Beckman_RFP_Final.pdf

SOLICITATION

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN

CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO

THIS SOLICITATION. ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN

ITS SECTION A - SOLICITATION/CONTRACT FORM, ACCOUNTING, APPROPRIATION AND

GENERAL INFORMATION APPLICABLE TO THE CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS

CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT

REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF

THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS

PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE

INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND

THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

THE SMALL BUSINESS NAICS CODE IS 811219 and 20.5M. THIS SOLICITATION IS A

SMALL BUSINESS SET-A-SIDE; ALL CAPABLE SMALL BUSINESSES ARE ENCOURAGED

TO APPLY.

1.Requisition or other Purchase Authority: Public Law 92-218

2. Request for Quote

Number: NIHES2015055

3. Issue Date:

September 25, 2015

4. Set Aside:

[] No [X] Yes

5. Title : NIEHS Preventative Maintenance and Repair of Beckman Equipment

6. NAICS: 811219. Size Standard: $20.5 million

7. a. ISSUED BY:

Office of Acquisitions National Institute of Environmental Health Sciences National Institutes of Health 530 Davis Drive Morrisville, NC 27560

7.b. SUBMIT OFFERS TO:

Office of Acquisitions James Bryant National Institute of Environmental Health Sciences National Institutes of Health 530 Davis Drive, Morrisville, NC 27560

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in block 7b. 3:00 pm EST local time on October 9, 2015. Offers will be valid for 60 days unless a different period is specified by the offeror.

9. This solicitation requires delivery of proposals as stated in block 8, IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR

HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF

ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN

ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.212-1, Instructions to Offerors- Commercial Items LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Acquisition Management (SAM) at http://sam.gov prior to award of the contract.

11. FOR INFORMATION CONTACT:

Mr. James Bryant, Contract Specialist: bryant5@niehs.nih.gov with copy to Ms.

Melissa Gentry, Supervisory Contract Specialist: gentry1@niehs.nih.gov.

TELEPHONE CALLS WILL NOT BE ACCEPTED.

SUBMIT ALL QUESTIONS IN WRITING via email to: bryant5@niehs.nih.gov with copy to gentry1@niehs.nih.gov. QUESTIONS MUST BE SUBMITTED NO LATER THAN 3:00 PM EST on October 2, 2015. TELEPHONE INQUIRIES WILL NOT BE

ACCEPTED

http://sam.gov/ mailto:bryant5@niehs.nih.gov mailto:gentry1@niehs.nih.gov mailto:bryant5@niehs.nih.gov mailto:gentry1@niehs.nih.gov

B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The contractor shall provide services at the appropriate training and experience level to perform preventive maintenance, emergency and routine repairs, and relocation of Beckman Instruments as required at the National Institute of Environmental Health Sciences (NIEHS).

ARTICLE B.2. PRICES

a. The final contract will contain the price agreed upon by the Government and the Offeror.

The Government anticipates award from this solicitation will be a fixed price contract.

b. Upon delivery and acceptance of the services described in SECTION C of this contract and identified in the schedule provided below, the Government shall pay to the Contractor the unit price(s) set forth below:

c. The estimated contract amount and quantity of items set forth in paragraphs a. & b. above is not a guarantee that the estimated quantities will be required or ordered.

***Offerors should use Attachment III – Beckman Equipment Service and Repair Pricing Sheet

(Attachment III) for pricing purposes

Base Year (Year 1) Quantity Lot TOTAL Preventative Maintenance and Repair of Government owned Beckman Equipment

1 Lot

Total Estimated Price

ARTICLE B.3. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE I.3. and I.4., this contract consists only of the Base Period specified in the Statement of Work as defined in SECTIONS C and F, for the prices set forth in Section B of this contract.

b. Pursuant to FAR Clause 52.217-8 and FAR Clause 52.217-9, set forth in ARTICLE I.3.

AND ARTICLE I.4. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform the Option Period(s) specified in the Statement of Work as defined in SECTIONS C and F of this contract. If the Government exercises these options, notice must be given before the expiration date of the contract.

Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The fixed price of this contract will be increased as set forth in paragraph c., below.

c. Upon the delivery and acceptance of the Option Services described in SECTION C of the contract and identified in the schedule of charges below, the Government shall pay the Contractor the unit price(s) set forth.

Option Year 1 (Year 2) Quantity Lot TOTAL Preventative Maintenance and Repair of Government owned

Option Year 1 (Year 3) Quantity Lot TOTAL Preventative Maintenance and Repair of Government owned

SECTION C – DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

Preventive Maintenance and Repair of Government-Owned Beckman Instruments The National Institute of Environmental Health Sciences 2015

1. Introduction and Background

The National Institute of Environmental Health Sciences (NIEHS), located in the Research Triangle Park, North Carolina is one of the 27 Institutes and Centers composing the National Institutes of Health. The NIEHS has approximately 164 government-owned Beckman Instruments that are used to support the intramural research program. The instruments to be covered by this contract have been under continuous maintenance following the expiration of their respective warranties. The instruments are therefore considered to be at an acceptable level of upkeep to the Government at the start of this contract.

2. Objective

This contract shall provide services at the appropriate training and experience level to perform preventive maintenance, emergency and routine repairs, and relocation of Beckman Instruments as required at the National Institute of Environmental Health Sciences (NIEHS).

3. General Requirements

The Contractor shall:

• Furnish all necessary personnel, labor, facilities, equipment, parts, materials, and supplies to provide the required technical support and expertise for preventive maintenance, inspection, repair, and relocation of Government-owned Beckman Instruments located at NIEHS facilities.

• Provide preventive maintenance and repair service in accordance to acceptable Commercial Industry Performance Standards.

• Replace, purchase, and dispose of radioactive sources as necessary.

• Remove all trash, discarded parts, dunnage and other material from areas immediately after completion of preventive maintenance or repair. Government-owned dumpsters may be used for disposal for this waste material.

• Attempt to notify the NIEHS users at least forty-eight hours in advance of making preventive maintenance inspections, and shall confirm that the scheduled work will be performed at a time convenient to the user.

• Notify the Contracting Officer’s Representative (COR) when equipment is to be removed from the Government facilities for repairs. NIEHS procedures for removal of Government-owned equipment shall be followed. The COR will provide the contractor with these procedures and appropriate forms.

• Follow the NIEHS Lock-Out/Tag-Out Program requirements as required, depending on the type of repair of preventative maintenance to be performed. The contractor must notify the COR, who will in turn consult with the NIEHS Health and Safety Branch (HSB).

• Provide the following services:

Preventive Maintenance – the contractor shall provide regular preventive maintenance inspections in accordance with acceptable industry standards on all instruments except all Microfuges, which will not receive any preventive maintenance. Preventive maintenance shall be provided to the units as necessary to continue proper performance. An annual preventive maintenance schedule shall be developed by the contractor and provided to the COR no later than 30 days after execution of award and exercising of option periods. Preventive maintenance shall be performed on all equipment listed in Attachment I – Beckman Equipment Listing (Attachment I) to this document. Preventive maintenance of ultracentrifuges shall include an annual boroscopic inspection of all rotors for cracks and other defects. A written report outlining any defects, and their effect on safe operation, shall be provided to the user. Replacement of damaged rotors is the responsibility of the Government.

Emergency Repair – the contractor shall, when notified by the COR or Alternate COR, provide emergency service by responding on-site and begin repairs within 24 hours of the call and exert best efforts to complete the repair within 48 hours. The contractor shall be capable of providing this service 365 days of the year, on a 24 hour-a-day basis, including weekends and holidays.

Routine Repair – the Contractor shall perform all repairs as may be required to restore the instruments to optimum operating capacity. The COR, Alternate COR, or designated laboratory personnel may place calls for repairs; the caller will indicate the equipment in need of repair and its location. This contact with the Contractor will be done by the most convenient means, normally by direct telephone contact or email. The Contractor shall inspect and complete routine onsite repairs to the instruments specified by this contract within forty-eight hours (two work days) after the call has been placed by the NIEHS designated official. However, in the event repair parts have to be ordered the equipment shall not be out of service for more than five workdays, unless approved by the COR. The Contractor shall be required to furnish repair parts that meet or exceed manufacturer standards. Repair parts used by the Contractor must be warranted against defects in materials and workmanship for one year. Equipment shall be maintained by the Contractor to 100% of equipment’s original specifications and technical updates.

Relocations – the Contractor, at the request of the COR or Alternate COR, shall prepare equipment for relocation, and reinstall equipment once it has been moved and assure the NIEHS designated official that the instrument is operating at optimum capacity. The instrument should be moved within 24 hours of the request or on the date specified. Whenever possible, the Contractor shall combine the preventive maintenance inspection with the installation of the instruments following relocation. Arrangements for transportation of the instrument will be the responsibility of the Government.

4. Adding and Deleting Instruments

The items listed in Attachment I shall require preventive maintenance and may require repairs and emergency repair services. The quantity of items shown represent the Government’s current best estimate of the level of service that will be required during the contract period and are intended for price evaluation and funding purposes only. It is conceivable that these quantities may increase or decrease by 25% over the life of the contract. As needed, instruments may be added or deleted from the contract. In each instance the cost to the Government shall be calculated based on the contract unit price, and pro-rated from the time the instrument is added/deleted.

5. Reporting Requirements and Deliverables

The Contractor must provide the following deliverables and reports to the COR, all submissions shall be Section 508 compliant:

Service Reports – the Contractor shall obtain a signature from the responsible user for the instrument on a preventive maintenance and/or service report upon completion of each service call. A copy of the signed preventive maintenance and/or service report shall be left with the responsible user for the instrument. The Contractor shall provide the COR with copies of all preventive maintenance and/or service reports performed within a quarter by the last day of the month following the service. At minimum, each report shall include the following – model number, serial number, NIH decal number (if applicable), location, scientist name, responsible user name, date of service, and cost of service.

Quarterly Summary Report –the quarterly report shall include a summary of the number and types of requests (preventive maintenance, emergency repairs, routine repairs, and relocations) received, and completed. This summary shall be broken down for each type of service and grouped according to the type of service performed. The report should include: model number, serial number, NIH decal number (if applicable), location, scientist name, responsible user name, and date of service.

Servicing Stickers – the Contractor Service Representative shall affix a sticker to each instrument each time that service is performed on the instrument. The sticker shall have the following information – Contractor name and contract number, instrument serial number, service representative name and phone number, and date of service.

History File – the Contractor shall maintain a history file on all PMs/repairs/inspections conducted and must indicate any corrective action taken. The history file shall be 1) reviewed yearly by the COR, 2) the property of the Government and 3) maintained by the Contractor and turned over to the COR upon completion of the contract.

Licenses – The Contractor shall possess the necessary Nuclear Regulatory Commission licenses in accordance with the Code of Federal Regulations, Title 10, Part 20, to replace, purchase, and dispose of radioactive sources as necessary and must be deliverable to the COR within 7 days of award.

6. Inspection and Acceptance Criteria

The COR and/or the Alternate COR will monitor the Contractor’s activities and accomplishments and will indicate acceptance or non-acceptance of the deliverables.

Acceptance is defined as meeting all tasking elements as stated in section 5 above. Each deliverable identified in section 5 will be inspected and either approved or rejected by the COR and/or the Alternate COR. These inspections will occur within 5 working days upon receipt of deliverable.

7. Quality Assurance System

The Contractor’s Quality Assurance System (QAS) is an everyday tool to insure that the Government’s performance standards are being met and should be consistent with Commercial Industry Performance Standards. The system may include, but is not limited to, a written set of self-inspection check lists which comprehensively detects variations from the contract requirements; recording of work data; problem analysis; feedback and control systems for correcting deficiencies; and the necessary documentation to record findings. The contractor shall provide, no later than 30 days after award, documentation to support that the QAS adequately meets the Government’s requirement.

The adequate and efficient management of contractor staff can impact the quality performance of the contract and the Government’s quality assurance surveillance of performance. Quality of performance will be assessed in accordance with Attachment II – Quality Assurance Surveillance Plan (Attachment II). It is for this reason that contractors are encouraged to incorporate industry or commercial standards that are available into their QAS. Further, the Contractor must ensure that their QAS is comprehensive and appropriate for the complexity and criticality of the contracted services.

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with the Statement of Work. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, to be determined is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at: 530 Davis Drive and at the Contractor’s facility can also be 111 T.W Alexander Drive.

d. This contract incorporates the following clauses by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.212-4(a) Inspection and Acceptance (Mar 2009) FAR Clause 52.246-4, Inspection of Services – Fixed-Price (Aug. 1996) FAR Clause 52.246-15 Certified of Conformance (Apr 1984) FAR Clause 52.246-16, Responsibility for Supplies (Apr 1984)

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be one (1) year from date of award plus two

(2) one-year options.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in

Section H of this contract, the period of performance will be increased as listed below:

Option Option Period

Option 1 (Year 2) 12 months upon expiration of base period

Option 2 (Year 3) 12 months upon expiration of Option Year 1

ARTICLE F.2. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY

1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.acquisition.gov/comp/far/index.html

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989) 52.242-17, Government Delay of Work (April 1984).

http://www.acquisition.gov/comp/far/index.html

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract: [To be specified prior to award].

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements;

(2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.4. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH (RC)-2, are attached and made part of this contract.

The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original invoice shall be submitted to the following designated billing office: National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

a. One copy of the invoice shall be submitted to the following approving official:

Contracting Officer OM/Office of Acquisitions National Institutes of Health National Institute of Environmental Health Sciences PO Box 12874 MD K1-05 Research Triangle Park, NC 27709

E-Mail: To be specified at award

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is NIEHS.

b. Central Point of Distribution. For the purpose of this contract, the Central Point of Distribution is NIEHS_OA_Invoices-BranchC@mail.nih.gov.

c. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request.

The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

d. DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract.

[Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

e. Invoice Matching Option. This contract requires a two-way match.

f. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

g. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301)

496-6088.

ARTICLE G.5. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The final performance evaluation will be prepared at the time of completion of work. In addition to the final evaluation, interim evaluations will be prepared annually, on the anniversary date of contract award.

Interim and final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov http://www.cpars.gov/

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. HUMAN SUBJECTS

It is hereby understood and agreed that research involving human subjects shall not be conducted under this contract, and that no material developed, modified, or delivered by or to the Government under this contract, or any subsequent modification of such material, will be used by the Contractor or made available by the Contractor for use by anyone other than the Government, for experimental or therapeutic use involving humans without the prior written approval of the Contracting Officer.

ARTICLE H.2. NEEDLE DISTRIBUTION

The Contractor shall not use contract funds to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

ARTICLE H.3. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.4. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING

INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.5. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in ARTICLE I.3., and ARTICLE I.4 the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-8, Option to Extend Services, and FAR Clause 52.217-9, Option to Extend the Term of the Contract, set forth in ARTICLE I.3. and ARTICLE I.4. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given at least 60 days prior to the expiration date of this contract and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

ARTICLE H.6. INFORMATION AND PHYSICAL ACCESS SECURITY

A. HHS-Controlled Facilities and Information Systems Security

a. To perform the work specified herein, Contractor personnel are expected to have routine (1) physical access to an HHS-controlled facility; (2) physical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

b. To gain routine physical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-05- 24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigations procedures contained in the following documents:

1. HHS Information Security Program Policy ( http://www.hhs.gov/read/irmpolicy/121504.html)

2. HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook, dated February 1, 2005 ( http://www.hhs.gov/ohr/manual/pssh.pdf)

3. HHS HSPD-12 Policy Document, v. 2.0 ( http://www.whitehouse.gov/sites/default/files/omb/assets/ omb/memoranda/fy2005/m05-24.pdf)

4. Information regarding background checks/badges ( http://idbadge.nih.gov/background/index.asp)

c. Position Sensitivity Levels:

This contract will entail the following position sensitivity levels:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

d. The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions - i.e., those above non-sensitive, require more extensive documentation and investigation.

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract that will develop, have the ability to access and/or maintain a Federal Information System(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days after the effective date of the contract. The Contracting Officer shall notify the Contractor of the appropriate level of suitability investigations to be performed. An electronic http://www.hhs.gov/read/irmpolicy/121504.html http://www.hhs.gov/ohr/manual/pssh.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://idbadge.nih.gov/background/index.asp template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: http://ocio.nih.gov/docs/public/Suitability- roster.xls.

Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

e. Investigations are expensive and may delay performance, regardless of the outcome of the investigation.

Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

f. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

g. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

h. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

i. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

B. Standard for Security Configurations, HHSAR 352.239-70, (January 2010)

a. The Contractor shall configure its computers that contain HHS data with the applicable Federal

Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops - regardless of function - but not including servers.

http://ocio.nih.gov/docs/public/Suitability-roster.xls http://ocio.nih.gov/docs/public/Suitability-roster.xls http://nvd.nist.gov/fdcc/index.cfm

b. The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

c. The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings - see http://nvd.nist.gov/validation.cfm. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products met the latest FDCC major version and subsequent major versions.

d. The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

e. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

f. The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant ( http:// csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

g. The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

C. Standard for Encryption language, HHSAR 352.239-71, (January 2010)

a. The Contractor shall use Federal Information processing Standard (FIPS) 140-2-compliant encryption (Security) Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered "sensitive" in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004).

b. The Contractor shall verify that the selected encryption product has been validated under the

Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

c. The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the

HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

d. The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

http://nvd.nist.gov/validation.cfm http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/cryptval/ http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

e. The Contractor shall ensure that this standard is incorporated into the Contractor's property management/ control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

f. The Contractor shall ensure that its subcontractors (all tiers) which perform work under this contract comply with the requirements contained in this clause.

D. Security Requirements For Federal Information Technology Resources, HHSAR 352.239-72, (January 2010)

a. Applicability. This clause applies whether the entire contract or order (hereafter "contract"), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term "information technology (IT)", as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

b. Contractor responsibilities. The Contractor is responsible for the following:

1. Protecting Federal information and Federal information systems in order to ensure their -

a. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

b. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

c. Availability, which means ensuring timely and reliable access to and use of information.

2. Providing security of any Contractor systems, and information contained therein, connected to an

HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

3. Adopting, and implementing, at a minimum, the policies, procedures, controls and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

c. Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

1. IT Security Plan (IT-SP) - due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

a. The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E- Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

i. Office of Management and Budget (OMB) Circular A-130, Management of

Federal Information Resources, Appendix III, Security of Federal Automation Information Resources.

ii. National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-

18, Guide for Developing Security Plans for Information Systems, in form and content, and with any pertinent contract Statement of Work (SOW) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommend Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

iii. HHS-OCIO Information Systems Security and Privacy Policy.

2. IT Risk Assessment (IT-RA) - due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

3. FIPS 199 Standards for Security Categorization of Federal Information and Information

Systems Assessment (FIPS 199 Assessment) - due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the

FIPS

199 Assessment and incorporate the Contractor's final version into the contract.

4. IT Security Certification and Accreditation (IT-SC&A) - due within 3 months after contract award.

The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems - see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security, Certification and Accreditation of Federal Information Systems; and NIST 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provided it to the Contracting Officer for review, comment, and acceptance.

a. After resolution of any comments provided by the Government on the draft IT SC&A, the

Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

b. The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

i. Annual testing of the system contingency plan; and

ii. The performance of security control testing and evaluation.

d. Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in "HHS-Controlled Facilities and Information Systems Security" requirements specified in the SOW/PWS of this contract.

e. Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

f. Government access for IT inspection. The Contractor shall afford the Government access to the

Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of

HHS.

g. Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph

(a) of this clause, including those subcontracts that –

a. Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

b. Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

h. Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

i. Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

j. Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

k. Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

(End of Clause)

Note: The NIST Special Publication SP-800-26 cited in subparagraph c.1.a.(ii) of this clause has been superseded by NIST SP 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations" for use for the assessment of security control effectiveness.

See http://csrc.nist.gov/ publications/PubsSPs.html to access NIST Special Publications (800 Series).

E. Additional NIH Requirements

1. SECURITY CATEGORIZATION OF FEDERAL INFORMATION AND INFORMATION

SYSTEMS (FIPS 199 Assessment)

a. Information Type:

[X] Administrative, Management and Support Information

[X] Mission Based Information

b. Security Categories and Levels:

Confidentiality Level: [X] Low [ ] Moderate [ ] High

Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level:

Overall Level:

[X] Low

[ ] Low

[ ] Moderate

[X] Moderate

[ ] High

[ ] High

c. In accordance with HHSAR Clause 352.239-72, the contractor shall submit a FIPS 199 Assessment within 30 days after contract award. Any differences between the contractor's assessment and the information contained herein, will be resolved, and if required, the contract will be modified to incorporate the final FIPS 199 Assessment.

2. INFORMATION SECURITY TRAINING

In addition to any training covered under paragraph (e) of HHSAR 352.239-72, the contractor shall comply with the below training:

a. Mandatory Training

i. All Contractor employees having access to (1) Federal information or a…