Amendment_000001_NIHES2017101.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICAITON NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a)By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPIRATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc. ) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION ( Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

NSN 7540-01-152-8070

Previous edition unusable

NIHES2017101

000001

SOLICITATION

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY QUOTER INTERESTED IN RESPONDING TO THIS SOLICITATION. ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION, AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE QUOTER (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Quoter's submission and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION

PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT

SCHEDULE IS INTENDED TO PROVIDE THE QUOTER WITH THE NECESSARY INFORMATION TO

UNDERSTAND THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

NOTE: The North American Industry Classification Service (NAICS) code is 519130 with a size standard of 1,000 employees. This solicitation being competed on a full and open/unrestricted basis; all potential Quoters are encouraged to apply.

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: ______________________________

2. Request for Quote (RFQ)

Number: NIHES2017101

3. Issue Date: September 1, 2017

4. Set Aside:

[X] No {Unrestricted}

[ ] Yes

5. Title: Journal Web Hosting – Environmental Health Perspectives (EHP)

6. ISSUED BY:

Office of Acquisitions

National Institutes of Health

National Institute of Environmental Health Sciences

530 Davis Drive

Morrisville, NC 27560

7. SUBMIT OFFERS TO:

See Part IV Section L - Instructions, Conditions, and Notices to Offerors, Article L.4.2

8. Quotes for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Section L - Instructions, Conditions, and Notices to Offerors, Article L.4.2," until 2:00 pm local time on October 3, 2017. Offers will be valid for 120 days unless a different period is specified by the Quoter.

9. This solicitation requires delivery of quotes as stated in Section L - Instructions, Conditions, and Notices to

Offerors, Article L.4.2," If quotes are required to be delivered to two different locations, the OFFICIAL POINT

OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF

ACQUISITIONS.

IF YOUR QUOTE IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE

PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED

LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.212-1, Instructions to Offerors-Commercial Items, LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Quoters must be registered in the System for Award Management (SAM) prior to award of a contract.

Quoters must access the CCR through The System for Award Management (SAM) at http://www.sam.gov

11. FOR INFORMATION CALL: Uché Washington

PHONE: (919) 541-0423

E-MAIL: Uche Washington, uche.washington@nih.gov;

COLLECT CALLS WILL NOT BE ACCEPTED.

Uche Washington Contracting Officer Office of Acquisitions, NIEHS http://www.sam.gov/ mailto:E-MAIL:

mailto:uche.washington@nih.gov

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Institute of Environmental Health Sciences (NIEHS) publishes the monthly scientific journal Environmental Health Perspectives (EHP). EHP is a world-renowned journal that helps the NIEHS to implement its strategic plan of advancing science and improving health. The purpose of this requirement is to provide journal web hosting for a new website on an established third-party, separately hosted journals-publishing platform in support of the scientific journal EHP. The platform must be able to ingest EHP production content without specific manual conversions, and must offer uninterrupted access to users worldwide. The platform must be versatile enough to handle our multiple types of content (Research, News, Abstracts, Collections, Podcasts) and our international/translated content, and should do so through a single site/platform. The service must also be robust enough to serve our users throughout the world. Being a fully open-access journal, the site must offer unfettered access to all readers in all countries. The requirement has an anticipated one (1) year base period (January 31, 2018 through January 30, 2019 (inclusive of a nine (9) month phase-in period)) with four 1-year option periods.

The phase in period shall be from January 31, 2018 through October 30, 2018. A Firm Fixed Price (FFP) contract type is anticipated. The number of awards anticipated as a result of the solicitation is one (1).

ARTICLE B.2. PRICES/COSTS

ITEM # DESCRIPTION QUANTITY UNIT UNIT PRICE NET AMOUNT

0001 12 Monthly $ ______________ $ ______________

Journal Web Hosting – Environmental Health Perspectives (Base Year) The Contractor shall provide all qualified personnel, labor, materials (hardware, internet access), travel, other items, and non-personal services necessary to provide journal web hosting for a brand-new website on an established third-party, separately hosted journal-publishing platform as required at the NIEHS, RTP, North Carolina in strict compliance with the contract, Attachment I – the Performance Work Statement (PWS), Attachment II - Quality Assurance Requirements Summary (QARS), Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other provisions contained herein.

Performance Period: January 31, 2018 – January 30, 2019

The final contract will contain the price provisions agreed upon by the Government and the Quoter.

ARTICLE B.3. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE I.8.

ADDITIONAL CONTRACT CLAUSES IN FULL TEXT, this contract consists only of the Base Period specified in the Statement of Work as defined in SECTIONS C and F, for the price set forth in ARTICLE

B.2. of this contract.

b. Pursuant to FAR Clause 52.217-9 set forth in ARTICLE I.8. ADDITIONAL CONTRACT CLAUSES IN

FULL TEXT of this contract, the Government may, by unilateral contract modification, require the

Contractor to perform the Option Period(s) specified in the Statement of Work as defined in SECTIONS

C and F of this contract. If the Government exercises this/these option(s), notice must be given before the expiration date of the contract. Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The fixed price of this contract will be increased as set forth in paragraph c., below.

c. Upon the delivery and acceptance of the Option Services described in SECTION C of the contract and identified in the schedule of charges below, the Government shall pay the Contractor the unit price(s) set forth in the following tables:

0002 12 Monthly $ ______________ $ ______________

Journal Web Hosting – Environmental Health Perspectives (Option 1) The Contractor shall provide all qualified personnel, labor, materials (hardware, internet access), travel, other items, and non-personal services necessary to provide journal web hosting for EHP’s website on an established third-party, separately hosted journal-publishing platform as required at the NIEHS, RTP NC in strict compliance with the Attachment I – the PWS, Attachment II - QARS, Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other provisions contained herein.

Performance Period: January 31, 2019 – January 30, 2020

0003 12 Monthly $ ______________ $ ______________

Journal Web Hosting – Environmental Health Perspectives (Option 2) The Contractor shall provide all qualified personnel, labor, materials (hardware, internet access), travel, other items, and non-personal services necessary to provide journal web hosting for EHP’s website on an established third-party, separately hosted journal-publishing platform as required at the NIEHS, RTP NC in strict compliance with the Attachment I – the PWS, Attachment II - QARS, Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other

Performance Period: January 31, 2020 – January 30, 2021

0004 12 Monthly $ ______________ $ ______________

The Contractor shall provide all qualified personnel, labor, materials (hardware, internet access), travel, other items, and non-personal services necessary to provide journal web hosting for EHP’s website on an established third-party, separately hosted journal-publishing platform as required at the NIEHS, RTP NC in strict compliance with the Attachment I – the PWS, Attachment II - QARS, Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other

Performance Period: January 31, 2021 – January 30, 2022

0005 12 Monthly $ ______________ $ ______________

Journal Web Hosting – Environmental Health Perspectives (Option 4) The Contractor shall provide all qualified personnel, labor, materials (hardware, internet access), travel, other items, and non-personal services necessary to provide journal web hosting for EHP’s website on an established third-party, separately hosted journal-publishing platform as required at the NIEHS, RTP NC in strict compliance with the Attachment I – the PWS, Attachment II - QARS, Attachment III - Reporting and Deliverable Schedule, and all specifications, terms, conditions, clauses, and all other

Performance Period: January 31, 2022 – January 30, 2023

**All pricing shall be to two (2) decimal places. If submitted, all formulas, lookup tables, and links should be intact, and no links should exist to files not included with the quote. Spreadsheets shall not contain hidden worksheets.

CLIN 0001 - Base Period Total: $________________________

CLIN 0002 - 1st Option Period Total: $________________________

CLIN 0003 - 2nd Option Period Total: $________________________

CLIN 0004 - 3rd Option Period Total: $________________________

CLIN 0005 - 4th Option Period Total: $________________________

GRAND TOTAL: $________________________

ARTICLE B.4. ADVANCE UNDERSTANDINGS

a. Non-Personal Services and Inherently Government Functions

(1) Pursuant to FAR 37.1, no personal services shall be performed under this contract. All work requirements shall flow only from the Contracting Officer's Representative (COR) to the Contractor's Project Manager. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor.

If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

(2) Pursuant to FAR 7.5, the Contractor shall not perform any inherently governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government contractors in connection with this contract, the Contractor employee shall state that they have no authority to in any way change the contract and that if the other contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

(3) The Contractor shall insure that all of its employees working on this contract are informed of the substance of this article. Nothing in this article shall limit the Government's rights in any way under the other provisions of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this article shall be included in all subcontracts at any tier.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. PERFORMANCE WORK STATEMENT

a. Independently and not as an agent of the Government, the Contractor shall provide Journal Web Hosting support services for the scientific journal EHP, not otherwise provided by the Government, as needed to perform the PWS, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments). The PWS provided at Section J, sets forth a general description of work to be ordered under the resulting contract (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

a. All reports required herein shall be submitted in electronic format. In addition, one hardcopy of each report shall be submitted to the Contracting Officer.

b. All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973.

Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html under "Making Files Accessible."

c. All paper/hardcopy documents/reports submitted under this contract shall be printed or copied, double-sided, on at least 30 percent post-consumer fiber paper, whenever practicable, in accordance with FAR 4.302(b).

d. The PWS provided at Section J, Attachment I, sets forth the description of reports to be submitted under the resulting contract.

http://www.hhs.gov/web/508/index.html

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with the PWS.

At a minimum; all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, to be determined is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Institute of Environmental Health Sciences 111 T. W. Alexander Drive Research Triangle Park, NC 27709

The COR and/or the Alternate COR will monitor the Contractor’s activities and accomplishments and will indicate acceptance or non-acceptance of the deliverables. The deliverables identified above will be inspected and either approved or, if they are not acceptable, rejected by the COR and/or the Alternate COR. Such inspections will occur as determined to be necessary by the COR and/or Alternate COR.

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

The Government reserves the right to an Inspection period of 30 calendar days, unless a different time period is stated when (the Record of Call/elsewhere in the contract). The receiving report, completed and signed by the appropriate official, constitutes acceptance and shall be acknowledged to the payment office (OFM).

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

1. FAR Clause 52.246-4 Inspection of Services -- Fixed-Price AUG 1996

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be for one (1) year plus four (4) one-year options.

b. If the Government exercises its option pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below

Option Option Period

Option 1 (Year 2) January 31, 2019 thru January 30, 2020

Option 2 (Year 3) January 31, 2020 thru January 30, 2021

Option 3 (Year 4) January 31, 2021 thru January 30, 2022

Option 4 (Year 5) January 31, 2022 thru January 30, 2023

ARTICLE F.2. DELIVERIES

a. Satisfactory performance of this contract shall be deemed to occur upon performance of the work described in the Description Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the Services specified in the Delivery Schedule which are described in SECTION C of this contract.

b. Deliveries required by the Contractor shall be made F.o.b. destination as set forth in FAR Clause 52.247-35, F.o.b. Destination, within consignees Premises (April 1984) [and any specifications stated in SECTION D, PACKAGING AND MARKING AND SHIPPING, of this contract] to the address/addressee listed below:

c. Unless otherwise specified, deliveries shall be made to the Delivery Point specified above Mondays through Fridays (excluding Federal Holidays) between the hours of 8:30 a.m. and 5:30 p.m. EST only.

Supplies or services scheduled for delivery on a Federal holiday shall be made the following day.

ARTICLE F.3. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY 1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.acquisition.gov/far .

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

1. FAR Clause 52.242-15 Stop Work Order AUG 1989

2. FAR Clause 52.242-17 Government Delay of Work APR 1984 http://www.acquisition.gov/far

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract: [To be designated after award]

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH (RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment.

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original contract invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

b. One copy of the contract invoice shall be submitted to the following approving official:

Contracting Officer Uché Washington NIH/NIEHS, OM, Office of Acquisitions 530 Davis Drive, Room 1043 P.O. Box 12233, MSC: K1-04, Room 1048 Research Triangle Park, NC 27709 E-mail: uche.washington@nih.gov

The Contractor shall submit an electronic copy of the payment request to the approving official instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

[Note: The original payment request must still be submitted in hard copy and mailed to the mailto:uche.washington@nih.gov designated billing office to meet the requirements of a "proper invoice."]

Central Point of Distribution:

The Contractor shall submit an electronic copy of the payment request to the Central Point of Distribution mailbox. The payment request shall be transmitted as an attachment via e-mail to the address listed above in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number. [Note: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice."]

b. Inquiries regarding payment of contract invoices shall be directed to the designated billing office, (301) 496-6452.

ARTICLE G.3. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared annually as follows on the anniversary dates of the contract.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov

ARTICLE G.4. KEY PERSONNEL, HHSAR 352.237-75 (DECEMBER 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The following individual(s) is/are considered to be essential to the work being performed hereunder:

KEY PERSONNEL

Title Name

Project Manager

Software Engineer/Developer

(End of Clause) http://www.cpars.gov/

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. NEEDLE EXCHANGE, HHSAR 352.270-12 (December 2015) The Contractor shall not use any funds obligated under this contract to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

(End of clause)

ARTICLE H.2. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for quotes, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.3. LIMITATION ON USE OF FUNDS FOR PROMOTION OF LEGALIZATION OF CONTROLLED

SUBSTANCES

The Contractor shall not use contract funds to support activities that promote the legalization of any drug or other substance included in schedule I of the schedules of controlled substances established under section 202 of the Controlled Substances Act, except for normal and recognized executive-congressional communications. This limitation shall not apply when the Government determines that there is significant medical evidence of a therapeutic advantage to the use of such drug or other substance or that federally sponsored clinical trials are being conducted to determine therapeutic advantage.

ARTICLE H.4. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.5. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-9, Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given any time prior to the expiration date of this contract and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

ARTICLE H.6. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is: http://oig.hhs.gov/fraud/hotline/ and the mailing address is:

US Department of Health and Human Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489 Washington, D.C. 20026

ARTICLE H.7. INFORMATION AND PHYSICAL ACCESS SECURITY

A. BASELINE SECURITY REQUIREMENTS

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee http://oig.hhs.gov/fraud/hotline/ will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, physical or logical (electronic) access to federal information that is not in the public domain.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that directly supports the HHS mission. In addition to the FAR Subpart 2.1 definition of “information technology” (IT), the term as used in this section, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This section does not apply to national security systems as defined by the Federal Information Security Modernization Act (FISMA) (as amended).

2) Safeguarding Information and Information Systems. The Contractor (and/or any subcontractor) is responsible for the following:

1. On behalf of HHS/NIH/NIEHS, protecting federal information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

b. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

c. Availability, which means ensuring timely and reliable access to and use of information.

2. Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location per clause 52.239-1 of the Federal Acquisition Regulation (FAR) (https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html).

a. The Contractor is prohibited from subcontracting to companies to conduct HHS business in which foreign governments that support international terrorism have a “significant interest” per 10 U.S.C. § 2327 (https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm).

3. Adopting, and implementing the policies, procedures, controls, and standards required by HHS Information Security Program to ensure the confidentiality, integrity, and availability of federal information and federal information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. The HHS Information Security Program security requirements are outlined in the HHS IS2P, which is accessible on the HHS Office of the Chief Information Officer’s (OCIO) website (http://intranet.hhs.gov/it/ocio/).

a. The Information Security Solicitation Checklist and Certification Form (See Appendix A, for the

Information Security Solicitation Checklist and Certification Form) must be completed when the acquisition requires contractor personnel to develop or access federal information systems.

3) Information Security Categorization. The Contractor/subcontractor will coordinate with the system owner, Contracting Officer Representative (COR) and/or Contracting Officer to categorize the system and information to determine applicable information type(s) and the overall level of risk in accordance with FIPS-199 (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf) and the Federal Information Processing Standard NIST SP 800-60, “Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories”, Appendix C, Table C-2 at Vol 2 (http://csrc.nist.gov/publications/nistpubs/800- 60-rev1/SP800-60_Vol2-Rev1.pdf). The security categories and risk level shall be documented in the designated System Security Plan (SSP) for all systems within the proposal.

4) Internet Protocol Version 6 (IPv6). All acquisitions using Internet Protocol must comply with FAR sections:

FAR 7.105(b)(5), FAR 11.002(g), and FAR 12.202(e) (https://www.acquisition.gov/?q=browsefar).

5) Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm https://www.gpo.gov/fdsys/pkg/USCODE-2011-title10/html/USCODE-2011-title10-subtitleA-partIV-chap137-sec2327.htm http://www.hhs.gov/ocio/policy/index.html http://www.hhs.gov/ocio/policy/index.html http://intranet.hhs.gov/it/ocio/ http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf https://www.acquisition.gov/?q=browsefar phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Contracting Officer’s Representative (COR), with a copy to the Contracting Officer, within 30 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

6) Contract Documentation. The Contractor shall contact the Contracting Officer and/or COR for any NIEHS templates, policies, forms and other documents necessary to comply with the requirements of this section. All contract deliverables shall be compliant with Section 508 (http://www.hhs.gov/ocio/policy/508_policy.html#3Scope).

7) Standard for Encryption

1. The Contractor (and/or any subcontractor) shall comply with the HHS Standard for Encryption Language in

HHS Contracts (http://www.hhs.gov/ocio/policy/2009-0002.001s.html) to prevent unauthorized access to HHS information.

2. The Contractor (and/or any subcontractor) shall use FIPS 140-2, Security Requirements for Cryptographic Module (http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf) compliant encryption to protect all instances of HHS sensitive information during storage and transmission

3. The Contractor (and/or any subcontractor) shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (http://csrc.nist.gov/groups/STM/cmvp/) to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR and/or Contracting Officer.

4. The Contractor (and/or any subcontractor) shall use the Key Management Key

(http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor (and/or any subcontractor) shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (OMB Encryption Guidance at http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the COR and/or Contracting Officer of personnel authorized to decrypt and recover all encrypted information.

5. The Contractor (and/or any subcontractor) shall ensure that their equipment and devices meet HHS and NIH specific encryption standard requirements or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information (including PII).

6. The Contractor (and/or any subcontractor) shall ensure that encryption keys are provided to the COR and/or

Contracting Officer upon request and at the conclusion of the contract.

8) Protection of Sensitive Information. All federal information that may be sensitive (as defined in the Departmental Standard for the Definition of Sensitive Information) shall be protected in accordance with Office of Management and Budget (OMB) Memorandum (M) 06-16 (https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf), Protection of Sensitive Agency Information and encrypted with Federal Information Processing Standard (FIPS) 140-2 compliant solution.

9) Contractor Agreement. The Contractor (and/or any subcontractor), performing under this contract, shall not release, publish, or disclose non-public federal information to unauthorized individuals. The confidentiality, integrity, and availability of such information shall be protected by the Contractor in accordance with the governing laws and regulations listed as follows:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records) (https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html) http://www.hhs.gov/ocio/policy/508_policy.html#3Scope http://www.hhs.gov/ocio/policy/2009-0002.001s.html http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/groups/STM/cmvp/ http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html https://www.gpo.gov/fdsys/granule/USCODE-2011-title18/USCODE-2011-title18-partI-chap31-sec641/content-detail.html

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information) (https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf)

- Public Law 96-511 (Paperwork Reduction Act) (http://ciog6.army.mil/Portals/1/Policy/Paper Reduction 1980.pdf)

10) Contractor Employee Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public federal information under this contract shall complete the NIH Commitment to Protect Non-Public Information – Contractor Employee Agreement. A copy of each signed and witnessed NDA shall be submitted to the COR and/or Contracting Officer prior to performing any work under this acquisition (See Appendix C for the HHS Contractor Non-Disclosure Agreement).

11) Privacy or Security Safeguards (FAR Clause 48 CFR § 52.239-1). The Contractor(and/or any subcontractor) shall comply with FAR Clause 48 CFR § 52.239-1 privacy and security requirements, which can be located at:

https://www.acquisition.gov/?q=browsefar. If new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

12) Confidential Information (HHSAR Clause 48 CFR § 352.224-71). The Contractor (and/or any subcontractor) shall comply with HHSAR Clause 48 CFR § 352.224-71 requirements, which can be located at:

http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html.

13) Privacy Threshold Analysis (PTA) – due within 30 days after contract award.

1. The Contractor shall assist the Senior Agency Official for Privacy (SAOP) (or his or her designee)1 with conducting a PTA (using the Privacy Impact Assessment [PIA] form) for the information system and/or information collection project to determine whether or not a full PIA needs to be completed (http://intranet.hhs.gov/it/cybersecurity/fisma/sport/faq_pia/).

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the SAOP (or his or her designee) and other designated authorities with completing a PIA for the system or project within 60 days after completion of the PTA.

b. The PIA shall be completed in accordance with HHS policy, OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 (https://www.whitehouse.gov/omb/memoranda_m03-22) and shall be revised at each milestone during the system development lifecycle (SDLC).

c. PIAs and PTAs are required in the early stages of system development. PIAs must be reviewed within 3 years of the last PIA approval date and/or updated as needed based on a major change to the system or when new types of PII are collected, that introduces new or increased privacy risks.

14) Rules of Behavior

1. The Contractor (and/or any subcontractor) shall ensure that all employees comply with the HHS Information

Technology General Rules of Behavior (http://intranet.hhs.gov/it/cybersecurity/policies/index.html), and NIH IT General Rules of Behavior (https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/NIH_IT_GeneralRulesofBehavior.aspx).

2.

All Contractor employees must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process HHS information initially and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

15) Incident Response

1 HHS Privacy Officers are listed here: http://intranet.hhs.gov/it/cybersecurity/privacy/#header1. Some of them may also be HHS

Privacy Act Contacts, mentioned in Section 3.

https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf https://www.gpo.gov/fdsys/pkg/USCODE-2014-title18/pdf/USCODE-2014-title18-partI-chap93-sec1905.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf http://ciog6.army.mil/Portals/1/Policy/Paper%20Reduction%201980.pdf https://www.acquisition.gov/?q=browsefar http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html http://intranet.hhs.gov/it/cybersecurity/fisma/sport/faq_pia/ http://intranet.hhs.gov/it/cybersecurity/policies/index.html https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/NIH_IT_GeneralRulesofBehavior.aspx http://intranet.hhs.gov/it/cybersecurity/privacy/#header1

1. Per FAR 52.239-1, if new or unanticipated threats or hazards are discovered by either the Government or the

Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

2. The Contractor (and/or any subcontractor) shall report all suspected and confirmed information security and privacy incidents to the NIEHS ISSO, COR, Contract Officer, SAOP (or his or her designee), and other stakeholders, including incidents involving personally identifiable information (PII), in electronic or physical form, within 1 hour of discovery. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

a. Pursuant to 45 C.F.R. § 164.308(a)(6), Business Associates must implement policies and procedures to address security incidents; identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the Business Associates;

document security incidents and their outcomes; and require their subcontractors to do the same.

b. Pursuant to 45 C.F.R. § 164.314(a)(2)(i)(C), Business Associates must report to Covered Entities any security incident of which they become aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410. Pursuant to 45 C.F.R. § 164.410(c), such notification must include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the Business Associate to have been accessed, acquired, used, or disclosed during the breach.

3. In the event of an information security or privacy incident, the Government may suspend or revoke an existing

Authority to Operate (ATO) (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor (and/or any subcontractor) to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor (and/or any subcontractor) IT system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

4. The Contractor (and/or any subcontractor) shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. Incident response activities determined to be required by the Government may include, but are not limited to, the following:

a. Inspections,

b. Investigations,

c. Forensic reviews,

d. Containment and damage assessment, and

e. Data analysis and processing.

16) Personnel Security Responsibilities

1. The Contractor, within 7-days (before an employee begins working on this contract), shall provide the COR and/or Contracting Officer, and Information System Security Officer (ISSO) the name, position title, e-mail address, and phone number of all contract employees working under the contract per the National Industrial Security Program Operating Manual (NISPOM) Section 2-200 (http://intranet.hhs.gov/security/ossi/documents/nispom.pdf), the HHS Contract Closeout Guide (2012)…