conform to standards described in these directives, remediation to an acceptable level of conformance shall be the responsibility of the Contractor at its own expense.

http://oma.od.nih.gov/manualchapters/management/1183/ http://oma.od.nih.gov/manualchapters/management/1186/ http://oma.od.nih.gov/manualchapters/management/2804/ http://oma.od.nih.gov/manualchapters/management/2805/ http://oma.od.nih.gov/manualchapters/management/2809/