NIA IT Equipment Maintenance - Statement of Work - GINC.pdf

Statement of Work (SOW)

A. GENERAL INFORMATION

1. Title of Project: IT Equipment Imaging and Maintenance

2. Background Information: The National Institute on Aging (NIA), one of the 27 Institutes and Centers of NIH, leads a broad scientific effort to understand the nature of aging and to extend the healthy, active years of life. The Intramural Research Program (IRP) of the National Institute on Aging (NIA) provides a stimulating setting for a comprehensive effort to understand aging through multidisciplinary investigator-initiated research, in this regard.

One of the IRP's program activities includes the Clinical Research Core (CRC), which is part of the NIA Clinical Unit within the Office of the Scientific Director. The CRC seeks to elucidate normative values and separate normal aging findings from disease states. The CRC’s goal is to prolong disease-free states with age. The CRC serves as an infrastructure to facilitate the creation and development of therapeutic targets for the treatment of age-related disease across the Intramural Research Program. The CRC performs research that has direct clinical applications to aging and disease states and, as such, collects participant specimens depending on the testing procedures required per protocol study. NIA’s Clinical Unit must be located within a hospital. Therefore, all participants seen at the NIA Clinical Unit are required to be entered into the hospital’s IT patient admissions system as they undergo tests performed by the hospital. Therefore, NIA has dedicated IT equipment for the purpose of registering NIA participants into the hospital’s patient admissions systems. As such, NIA’s IT equipment must be configured and imaged according to the hospital’s standards and, therefore, maintained according to these standards.

3. Purpose or Objective of the Requirement: The contractor shall provide all resources necessary to accomplish the tasks and deliverables described in this Statement of Work (SOW). The contractor shall provide imaging, configuration and maintenance of NIA’s IT equipment used for accessing the Contractor’s Patient Admissions Systems.

4. Type of Contract Contemplated:

Purchase Order, Open Market, and the expected value will be provided (inclusive of options).

5. Period of Performance: The period of performance is twelve months (12) from the date of award, plus four (4) one-year options.

B. CONTRACTOR REQUIREMENTS (SCOPE OF WORK)

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the tasks as specified herein. Specifically, the contractor shall:

• Configure, image and maintain NIA’s IT equipment used for accessing the Contractor’s Patient Admissions Systems in accordance with the Contractor’s IT systems’ standards.

• Access to the Contractor’s Patient Admissions System will allow NIA to register NIA participants into the Contractor’s Patient Admissions Systems.

C. GOVERNMENT RESPONSIBILITIES

The government will provide: 2 desktops, 2 laser printers and 2 label maker printers used for patient admissions.

NIA will grant access to the Clinical Unit located in the Baltimore metropolitan area.

D. DELIVERY OR DELIVERABLES

Not applicable

E. TRAVEL

Not applicable

F. CONTRACTOR EXPERIENCE REQUIREMENTS – KEY PERSONNEL

Not applicable

G. SECURITY REQUIREMENTS:

Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

• NIH PII Spillage Report http://ocio.nih.gov/docs/public/PII_Spillage_Report.doc

• NIH Lost or Stolen Assets Report http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc

Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

mailto:IRT@mail.nih.gov http://ocio.nih.gov/docs/public/PII_Spillage_Report.doc http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc http://csrc.nist.gov/cryptval

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel. Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance (http://cit.nih.gov/ProductsAndServices/ServiceCatalog/Services.htm?Service=Media+Sanitization+Servi ce).

Common Security Configurations

1. The Contractor shall ensure new systems are configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/download_fdcc.cfm) and applicable configurations from http://checklists.nist.gov, as jointly identified by the Operating Division (OPDIV)/Staff Division (STAFFDIV) Contracting Officer’s Technical Representative (COTR) and the Chief Information Security Officer (CISO).

2. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and/or patching will not alter the configuration settings specified in: (a) the FDCC (http://nvd.nist.gov/fdcc/index.cfm); and (b) other applicable configuration checklists as referenced above.

3. The Contractor shall ensure applications are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

4. The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges.

5. Federal Information Processing Standard 201 (FIPS-201)-compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

6. The Contractor shall ensure that all of its subcontractors (at all tiers) comply with the above requirements.

Special Information Security Requirements for Foreign Contractors/Subcontractors

When foreign contractors/subcontractors perform work under this acquisition at non-US Federal Government facilities, provisions of HSPD-12 do NOT apply.

H. DATA RIGHTS

The NIA shall have unlimited rights to and ownership of all deliverables provided under this contract, including reports, recommendations, briefings, work plans and all other deliverables. This includes the deliverables provided under the basic contract and any optional task deliverables exercised by the contracting officer. In addition, it includes any additional deliverables required by contract change. The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.”

FAR clause 52.227-14, “Rights in Data-General,” is hereby incorporated by reference and made a part of this contract/order.

http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf http://cit.nih.gov/ProductsAndServices/ServiceCatalog/Services.htm?Service=Media+Sanitization+Service http://cit.nih.gov/ProductsAndServices/ServiceCatalog/Services.htm?Service=Media+Sanitization+Service http://nvd.nist.gov/fdcc/download_fdcc.cfm http://checklists.nist.gov/ http://nvd.nist.gov/fdcc/index.cfm

I. SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board), pursuant to Section 508(2)(A) of the Rehabilitation Act Amendments of 1998, established information technology accessibility standards for the federal government. Section 508(a)(1) requires that when federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a federal department or agency. Section 508 text is available at http://www.opm.gov/HTML/508-textOfLaw.htm or http://www.section508.gov/index.cfm?FuseAction=Content&ID=14]

The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

J. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

1. The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

Name: Taryn E. Mabe National Institute on Aging (NIA) Intramural Research Program (IRP) Office of the Scientific Director 251 Bayview Boulevard Room 4C023 Baltimore, Maryland 21224 Telephone Number: (410) 558-8310 Fax: (410) 558-8103 E-mail address: mabete@mail.nih.gov

2. The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

3. Alternate COR: N/A

4. The Contracting Officer is the only person with authority to act as agent of the

Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise http://www.opm.gov/HTML/508-textOfLaw.htm http://www.section508.gov/index.cfm?FuseAction=Content&ID=14 mailto:mabete@mail.nih.gov change any terms and conditions of this contract; or (6) sign written licensing agreements.

Any signed agreement shall be incorporated by reference in Section K of the contract

5. The Government may unilaterally change the COR designation for this contract.