NIH_RFP NIHODM9000022022_RCO Support SOW_Mar2022.docx

RFP NIHODM9000022022

Statement of Work

NIH/OD/OLAO/OA

Statement of Work (SOW) All of Us Research Program Research Compliance, Site Support & Governance June 2021

TABLE OF CONTENTS

1.0 INTRODUCTION/OVERVIEW

The All of Us Research Program (AoURP or ‘the program’) will be the largest research program conducted by the U.S. Government on its own people. Over the course of the next 10 plus years, the program aims to collect data and specimens from a million or more Americans. The program is conducted by numerous awardees across the U.S. Compliance with Federal regulations pertaining to the conduct of human subjects research and with the principles underpinning those regulations is paramount to ensure trust in the program and its aims. With a diverse network of sites and partners working toward the common goals of the program, there is a need for centralized support for compliance and monitoring of research to ensure consistent approaches across the U.S.

Compliance and monitoring activities include, but are not limited to, monitoring site activities for protocol compliance, support in reporting of adverse incidents to the program and central Institutional Review Board (IRB), coordination of annual review for site activities, and assisting in the management of changes in research. Centralizing support for the performance sites engaged in the research program limits regulatory and compliance risk to the program and its participants.

1.1 BACKGROUND

Human subjects research funded by the NIH (and other signatory Federal Agencies) is governed by the "Common Rule" (45 CFR 46). In addition to the Common Rule, HHS's Office for Human Research Protections (OHRP) has promulgated guidance and provided opinions that make clear the scope of human research protections measures expected to be employed when engaged in research with human subjects. In addition, human research programs and protocols that employ an FDA regulated devices are regulated by 21 CFR 50 and 21 CFR 56 - which taken together are substantially similar to 45 CFR 46.

The AoURP also operates under an FDA-approved Investigational Device Exemption (IDE) subject to the requirements of 21 CFR 812. These parts create requirements for the sponsor (AoURP/NIH) to engage with the research sites to ensure compliance with the terms not only of the IRB-approved protocol and consent form, but also the parameters of the FDA-approved IDE.

Since the inception of the AoURP, support for governance and compliance needs relative to the AoURP core protocol and participating sites has been managed via a sub-award to one of the program’s awardees. In 2020, the program created a Research Compliance Office (RCO) to provide centralized support for the program’s core protocol and centralized activities. The RCO requires continued support for compliance and monitoring of site activities that are undertaken relative to the centralized activities managed by the RCO itself.

This new award will establish much-needed support for the program in two key areas: (1) protocol governance and quality assurance; and (2) support for sites engaged in human subjects research through AoURP. The current sub-award has provided basics in both areas with emphasis on governance and IRB submission support for sites; however, the program has an immediate need for thorough review of program processes and implementation of measures to ensure quality and compliance with IRB determinations, protocol documentation, and research regulations at all sites engaged in human subjects research.

1.2 MANDATORY REQUIRMENTS

The statement of work requires the need for ongoing support of the AoURP and the RCO at its current size (approximately 80 stakeholders engaged in human subject’s research). The program requires ongoing support to ensure compliance of stakeholders with IRB determinations, approved protocols and regulations applicable to the conduct of the research. As a decentralized national program, additional expertise is required to mitigate significant compliance risks that if not appropriately addressed could cause irreparable harm to participants or the success of the research program.

Offerors must demonstrate prior experience in compliance and monitoring activities. These activities shall include monitoring site activities for protocol compliance; support in reporting of adverse incidents to the program and central Institutional Review Board (IRB); coordination of annual review for site activities; and assisting in the management of changes in research.

1.3 SCOPE

The AoURP aims to create a comprehensive program of support and evaluation of processes related to the research program from concept to site implementation. Particular emphasis will be placed on the operational efficiency of processes and efforts to evaluate and ensure ongoing compliance with applicable protocols, regulations, IRB determinations, and program policies.

1.4 OBJECTIVES

· Support the ongoing self-evaluation of the AoURP with analytics and insights related to current processes with the aim of improving overall efficiency in research development and implementation activities.

· Provide the AoURP with subject matter expert support for the ongoing work conducted under the AoURP core protocol and portfolio of research.

· Coordinate the efforts of the various awardees engaged in human subjects research under the AoURP to ensure compliance with the core protocol, program policy, IRB determinations, and applicable regulations.

· Design and implement a monitoring and evaluation plan to be deployed across the AoURP Consortium that meets requirements of the AoURP IDE, expectations of the AoURP IRB, and satisfies the Association for the Accreditation of Human Research Protection Programs (AAHRPP) standards.

2.0 REQUIREMENTS

The All of Us Research Program requires ongoing support to ensure compliance of stakeholders with IRB determinations, approved protocols and regulations applicable to the conduct of the research, as well as periodic review to ensure best practices are employed to support governance of the program. As a decentralized national program, additional expertise is required to mitigate significant compliance risks that if not appropriately addressed could cause irreparable harm to the success of the research program.

2.1 TASKS

1. Program Evaluation

a. The awardee will work with the RCO to conduct periodic (not less than annual) evaluation of the AoURP and develop analytics capable of providing at-a-glance data on the health of processes related to:

i. development of research activities from concept to IRB submission;

ii. Implementation of research at awardee sites; and

iii. Compliance with program standards, protocol and IRB requirements.

The evaluation will consider variables such as time, quality, complexity, variability and level of effort. Timing of reporting on operational analytics will be jointly determined by the awardee and program.

b. Specific areas of evaluation include:

i. Protocol Life Cycle – The AoURP has implemented processes to manage the development of research activities from concept to implementation. Analytics on these efforts will provide insight into how upstream efforts impact downstream implementation efforts and allow the program to adjust to better anticipate downstream effects.

ii. Protocol Change Management Cycle – In addition to development of research activities, AoURP’s portfolio of research undergoes periodic changes in order to keep research activities up-to-date and relevant to the state of science and to curate the participant experience. Insights regarding the change management cycle for the portfolio of research will provide information on the sources of change and identify areas where the need for change could have been better anticipated or even avoided by stronger planning in the protocol development phase. Insights on protocol change management cycle should also address implementation of change in the portfolio of research across the consortium including, for example, how the change is communicated to stakeholders, how implementation is verified across stakeholders, and how changes affect the conduct of the research.

iii. Stakeholder Support – Various partners engage in the AoURP under the core protocol or other projects in the portfolio of research. Analytics related to the process of onboarding new sites, amending site-specific content, reporting unanticipated problems and issues of noncompliance, and review of sites for compliance with IRB determinations and applicable regulations will provide the program with needed insights relative to both efficiency and compliance with IRB and regulatory requirements.

iv. Protocol Governance - The awardee will conduct periodic review of the AoURP governance processes related to the research portfolio from concept to implementation to identify any gaps in process that leave either regulatory or policy considerations unaddressed, or where regulatory or policy considerations could be better addressed (e.g., more thoroughly or earlier).

v. Quality and Compliance – Subject to the approval of the RCO, the awardee will conduct an evaluation of the quality and compliance of consortium members with particular emphasis on those engaged in human subjects research. The evaluation will be based on an intimate understanding of the portfolio of research, site-specific processes, and a strong understanding of the interconnectivity of the components that comprise the AoURP consortium. The scope of quality and compliance evaluation includes all regulated components if the research program and must adequately address requirements under applicable regulations, the IDE and AAHRPP standards.

c. Documentation of Evaluation Process – For each evaluation area noted above, the awardee will provide the RCO with documentation of the processes undertaken in support of the evaluation, as well as reports of the findings of the evaluation identifying areas where current processes are optimized, identifying best practices and applying those findings to other areas where processes may be overwrought or under-developed.

2. Development of New Procedures and Process Improvement

a. In conjunction with the RCO and, as necessary, other program components, the awardee will provide support for, develop, and implement a process for evaluation of quality and compliance across the AoURP enterprise sufficient to meet the needs of ongoing monitoring of research required by applicable regulations.

b. The awardee will work with the RCO to develop new or modify existing processes in response to findings of the evaluation process.

c. New or modified processes will be documented in sufficient detail to allow the AoURP to evaluate the feasibility of the process and will provide the program with detail on how the new or revised process is expected to impact the areas evaluated.

d. In conjunction with the RCO and, as necessary, other program components, the awardee will develop a quality assurance and surveillance plan to resolve any issues of quality or compliance identified as part of the quality and compliance evaluation completed as part of task 1.b.v. To the extent indicated by findings of compliance evaluation activities, the awardee will participate in the development and implementation of corrective actions to resolve any deficiencies found as part of the evaluation or ongoing assurance and surveillance activities.

e. The awardee will develop standard operating procedures describing efforts to support stakeholders who are engaged in human subjects research sufficient to cover the task areas outlined in task 4c.

3. Implementation

a. The awardee will coordinate efforts to implement new or revised procedures for the RCO and participating sites developed based on evaluations described in task 1 and development tasks outlined in task 2. When new or revised procedures pertain to support for or evaluating compliance of participating sites, the awardee will implement procedures after approval by the RCO and will report on the effectiveness of the new/revised procedures as part of ongoing evaluation.

b. Implement a quality assurance and surveillance plan as described in task 2d providing documentation to the RCO detailing the plan as it is to be implemented.

c. The awardee will facilitate the transfer of legacy files pertaining to the AoURP, including the core protocol, supplements, pilots, sites, and stand-alone protocols to the RCO as part of ensuring that the program has adequate documentation of all research activities subject to IRB review and approval.

d. The awardee will provide support to the RCO’s efforts toward AAHRPP Accreditation of the AoURP by providing requested information to the RCO in support of AAHRPP self-evaluation, step 1 application, and annual reports as needed.

4. Maintenance and Ongoing Operations

a. Subject Matter Expert (SME) Support – The awardee will provide subject matter expertise regarding the development, governance, and history – including past decisions and activities – scope, and activities described within the core protocol. The SME(s) will provide expert level understanding of the contents of the core protocol and other protocols in the AoURP’s portfolio, as necessary, and will offer analysis, recommendations, and guidance on the overall organization of the AoURP’s activities within the portfolio of research as part the program evaluation in task 1. The SMEs may be called upon to support significant revisions to the core protocol or other key components of the research portfolio including core protocol appendices, supplements, and pilots, by for example providing guiding principles for protocol contents, organization and ongoing governance. The awardee will also provide subject matter experts on the key processes for support of sites relative to IRB submission processes, incident reporting, and other key regulatory documentation required for sites engaged in the AoURP.

b. Ongoing Evaluation of Quality and Compliance – The awardee will continue to support periodic evaluations of the quality and compliance of the program relative to task 1 and developed as part of task 2. Periodic evaluations should take place not less than once annually and be sufficient to meet program obligations under applicable regulations or accrediting bodies.

c. Ongoing Stakeholder Support – The awardee will support stakeholders that are engaged in human subjects research by providing key functions related to compliance with the core protocol and applicable federal regulations including:

i. Support for all IRB/program site-specific submission types: initial submission; annual updates; incident reports; and site-specific modifications (including communications assets).

ii. Advising engaged sites based on past experience with the IRB and RCO in the development of the site’s IRB submissions.

iii. Pre-review of site-specific submissions to the IRB for compliance with the applicable protocol and past determinations of the IRB.

iv. Coordinating review of site-specific submissions by the assigned AoURP Program Officer or communications lead as needed.

v. Ensuring RCO sign off for site-specific pilot and supplemental projects prior to submission to the IRB.

vi. Submission of all site-specific IRB submissions in the IRB’s electronic submission system.

vii. Weekly reporting on status of site-specific submissions to the RCO.

viii. Dissemination of program-wide updates to engaged sites (e.g., distribution of revisions to the core protocol).

ix. Maintenance of documentation pertaining to each of the items listed above sufficient to provide external evaluators with adequate detail as to the involvement of the stakeholder in human subjects research and sufficient to detail compliance with applicable IRB determinations, protocols, and regulation. In addition to maintaining documentation to support site activities, the awardee will ensure the RCO is provided with copies of approved submissions and related correspondence with the IRB for its files.

d. Status Meetings – the awardee will participate in status meetings with the RCO, and other program stakeholders (e.g., IRB support staff) as requested.

5. As necessary, attend and contribute to meetings related to the tasks outlined above.

2.2 REPORTING

Technical Progress and Financial Report –

a. Monthly reports - Due on the 15th of the subsequent month, the awardee will provide a detailed summary of activities of the preceding month including activities in progress, activities completed, activities not yet begun, anticipated risks to ongoing work, summary of all site-specific submissions in progress or completed, and summary of current spending. The reports will be accompanied by a two-page executive summary of the report’s contents.

b. Annual report – Due at the completion of the award year, the awardee will provide a detailed summary of activities undertaken in the award year, activities completed, activities not yet begun, anticipated risks to ongoing work, and summary of spending for the year. The report will be accompanied by a two-page executive summary of the report’s contents.

2.3 DELIVERABLES

1. Reports on the results of periodic program evaluations as described in task 1 and documentation of the evaluation processes undertaken.

2. Quality assurance and surveillance plan to assure compliance of stakeholders engaged in human subject’s research.

3. Standard Operating Procedures for the tasks outlined in task 4c.

4. Monthly and Annual Technical Progress and Financial reports. Monthly reports are due on the 15th of the following month, and Annual reports are due within 30 days of completion of the award year, except for the final year of the award, in which case the report is due prior to completion of the final year (unless the award is extended/renewed, in which case report will be due within 30 days of completion of the award year as with prior years).

3.0 SCHEDULE

Resultant Award will consist of one (1) twelve (12) month base period and two (2) twelve (12) month Option Periods.

4.0 KEY PERSONNEL

In accordance with HHSAR 352.237-75 Key Personnel

Key Personnel (December 18, 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of clause)

The following individual(s) are considered to be essential to the work being performed:

5.0 ADDITIONAL REQUIRMENTS

Section 508

This language is applicable to Statements of Work (SOW) or Performance Work Statements (PWS) generated by the Department of Health and Human Services (HHS) that require a contractor or consultant to (1) produce content in any format that could be placed on a Department-owned or Department-funded Web site; or (2) write, create or produce any communications materials intended for public or internal use; to include reports, documents, charts, posters, presentations (such as Microsoft PowerPoint) or video material that could be placed on a Department-owned or Department-funded Web site.

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that Federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow Federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

The following Section 508 provisions apply to the content or communications material identified in this SOW or PWS:

· HHS Section 508 Web site: http://508.hhs.gov/

· HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html

· US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm

Confidentiality

Commitment to Protect Non-Public Departmental Information and Data.

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

· 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

· 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

· Public Law 96-511 (Paperwork Reduction Act)

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

Privacy and Security Requirements

All personnel and activities must conform to all Federal, HHS, NIH and All of Us policies and guidelines regarding security, confidentiality and privacy. The contractor must be able to successfully complete any required security or background checks.

Government Furnished Equipment

All equipment and supplies needed to perform the outlined tasks and activities will be supplied by the offeror.

Security Categories and Levels The security level for this work is:

Privacy Provisions for the All of Us Research Program

All partners in the All of Us Research Program (AoURP) are required to adhere to the PMI Privacy and Trust Principles, which may be accessed at: https://allofus.nih.gov/about/program-overview/precision-medicine-initiative-privacy-and-trust-principles

1. The AoURP requires the contractor to work with the program and relevant stakeholders to develop a privacy plan within six (6) months of contract award. The plan shall describe how the contractor will design and implement privacy controls and policy safeguards necessary to ensure secure data sharing, access, and use and data quality and integrity congruent with the PMI Privacy and Trust Principles and, where applicable, how they will comply with privacy requirements established in the Common Rule, the Public Health Service Act, the 21st Century Cures Act, HITECH, HIPAA, including relevant supporting regulations, and agency and program policies.

The AoURP, through the Policy Director and in coordination with the Privacy Officer and Program Officer, may require additional privacy measures not included in the PMI Privacy Trust Principles. AoURP will regularly monitor compliance with the privacy plan and any new privacy requirements as specified by the program and agreed upon by the contractor. The contractor will reach agreement with AoURP on requested terms, scope, and timing of privacy reviews

2. PII specifically obtained for the All of Us Research Program may be stored at any of the following sites: an enrollment and/or data collection site (Health Provider Organization (HPO) or Direct Volunteer sites), the Data and Research Center (DRC), or the Participant Technology Systems Center (PTSC). A privacy incident may occur in any system that collects or uses PII from these sites, due to an external or internal intruder, human error or intentional malice, or during data exchange between systems. Once the contractor identifies a suspected or confirmed privacy incident, it must be notified to the Incident Notification Board (INB) as soon as possible and no later than 24 hours, even if investigations into the incident(s) are incomplete or ongoing. Notification to the Board should use the Privacy Incident Report template and must include the following information, if available:

· Description of what happened;

· Type of PII involved in the privacy incident and to whom the PII pertains;

· Description of the controls in place that could potentially minimize the risk posed by the incident;

· Approximate number of potentially impacted individuals affected by the incident.

· Any initial remediation steps taken by the site to minimize risk;

· Actions the site has already taken in compliance with Federal and State law.

If this information is not available, the contractor should include in its notification as much information as is available to it at that time and supplement its notification as additional information becomes available. Privacy incident reports are sent to the INB by email to AllofUs_Notifications_Board@mail.nih.gov, using the Privacy Incident Report Template. The affected contractor should also notify the INB of any deadlines it anticipates facing as part of its investigation or response to the incident, whether required by law (including HIPAA, if applicable) or policy, so that the INB may provide timely recommendations. In the event that a privacy incident also includes a security breach, the contractor may have additional notification requirements per their obligations for FISMA and the NIH ATO, including reporting to the NIH IRT.

Precision Medicine Initiative Data Security Framework

All partners in the All of Us Research Program are required to adhere to the Precision Medicine Initiative Data Security Policy Framework which may be accessed at: https://allofus.nih.gov/protecting-data-and-privacy/precision-medicine-initiative-data-security-policy-principles-and-framework-overview

Additional Conditions for Contractors with Significant Security Responsibilities

1. Compliance with AoURP Security Authorization Process - The NIH AoURP requires that the contractor comply with the AoURP Security Authorization Process for all AoURP systems under the direct management and operations of the contractor. The NIH AoURP requires the contractor to describe how it will design and implement technical and policy safeguards necessary to ensure data security, in accordance with NIST Special Publication 800-53 meeting or exceeding the FISMA Moderate baseline. All contractors will apply NIH organizationally-defined parameters unless provided a waiver by the NIH AoURP ISSO. Additionally, the contractor shall abide by the terms outlined in the Authority to Operate (ATO) requiring that the authorization will remain in effect as long as:

I) The required security status reports for the system are submitted periodically to the AOURP ISSO II) The vulnerabilities reported during the continuous monitoring process do not result in additional NIH-level risk which is deemed unacceptable III) The system has not exceeded the maximum allowable time between security assessments (one-third security controls are reviewed annually within three-year authorization period)

The NIH AoURP Information Systems Security Office will request an annual independent review of security controls, in addition to continual review and testing, to ensure overall effectiveness against evolving threats and consistent implementation as a requirement of renewal of the ATO.

All major changes to the system boundary will be evaluated using a Security Impact Analysis within the AOURP Security Authorization Process to determine if a new or additional ATO is required.

2. Risk Management – The NIH AoURP, through the program Information System Security Officer (ISSO) in coordination with the Program Officer, may require additional security measures not included in the FISMA Moderate baseline to provide advanced cybersecurity measures following a risk-based approach. The NIH AoURP and the contractor will establish data security implementation plans and timelines collaboratively. NIH AoURP will regularly monitor compliance with ongoing and new security requirements as specified by the NIH AoURP and agreed upon by the contractor. The following terms apply:

a. Adhere to NIH AoURP security policy, procedure, and developed memorandum

b. All contractors must maintain and make available to the NIH AoURP accurate security documentation and architecture diagrams

c. Apply risk reducing measures and other NIH AoURP recommendations

d. All contractor system ISSOs must maintain a record of completed trainings and signed user access agreements (Rules of Behavior)

e. All contractor systems ISSOs must coordinate and complete an annual IT Contingency Plan test methodology that commensurate with the risk profile of the system

3. Plans of Action & Milestones - A Plan of Action & Milestones (POA&M) document will be maintained by the contractor and reviewed at least monthly with the AoURP Information Systems Security Office. Additionally, the contractor must abide by the following terms:

a. POA&Ms will be categorized, and managed following NIH AOURP provided templates

b. POA&Ms will be documented as Program-level and System-level

c. POA&M corrective actions will follow the following standard

d. POA&Ms will be created based on the following criteria

e. All risk waivers will be created from POA&Ms that cannot be completed due to technology limitation, functional impact to the AoURP, or a conflict in policy between contractor and the NIH

f. All risk waivers will be documented and reviewed annually and acknowledged by the AoURP ISSO

g. The contractor will use an NIH designated site to share documents as directed by the AoURP ISSO

h. The completion of POA&Ms will be a collaborative effort requiring acknowledgement from the contractor ISSO, System Owner, and the NIH AoURP Information Security Office

i. Status of all milestones will be included in the quarterly report and thereby incorporated into the NIH award record

NIH may take action, including reduction or reallocation of funds or termination of the award, for non-compliance with security requirements and milestones as agreed upon by both the NIH and the contractor.

4. Incident Response – The NIH AoURP requires all contractors to maintain an active and evolving security program with incident response capabilities that meet NIH AoURP requirements. All contractors will use the HHS Policy and Plan for Responding to a Breach as guide for implementing incident response capabilities. The following incident reporting requirements must be followed.

a. All contractors must designate a dedicated incident response point of contact

b. All perceived and potential security and privacy incidents must be reported to the NIH AoURP ISSO within 1 hour of discovery

c. All incidents will require full transcript of incident and timeline, response action report, and final report

d. Notification of incidents will be submitted via ISAO-AllofUs-Security@mail.nih.gov and contain non-sensitive information; all follow up communication and sharing information potentially containing with sensitive information will utilize NIH Secure Email and File Transfer (SEFT) or secure method of transfer approved by the AoURP ISSO

5. Continuous Monitoring – The NIH AoURP requires all contractors to maintain a continuous monitoring program that follows NIH guidelines and aligns with NIST SP 800-137. The purpose of the continuous monitoring program is to provide visibility into organizational assets, awareness of threats and vulnerabilities, and visibility into the effectiveness of deployed security controls. The continuous monitoring program provides ongoing assurance that planned and implemented security controls are aligned with organizational risk tolerance as well as the information needed to respond to risk in a timely manner should observations indicate that the security controls are inadequate. The following requirements must be followed.

Contractor will reach agreement with AoURP on requested terms, scope, and timing of security reviews.

Dispute resolution: Any disagreements or disputes regarding data security requirements specified by AoURP will be elevated to the NIH ATO signatories, i.e., the NIH Office of Chief Information Officer and the Director of the All of Us Research Program.