RFQ_NIHES2017096_NWG_-_EHP.pdf

NIHES2017096

SOLICITATION

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY QUOTER INTERESTED IN RESPONDING TO THIS SOLICITATION. ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE QUOTER (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Quoter's submission and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION

PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT

SCHEDULE IS INTENDED TO PROVIDE THE QUOTER WITH THE NECESSARY INFORMATION TO

UNDERSTAND THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

NOTE: The North American Industry Classification Service (NAICS) code is 519130 with a size standard of 1,000 employees. This solicitation is set-aside on a total small business basis; all potential small business concerns are encouraged to apply.

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: ______________________________

2. Request for Quote (RFQ)

Number: NIHES2017096

3. Issue Date: November 8, 2016

4. Set Aside:

[ ] No

[X] Yes {Total Small Business}

5. Title: News Writing, Graphics, & Podcasts – Environmental Health Perspectives

6. ISSUED BY:

Office of Acquisitions

National Institutes of Health

National Institute of Environmental Health

Sciences 530 Davis Drive

Morrisville, NC 27560

7. SUBMIT OFFERS TO:

See Part IV Section L - Instructions, Conditions, and Notices to Offerors, Article L.4.2

8. Quotes for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Section L - Instructions, Conditions, and Notices to Offerors, Article L.4.2," until 10:00 am local time on December 8, 2016. Offers will be valid for 120 days unless a different period is specified by the Quoter.

9. This solicitation requires delivery of quotes as stated in Section L - Instructions, Conditions, and Notices to

Offerors, Article L.4.2," If quotes are required to be delivered to two different locations, the OFFICIAL POINT

OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF

ACQUISITIONS.

IF YOUR QUOTE IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE

PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED

LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.212-1, Instructions to Offerors-Commercial Items, LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Quoters must be registered in the System for Award Management (SAM) prior to award of a contract.

Quoters must access the CCR through The System for Award Management (SAM) at http://www.sam.gov

11. FOR INFORMATION CALL: Uché Washington

PHONE: (919) 541-0423

E-MAIL: Uche Washington, uche.washington@nih.gov;

COLLECT CALLS WILL NOT BE ACCEPTED.

Uche Washington Contracting Officer Office of Acquisitions, NIEHS http://www.sam.gov/ mailto:E-MAIL:

mailto:uche.washington@nih.gov

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Institute of Environmental Health Sciences (NIEHS) publishes the monthly scientific journal Environmental Health Perspectives (EHP). EHP is a world-renowned journal that helps the NIEHS to implement its strategic plan of advancing science and improving health. The purpose of this requirement is to provide news writing, graphics, and podcast support services for the monthly scientific journal EHP. The contractor shall commission news articles for publication in the scientific journal Environmental Health Perspectives (EHP) and on its website; obtain graphics for use and publication with EHP materials, based on guidance and feedback from EHP staff; and create podcasts for publication based on EHP guidance. The requirement has an anticipated five

(5) year ordering period (April 1, 2017 through March 31, 2022). The EHP requires a one (1) month phase in period within the first year. The phase in period shall be from April 1, 2017 through April 30, 2017. A Fixed Price (FP) requirements contract with a total estimated ceiling of $3,557,975.61 for this acquisition. The requirement currently includes defined and undefined tasks that will be issued as task orders. As needed task orders will be placed by the NIEHS. Specific performance dates, locations, and tasks will be specified on task order Performance Work Statements (PWSs). The types of orders that are authorized for use under this requirements contract are fixed price orders only. The number of awards anticipated as a result of the solicitation is one (1).

ARTICLE B.2. PRICES/COSTS

ITEM # DESCRIPTION UNIT ESTIMTED AMOUNT

0001 Services Dollars $3,557,975.61

News Writing, Graphics, & Podcasts - Environmental Health Perspectives The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to execute a broad range of news writing, graphics, and podcast support services for the monthly scientific journal EHP. Services (as specified in each task order under the resulting contract) shall be performed in strict compliance with the Attachment I – the Performance Work Statement (PWS), Attachment II - Quality Assurance Requirements Summary (QARS), Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other provisions contained herein.

Ordering Period: April 1, 2017 through March 31, 2022

FOR INFORMATIONAL

PURPOSES ONLY –

DO NOT CHANGE

NUMBERS BELOW OR

ABOVE THIS BOX

ESTIMATED AMOUNT $3,557,975.61

The final contract will contain the price provisions agreed upon by the Government and the Quoter.

ARTICLE B.3. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE I.8.

ADDITIONAL CONTRACT CLAUSES IN FULL TEXT, this contract consists only of the Base Period specified in the Statement of Work as defined in SECTIONS C and F, for the price set forth in ARTICLE B.2. of this contract.

b. Pursuant to FAR Clause 52.217-8 set forth in ARTICLE I.8. ADDITIONAL CONTRACT CLAUSES IN FULL TEXT of this contract, the Government may, by unilateral contract modification, require the Contractor to perform the Option Period(s) specified in the Statement of Work as defined in SECTIONS C and F of this contract. If the Government exercises this option, notice must be given before the expiration date of the contract. Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The fixed price of this contract will be increased as set forth in paragraph c., below.

ARTICLE B.4. ADVANCE UNDERSTANDINGS

a. Non-Personal Services and Inherently Government Functions

(1) Pursuant to FAR 37.1, no personal services shall be performed under this contract. All work requirements shall flow only from the Contracting Officer's Representative (COR) to the Contractor's Project Manager. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor.

If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

(2) Pursuant to FAR 7.5, the Contractor shall not perform any inherently governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government contractors in connection with this contract, the Contractor employee shall state that they have no authority to in any way change the contract and that if the other contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

(3) The Contractor shall insure that all of its employees working on this contract are informed of the substance of this article. Nothing in this article shall limit the Government's rights in any way under the other provisions of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this article shall be included in all subcontracts at any tier.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. GENERAL PERFORMANCE WORK STATEMENT

a. Independently and not as an agent of the Government, the Contractor shall provide news writing, graphics, and podcast support services for the scientific journal EHP, not otherwise provided by the Government, as needed to perform the PWS, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments). The PWS provided at Section J, sets forth a general description of work to be ordered under the resulting contract (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

a. All reports required herein shall be submitted in electronic format. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

b. All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

c. All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

d. The SOW provided at Section J, Attachment I, sets forth the description of reports to be submitted under the resulting contract.

http://www.hhs.gov/web/508/index.html

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with the PWS.

At a minimum; all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, to be determined is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Institute of Environmental Health Sciences 111 T. W. Alexander Drive Research Triangle Park, NC 27709

The COR and/or the Alternate COR will monitor the Contractor’s activities and accomplishments and will indicate acceptance or non-acceptance of the deliverables. The deliverables identified above will be inspected and either approved or, if they are not acceptable, rejected by the COR and/or the Alternate COR. Such inspections will occur as determined to be necessary by the COR and/or Alternate COR.

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

The Government reserves the right to an Inspection period of 30 calendar days, unless a different time period is stated when (the Record of Call/elsewhere in the contract). The receiving report, completed and signed by the appropriate official, constitutes acceptance and shall be acknowledged to the payment office (OFM).

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

1. FAR Clause 52.246-4 Inspection of Services -- Fixed-Price AUG 1996

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be five (5) year ordering period (April 1, 2017 through March 31, 2022).

b. If the Government exercises its option pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below

Option Option Period

Option to Extend April 1, 2022 thru October 30, 2022

ARTICLE F.2. DELIVERIES

a. Satisfactory performance of this contract shall be deemed to occur upon performance of the work described in the Description Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the Services specified in the Delivery Schedule which are described in SECTION C of this contract.

b. Deliveries required by the Contractor shall be made F.o.b. destination as set forth in FAR Clause 52.247-35, F.o.b. Destination, within consignees Premises (April 1984) [and any specifications stated in SECTION D, PACKAGING AND MARKING AND SHIPPING, of this contract] to the address/addressee listed below:

c. Unless otherwise specified, deliveries shall be made to the Delivery Point specified above Mondays through Fridays (excluding Federal Holidays) between the hours of 8:30 a.m. and 5:30 p.m. EST only.

Supplies or services scheduled for delivery on a Federal holiday shall be made the following day.

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY 1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.acquisition.gov/far .

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

1. FAR Clause 52.242-15 Stop Work Order AUG 1989

2. FAR Clause 52.242-17 Government Delay of Work APR 1984 http://www.acquisition.gov/far

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract: [To be designated after award]

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH (RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original contract invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

b. One copy of the contract invoice shall be submitted to the following approving official:

Contracting Officer Uché Washington NIH/NIEHS, OM, Office of Acquisitions 530 Davis Drive, Room 1043 P.O. Box 12233, MSC: K1-04, Room 1048 Research Triangle Park, NC 27709 E-mail: uche.washington@nih.gov

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note: The original payment request must still be submitted in hard copy mailto:uche.washington@nih.gov and mailed to the designated billing office to meet the requirements of a "proper invoice."]

Central Point of Distribution:

The Contractor shall submit an electronic copy of the payment request to the Central Point of Distribution mailbox. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

b. Inquiries regarding payment of contract invoices shall be directed to the designated billing office, (301) 496-

6452.

ARTICLE G.3. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared annually as follows on the anniversary dates of the contract.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations Contractors may access evaluations through a secure Web site for review and comment at the following address: http://www.cpars.gov

ARTICLE G.4. KEY PERSONNEL, HHSAR 352.237-75 (DECEMBER 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The following individual(s) is/are considered to be essential to the work being performed hereunder:

KEY PERSONNEL

Title Name

Project Manager

(End of Clause) http://www.cpars.gov/

ARTICLE G.5. ADDENDUM TO FAR CLAUSE 52.216-18 ORDERING

Add (d), Ordering Procedures:

a. As needed task orders will be placed by the NIEHS.

b. Task orders are for estimated quantities.

c. Specific performance dates, locations, and task will be specified on task orders IAW the PWS.

d. The Government will request pricing for a task order via e-mail and shall include a PWS describing the work needed. The contractor shall provide a fixed price quote via e-mail and shall include a price breakout in accordance with the Contract Pricing Matrix. The price breakout shall include a total price and the following information, unless otherwise stated.

Writing Assignments price per word and total number of words

Graphics price per figure and total numbers of figures

Podcasts price per length and total time

e. All task orders shall be invoiced separately. All invoices shall be reconciled with actuals prior to billing to indicate the total price and shall always be billed in one (1) line item. The invoice shall also include a separate page with the reconciled price breakout in Article G.5.d above.

(End of Addendum)

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. NEEDLE EXCHANGE, HHSAR 352.270-12 (December 2015) The Contractor shall not use any funds obligated under this contract to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

(End of clause)

ARTICLE H.2. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for quotes, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.3. LIMITATION ON USE OF FUNDS FOR PROMOTION OF LEGALIZATION OF CONTROLLED

SUBSTANCES

The Contractor shall not use contract funds to support activities that promote the legalization of any drug or other substance included in schedule I of the schedules of controlled substances established under section 202 of the Controlled Substances Act, except for normal and recognized executive-congressional communications. This limitation shall not apply when the Government determines that there is significant medical evidence of a therapeutic advantage to the use of such drug or other substance or that federally sponsored clinical trials are being conducted to determine therapeutic advantage.

ARTICLE H.4. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.5. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the five (5) year ordering period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-8, Option to Extend the Services set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the PWS and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given any time prior to the expiration date of this contract and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

ARTICLE H.6. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is: http://oig.hhs.gov/fraud/hotline/ and the mailing address is:

US Department of Health and Human Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489 Washington, D.C. 20026

ARTICLE H.7. INFORMATION AND PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The following requirements apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

http://oig.hhs.gov/fraud/hotline/

a. Access (Physical or Logical) to Federal Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, physical (entry and documentation) or logical (electronic) access to federal information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the FAR Subpart 2.1 definition of “information technology” (IT), the term as used in this section, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources.

2) Safeguarding Information and Information Systems. The Contractor (and/or any subcontractor) shall:

a. Protect federal information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location per clause 52.239-1 of the Federal Acquisition Regulation (FAR) (https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html).

The Contractor is prohibited from subcontracting to companies to conduct HHS business in which foreign governments that support international terrorism have a “significant interest” per 10 U.S.C. § 2327 (https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm).

c. Adopt, and implement the policies, procedures, controls, and standards required by HHS Information Security Program to ensure the confidentiality, integrity, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. The HHS Information Security Program security requirements are outlined in the HHS IS2P, which is accessible on the HHS Office of the Chief Information Officer’s (OCIO) website and can be obtained by contacting fisma@hhs.gov. Please see HHS HSPD-12 guidance.

3) Information Security Categorization. In accordance with FIPS-199

(http://csrc.nist.gov/publications/http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf) and the Federal Information Processing Standard NIST SP 800-60, “Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories”, Appendix C, Table C-2 at Vol 2 (http://csrc.nist.gov/publications/) and based on information provided by the ISSO, CISO, or other security representative, the Security Level for each Security Category and the Overall Security Level, which is the highest level of the three, factors (Confidentiality, Integrity, and Availability) of the information or information system is below.

Confidentiality Level: [x] Low [ ] Moderate [ ] High Integrity Level: [x] Low [ ] Moderate [ ] High Availability Level: [x] Low [ ] Moderate [ ] High Overall Level: [x] Low [ ] Moderate [ ] High

For additional information, see NIST SP 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendices C and D.

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, the PII Confidentiality Impact Level has been determined to be:

Overall Level: [x] No PII [ ] N/A [ ] Low [ ] Moderate [ ] High

For additional information, see NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm http://www.hhs.gov/ocio/policy/index.html http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Information.

4) Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol shall comply with FAR sections: FAR 7.105(b)(5), FAR 11.002(g), and FAR 12.202(e) (https://www.acquisition.gov/?q=browsefar).

5) Controlled Unclassified Information (CUI). All information about the systems gathered or created under this contract shall be considered as Controlled Unclassified Information (CUI) and marked appropriately.

a. CUI, sensitive/proprietary data, and/or equipment will only be disclosed to authorized personnel on a Need-To- Know basis.

b. Contractors (and/or any subcontractors) processing CUI incidental to developing a product or service for NIEHS or storing government information on a system that has not been authorized by the agency must meet the requirements of NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations (http://csrc.nist.gov/publications/).

c. When no longer required, this information and/or data will be returned to HHS control, destroyed, or held until otherwise directed. Destruction of information and/or data shall be accomplished by following NIST SP 800-88, Guidelines for Media Sanitization (http://csrc.nist.gov/publications/).

6) Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Contracting Officer’s Representative (COR), with a copy to the Contracting Officer, within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

7) Contract Documentation. The Contractor shall use templates, policies, forms and other documents necessary, which will be provided by NIEHS, in order to comply with contract deliverables as appropriate. All contract deliverables shall be compliant with Section 508 (http://www.hhs.gov/ocio/policy/508_policy.html#3Scope).

8) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption Language in HHS Contracts

(http://www.hhs.gov/ocio/policy/index.html) to prevent unauthorized access to federal information.

b. Use FIPS 140-2, Security Requirements for Cryptographic Module (http://csrc.nist.gov/publications/) compliant encryption to protect all instances of HHS sensitive information during storage and transmission

c. Verify that the encryption product used by the Contractor has been validated under the Cryptographic Module

Validation Program (http://csrc.nist.gov/publications/) to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

d. Use the Key Management Key (http://csrc.nist.gov/publications/) on the HHS personal identification verification

(PIV) card; or alternatively, the Contractor (and/or any subcontractor) shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (OMB Encryption Guidance at http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the COR and/or Contracting Officer of personnel authorized to decrypt and recover all encrypted information.

e. Ensure that their equipment and devices meet HHS and NIEHS-specific encryption standard requirements

(http://www.hhs.gov/ocio/policy/2009-0002.001s.html) or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive federal information (including PII).

f. Ensure that encryption keys are provided to the COR upon request and at the conclusion of the contract.

9) Protection of Sensitive Information. All federal information that is or may be sensitive (as defined in the https://www.acquisition.gov/?q=browsefar http://www.hhs.gov/ocio/policy/508_policy.html#3Scope http://www.hhs.gov/ocio/policy/index.html http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://www.hhs.gov/ocio/policy/2009-0002.001s.html

Departmental Standard for the Definition of Sensitive Information) shall be protected in accordance with Office of Management and Budget (OMB) Memorandum (M) 06-16 (https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf), Protection of Sensitive Agency Information and encrypted with Federal Information Processing Standard (FIPS) 140-2 compliant solution.

10) Contractor Agreement. The Contractor (and/or any subcontractor), performing under this contract, shall not release, publish, or disclose non-public federal information to unauthorized individuals. The confidentiality, integrity, and availability of such information shall be protected by the Contractor in accordance with the governing laws and regulations listed as follows:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

(https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html)

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

(https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf)

c. Public Law 96-511 (Paperwork Reduction Act) (http://ciog6.army.mil/Portals/1/Policy/Paper Reduction 1980.pdf)

11) Contractor Employee Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public federal information under this contract shall complete NIEHS Commitment to Protect Non-Public Information – Contractor Employee Agreement. A copy of each signed and witnessed NDA shall be submitted to the COR and Contracting Officer prior to performing any work under this acquisition (See Appendix C for the HHS Contractor Non-Disclosure Agreement).

12) Privacy or Security Safeguards (FAR Clause 48 CFR § 52.239-1). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.239-1 privacy and security requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

13) Confidential Information (HHSAR Clause 48 CFR § 352.224-71). The Contractor (and/or any subcontractor) shall comply with HHSAR Clause 48 CFR § 352.224-71 requirements, which can be located at:

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

14) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment – The contractor will support the creation of new PTA forms and PIA forms as required.

a. The Contractor shall assist the NIEHS Privacy Officer (or his or her designee) with conducting a PTA (using the Privacy Impact Assessment [PIA] form) for the information system and/or information collection project to determine whether or not a full PIA needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor shall assist the NIEHS Privacy Officer (or his or her designee) and other designated authorities with completing a PIA for the system or project within after completion of the PTA.

The Contractor shall assist the NIEHS Privacy Officer in completing a PIA in accordance with HHS policy, OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002(https://www.whitehouse.gov/omb/memoranda_m03-22) and shall be revised at each milestone during the system development lifecycle (SDLC).

PIAs and PTAs are required in the early stages of system development. The Contractor shall assist the NIEHS Privacy Officer in reviewing PIAs within 3 years of the last PIA approval date and/or updated as needed based on a major change to the system or when new types of PII are collected, that introduces new or increased privacy risks.

B. Incident Response

1) In the event of a breach, the Contractor (and/or any subcontractor) shall report all suspected and confirmed https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html information security and privacy incidents to the NIEHS ISSO (isso@niehs.nih.gov), COR, Contract Officer, SOP (or his or her designee), and other stakeholders, including incidents involving personally identifiable information (PII), in electronic or physical form, within 1 hour of discovery. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

2) In reporting a breach, the Contractor (and/or any subcontractor) shall:

a. comply with FAR 52.239-1(c) Privacy or Security Safeguards) and HHS/NIEHS Incident Response Policy.

b. not include any sensitive information in the subject or body of any reporting e-mail.

c. use a FIPS 140-2 validated encryption solution to protect sensitive information in attachments to email, media, etc.

3) The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

Incident response activities determined to be required by the Government may include, but are not limited to, the following:

a. Inspections,

b. Investigations,

c. Forensic reviews,

d. Containment and damage assessment, and

e. Data analysis and processing.

C. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, EPLC processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All IT systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology (http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf) and the HHS Contract Closeout Guide (2012).

2) Providing System Documentation at Contract Expiration. Contractors (and/or any subcontractors) must follow and adhere to National Institute of Standards and Technology NIST SP 800-64, Security Considerations in the System Development Life Cycle (latest revision), at a minimum, for system development. This requirement may include providing system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review.

3) Certification of Sanitization of Government and Government-Activity-Related Files and Information. As part of contract closeout, the Contractor shall submit the certification to the COR and/or Contracting Officer following the template provided in NIST SP 800-88, Guidelines for Media Sanitization (http://csrc.nist.gov/publications/) at the expiration of the contract.

4) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all federal information and IT resources (i.e., federal information in contractor-owned and/or sub-contractor-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all federal information has been properly sanitized and purged, in accordance with HHS and/or NIEHS policies, from Contractor-owned systems, including backup systems and media used during contract performance.

http://www.hhs.gov/ocio/eplc-lifecycle-framework.pdf

D. Audit Record Retention The Contractor (and/or any subcontractor) shall maintain all information in accordance with NARA records retention policies and NIEHS-specific policies.

E. Privacy Incident Handling and Notification

1) In an instance of a suspected or confirmed breach of PII, the Contractor (and/or any subcontractor) shall refer to instructions in the Incident Response section. In addition, the Contractor shall not notify affected individuals unless so instructed by the Contracting Officer. If so instructed by the Contracting Officer, the Contractor shall send notifications to affected individuals within 3 days.

2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

a. Inspections,

b. Investigations,

c. Forensic reviews, and

d. Data analysis and processing.

F. Privacy Plan The Contractor (and/or any subcontractor) shall submit a privacy plan with its technical proposal, in accordance with the HHS IS2P, that safeguards data and protects the confidentiality of PII (NIST 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information, http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf and NIST SP 800-53, Revision 4, Appendix J http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf );the plan shall:

1) Verify the information categorization to ensure the identification of the PII requiring protection.

2) Verify the existing system risk assessment.

3) Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

4) Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

5) Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the SOW.

6) For PII to be physically transported to or stored at a remote site, verify that the security and privacy controls of

NIST Special Publication 800-53 , latest version, involving the encryption of transported information will be implemented.

7) When applicable, verify how the NIST Special Publication 800-53, latest version, security and privacy controls requiring authentication, virtual private network (VPN) connections and other technical safeguards will be implemented.

8) When applicable, verify how the NIST Special Publication 800-53, latest version, security controls enforcing allowed downloading of PII will be implemented.

9) Identify measures to ensure subcontractor compliance with safeguarding PII and security and privacy controls in the NIST 800-53.

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

10) Be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels.

11) Be evaluated by the Government for appropriateness and adequacy.

G. Privacy Act

1) Privacy Act Notification (FAR Clause 48 CFR § 52.224-1). The Contractor (and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.224-1 requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar.

2) Privacy Act (FAR Clause 48 CFR § 52.224-2). The Contractor (and/or any subcontractor) shall comply with FAR

Clause 48 CFR § 52.224-2 requirements, which can be located at: https://www.acquisition.gov/?q=browsefar.

3) Privacy Act (HHSAR Clause 48 CFR §352.224-70). The Contractor (and/or any subcontractor) shall comply with

HHSAR Clause 48 CFR §352.224-70 requirements, which can be located at:

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

4) The contractor (and/or any subcontractor) are subject to criminal penalties for violations of the Act (5 U.S.C.

552a(i)) to the same extent as employees of the Department of Health and Human Services. The contractor does hereby agree and assures that each one of its employees know the prescribed rules of conduct, and each employee is aware that he/she can be subjected to criminal penalties for violations of the Act. A copy of the rules of conduct and other requirements are set forth in 45 CFR Part 5b.

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

PART II - CONTRACT CLAUSES SECTION I CONTRACT CLAUSES

THE FOLLOWING ARTICLE I.1. GENERAL CLAUSE LISTING(S) WILL BE APPLICABLE TO MOST CONTRACTS

RESULTING FROM THIS RFQ. HOWEVER, THE ORGANIZATIONAL STRUCTURE OF THE SUCCESSFUL

QUOTER(S) WILL DETERMINE THE SPECIFIC GENERAL CLAUSE LISTING TO BE CONTAINED IN THE

CONTRACT(S) AWARDED FROM THIS RFQ:

ARTICLE I.1. The clause at 52.212-4, Contract Terms and Conditions- Commercial Items (MAY 2015) is incorporated in the solicitation and contract by reference. For full text see https://www.acquisition.gov/far/current/ html/52_212_213.html#wp1179465

ARTICLE I.2. The clause at 52.252-2, Clauses Incorporated by Reference (FEB 1998) is incorporated in the solicitation by full text below:

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): http://farsite.hill.af.mil/vffara.htm and http://farsite.hill.af.mil/vfhhsara.htm.

(End of clause)

ARTICLE I.3. The clause at 52.212-5, -- Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items is incorporated in the solicitation by full…