ADDENDUM_TO_TERMS_AND_CONDITIONS_.pdf

ADDENDUM TO TERMS AND CONDITIONS OF PURCHASE ORDER

Dated August ___, 2017

1. METHOD OF ACQUISITION

This requirement is a Firm Fixed Priced Order.

2. TRANSPORTATION & SHIPPING TERMS

The F.O.B. point for this Order is indicated in block 15 of page 1 of the Order document. The following provides an explanation of F.O.B. points as defined in the FAR, Part 47, and are applicable to this Order.

"F.O.B." means free on board. This term is used in conjunction with a physical point to determine (a) the responsibility and basis for payment of freight charges and (b) unless otherwise agreed, the point at which title for goods passes to the buyer or consignee.

"F.O.B. Origin" means free on board at origin; i.e., the seller or consignor places the goods on the conveyance by which they are to be transported. Unless this Order provides otherwise, the cost of shipping and risk of loss are borne by the buyer or consignee (Government).

For this Order, "F.O.B. Origin" is to be interpreted as "F.O.B. Origin Freight Prepaid." All items will be delivered to the National Library of Medicine, 8600 Rockville Pike, Building 38A Loading Dock, Bethesda, Maryland 20894.

The vendor is responsible for prepaying the freight charges and shall bill freight charges as a separate line item on the invoice.

"F.O.B. Destination" means free on board at destination; i.e., the seller or consignor delivers the goods on seller's conveyance at destination. Unless the Purchase Order provides otherwise, the cost of shipping and risk of loss are borne by the seller or consignor (Contractor).

For this Purchase Order, "F.O.B. Destination" is to be interpreted as "F.O.B.

Destination, within Consignee's Premises." The vendor will prepay all freight charges and will deliver to the National Library of Medicine, 8600 Rockville Pike, Building 38A Loading Dock, Bethesda, Maryland 20894. The vendor may not bill for shipping charges, except as described under "Special Shipping/Handling Charges" below.

3. DELIVERY OF MATERIAL/SERVICES

Delivery schedules will be negotiated by the authorized ordering official at the time the order is placed. The delivery of goods and services must be performed between the hours of 8:30 a.m. and 4:30 p.m., Monday through Friday, except when special arrangements are made by the ordering official.

All shipments delivered herein shall be addressed as directed by the ordering official and marked as indicated below.

Purchase Order Number:

National Library of Medicine 8600 Rockville Pike Building 38A Loading Dock Bethesda, Maryland 20894

4. INVOICE SUBMISSION

Payment requests shall be submitted to the offices identified below. The Contractor shall submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc) with each payment request as instructed by the COR.

a. The original invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, Maryland 20892-8500

Note: The original payment request must be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice".

b. One electronic copy of the invoice shall be submitted to the following approving official:

To Be Announced Building 38A, Room 7S708, MSC 3828 8600 Rockville Pike Bethesda, Maryland 20894-3827 E-Mail:

The contractor shall submit an electronic copy of the payment request to the approving official/COR instead of a paper copy. The payment request shall be transmitted as an attachment via e-mail to the approving official's address listed in one of the following formats: MSWord, MS Excel, or Adobe Portable Document Format (PDF). Only one payment request shall be submitted per e-mail and the subject line of the e-mail shall include the Contractor's name, contract number, and unique invoice number.

NOTE: The original payment request must still be submitted in hard copy and mailed to the designated billing office to meet the requirements of a "proper invoice"

5. ADDITIONAL INVOICING REQUIREMENTS

In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

• Name of the Office of Acquisitions. The Office of Acquisitions for this contract is the Office of Acquisitions Management, National

Library of Medicine, Democracy II, 6707 Democracy Blvd, Suite

105, Bethesda, MD 20892-5488.

• Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification

Number {VIN) on the payment request. The VIN is the number that appears after the contractor's name on the face page of the contract.

[Note: A VIN is assigned to new contracts awarded on or after June

4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

• DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the System for Award Management (SAM) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

• Invoice Matching Option. This contract requires a Three Way

Match.

• Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

• The Order’s Title is: “ G e n e t i c H o m e R e f e r e n c e ” Inquiries regarding payment of invoices should be directed to the designated billing office: 301-496-6088.

6. PROMPT PAYMENT DISCOUNTS

The Prompt Payment Discount period, if any, shall commence on the final date of the billing period, or on the date of the receipt of a proper invoice for all deliveries accepted during the billing period, whichever is later.

7. PROMPT PAYMENT

FAR 52.232-25, Prompt Payment (JUN 1997) is supplemented with the following

a. The Prompt Payment Act, Public Law 97-177, (96 Stat. 85, 31 U.S.C. 1801) is applicable to payments under this purchase order and requires payment to vendors of i nterest on overdue payments and improperly taken discounts.

b. Determinations of interest due will be made in accordance with the provision of the Prompt Payment Act and the above referenced clause.

8. RETURNED INVOICES

Invoices will be returned for: 1) failing to cite an order number; 2) citing an invalid order number; or 3) having other discrepancies on the invoice Resolution and correction of the invoice will require the vendor to contact the COR.

9. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be determined, Primary COR.

___, Alternate COR

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned. The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference to this contract.

The Government may unilaterally change it's COR designation.

10. OPTION PRICES

a. Unless the Government exercise its option pursuant to the OPTION

PROVISIONS article below, this delivery order consists only of the Basic Award period as defined in the Statement of Work.

b. Pursuant to clause 52.217-9, the Government may, by unilateral modification, require the VENDOR TO PERFOM THE Option Requirements of the Statement of Work. If the Government exercises its options(s), notice must be given within the period of performance of the purchase order.

c. Option I, Option to Extend the Term of the Delivery Order – Prices for the Period;:

TBD

Upon the Government’s order during the Option I period of any of the work described in the Statement of Work, the Contractor shall be paid the fixed unit prices(s) set forth in the Contractor’s proposal attached and made a part of this delivery order, and in accordance with the following estimated amount.

Total Estimated Amount (Option I Period): TBD

d. Option II, Option to Extend the Term of the Delivery Order – Prices for the Period :

TBD.

Upon the Government’s order during the Option II period of any of the work described in the Statement of Work, the Contractor shall be paid the fixed unit price(s) set forth in the Contractor’s proposal attached and made a part of this delivery order, and in accordance with the following estimated amount.

e. Total Estimated Amount (Option II Period): TBD

11. OPTION PROVISIONS

Unless the Government exercises its option pursuant to the OPTION PROVISIONS clause below, this purchase order consists only of the Basic Requirements as defined in the Statement of Work.

a. FAR 52.217-8, Option to Extend Services (Nov 1999)

The Contracting Officer may exercise the option by written notice to the

Contractor within t h i r t y (30) calendar days prior to the expiration date of the delivery order.

b. FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000)

Part (a) is revised to read as follows:

"(a) The Government may extend the term of this delivery order by written notice to the Contractor within the Period of Performance of the delivery order; provided that the Government shall give the

Contractor a preliminary written notice of its intent to extend at least thirty (30) days before the delivery order expires”

"(c) The total duration of this order, including the exercise of any options under this clause, shall not exceed 60 months ”

12. ADVANCE UNDERSTANDINGS

Non-Personal Services and Inherently Government Functions

a. Pursuant to FAR 37.1, no personal services shall be performed under this contract.

All work requirements shall flow only from the Contracting Officer's Representative (COR) to the Contractor's Project Manager. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

b. Pursuant to FAR 7.5, the Contractor shall not perform any inherently governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government contractors in connection with this contract, the Contractor employee shall state that they have no authority to in any way change the contract and that if the other contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

c. The Contractor shall insure that all of its employees working on this contract are informed of the substance of this article. Nothing in this article shall limit the Government's rights in any way under the other provisions of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this article shall be included in all subcontracts at any tier.

13. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days' notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer.

The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties. (End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

14. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federai funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

15. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

16. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

17. FEDERAL ACQUISITION REGULATION (FAR) CLAUSES INCOREPORATED

BY REFERENCE:

This order incorporates the following additional Federal Acquisition Regulation (FAR) clauses and provisions, by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a FAR clause may be accesses electronically at Http://www.acquisition.gov/.

FAR 52.227- 14 Rights in Data, General (May 2014) FAR 52.227-17, Rights in Data -Special Works (Dec 2007);

FAR 52.227-18, Rights in Data-Existing Works (Dec 2007) FAR 52.204-7 System for Award Management. (JUL 2013) FAR 52.204-8 Annual Representations and Certifications. (APR 2016) FAR 52.239-1, Privacy or Security Safeguards (August 1996) FAR 52.204-9, Personal Identity Verification of Contractor Personnel (JAN 2011) FAR 52.232-18, Availability of Funds (APR 1984) http://www.acquisition.gov/

FAR 52.232-19, Availability of Funds for the Next Fiscal Year (APR 1984) FAR 52.237-3, Continuity of Services (January 1991) FAR 52.232-39 Unenforceability of Unauthorized Obligations FAR 52.242-15 Stop-Work Order (Aug 1989) FAR 52.242-17, Government Delay of Work (April 1984) FAR 52.242-13 Bankruptcy. (July 1995) FAR 52.243-3 Changes-Time-and-Materials or Labor-Hours (SEPT 2000) FAR 52.245-a Government Property (April 2012)

18. DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS) ACQUISITION

REGULATIONS (HHASR) CLAUSES INCORPORATED BY REFERENCE:

HHSAR 352.224-70 Privacy Act (December 18, 2015) HHSAR 352.237-75, Key Personnel (December 2015) HHSAR 352.231-70, Salary Rate Limitation (December 18, 2015) HHSAR 352.239-73(b) Electronic and Information Technology Accessibility (January 2010)

19. NATIONAL INSTITUTES OF HEALTH (NIH) CLAUSES:

NLM (RC)- Rights in Data - Special (11/30/97)

20. NIH INFORMATION AND PHYSICAL ACCESS SECURITY ACQUISITION

LANGUAGE

20.0. Information and Physical Access Security

HHS-Controlled Facilities and Information Systems Security

20.1. To perform the work specified herein, Contractor personnel are expected to have routine (1) physical access to an HHS-controlled facility; (2) physical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or

(4) any combination of circumstances (1) through (3).

20.2. To gain routine physical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-05-24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigations procedures contained in the following documents:

1. HHS-OCIO Information Systems Security and Privacy Policy http://www.hhs.gov/ocio/policy/#Security

2. HHS HSPD-12 Policy Document, v. 2.0 http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy20 05/m05-24.pdf

3. Information regarding background checks/badges http://idbadge.nih.gov/background/index.asp http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://idbadge.nih.gov/background/index.asp

20.3. Position Sensitivity Levels

This Task Order will entail the following position sensitivity levels.

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

20.4. The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions, i.e., those above non-sensitive, require more extensive documentation and investigation.

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the Task Order who will develop, have the ability to access, and/or maintain a Federal Information System(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days after the effective date of the Task Order. The Contracting Officer shall notify the Contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRo ster_10-15-12.xlsx .

Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the Task Order and if they have previously been the subject of national agency checks or background investigations.

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this Task Order.

Contractors may begin work after the fingerprint check has been completed.

20.5. Investigations are expensive and may delay performance, regardless of the https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR Clause 52.249-14, Excusable Delays. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this Task Order have a reasonable chance for approval.

20.6. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the Task Order price of no more that the cost of the additional investigation(s).

20.7. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

20.8. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

20.9. Within 7 calendar days after the Government's final acceptance of the work under this Task Order, or upon termination of the Task Order, the Contractor shall return all identification badges to the Contracting Officer or designee.

20.10. Standard for Encryption Language

a) The Contractor shall use Federal Information Processing Standard (FIPS) 140-2, Compliant Encryption (Security) Requirements for Cryptographic Module (as amended), to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this Task Order is considered "sensitive" in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems (dated February 2004).

b) The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/groups/STM/cmvp/ ) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Representative.

c) The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4 (as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf ). The Contractor shall notify the Contracting Officer and the Contracting Officer's Representative of personnel authorized to decrypt and recover all encrypted information.

http://csrc.nist.gov/groups/STM/cmvp/ http://csrc.nist.gov/groups/STM/cmvp/ http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

d) The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

e) The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

f) The Contractor shall ensure that its subcontractors (all tiers) which perform work under this Task Order comply with the requirements contained in this clause.

20.11. Security Requirements For Federal Information Technology Resources

a. Applicability. This clause applies whether the entire contract or order (hereafter

"contract"), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term "information technology (IT)", as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

b. Contractor responsibilities. The Contractor is responsible for the following:

(1) Protecting Federal information and Federal information systems in order to ensure their

(a) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

(b) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(c) Availability, which means ensuring timely and reliable access to and use of information.

(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

(3) Adopting, and implementing, at a minimum, the policies, procedures, controls and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this Task Order or to which it may otherwise have access under this Task Order. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

c. Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

(1) IT Security Plan (IT-SP) - due within 30 days after Task Order award. The

IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this Task Order. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this Task Order. If the IT-SP only applies to a portion of the Task Order, the Contractor shall specify those parts of the Task Order to which the IT-SP applies.

(a) The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E-Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

(i) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automation Information Resources.

(ii) National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Information Systems, in form and content, and with any pertinent Task Order Statement of Work/Performance Work Statement (SOW/PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommend Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self- Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

(iii) HHS-OCIO Information Systems Security and Privacy Policy.

(2) IT Risk Assessment (IT-RA) - due within 30 days after Task Order award.

The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the Task Order for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

(3) FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment) - due within 30 days after Task Order award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the Task Order.

(4) IT Security Certification and Accreditation (IT-SC&A) - due within 3 months after Task Order award. The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems - see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security, Certification and Accreditation of Federal Information Systems; and NIST 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provided it to the Contracting Officer for review, comment, and acceptance.

(a) After resolution of any comments provided by the Government on the draft IT SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the Task Order as a compliance requirement.

(b) The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

(i) Annual testing of the system contingency plan; and

(ii) The performance of security control testing and evaluation.

d. Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in "HHS-Controlled Facilities and Information Systems Security" requirements specified in the SOW/PWS of this Task Order.

e. Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this Task Order complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

f. Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this Task Order to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

g. Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that -

(1) Have physical or electronic access to HHS' computer systems, networks, or

IT infrastructure; or

(2) Use information systems to generate, store, process, or exchange data with

HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

h. Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this Task Order), if that employee has, or had, access to HHS information systems or data.

i. Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

j. Contractor responsibilities upon physical completion of the Task Order. The

Contractor shall return all HHS information and IT resources provided to the Contractor during Task Order performance and certify that all HHS information has been purged from Contractor-owned systems used in Task Order performance.

k. Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this Task Order.

(End of Clause)

Note: The NIST Special Publication SP-800-26 cited in subparagraph c.1.a.(ii) of this clause has been superseded by NIST SP 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations" for use for the assessment of security control effectiveness. See http://csrc.nist.gov/publications/PubsSPs.html to access NIST Special Publications (800 Series).

20.12. Additional NIH Requirements

a. Information Type

[X] Administrative, Management and Support Information:

Information and Technology Management:

1. System Development Information Type: Supports all activities associated with the in-house design and development of software applications.

2. System Maintenance Information Type: Supports all activities associated with the maintenance of in-house designed software applications.

3. IT infrastructure Maintenance Information Type: Involves the planning, design, implementation, and maintenance of an IT Infrastructure to effectively support automated needs (i.e. operating systems, applications software, platforms, networks, servers, printers, etc.). IT infrastructure maintenance also includes information systems configuration and security policy enforcement information. This information includes password files, network access rules and implementing files and/or switch setting, hardware and software configuration settings, and documentation that may affect access to the information system’s data, programs, and/or processes. The impact levels associated with IT infrastructure Maintenance Information are primarily a function of the information processed in and through that infrastructure. The IT Maintenance Information Type represents a complex set of data elements that are used to secure the design, implementation, and maintenance of systems and networks. The security of each of these data elements is dependent on the security of the other data elements. Security compromise of one data element type will propagate to others.

4. System and Network Monitoring Information Type: Supports all activities related to the real-time monitoring of systems and networks for optimal performance. System and Network Monitoring describes the use of tools and observation to determine the performance and status of information systems and is closely tied to other Information and Technology Management sub-functions. System and Network Monitoring Information Type should be considered broadly to include an agency’s http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html network [performance, health, and status] and security operations [intrusion monitoring, auditing, etc.] support.

[ ] Mission Based Information:

b. Security Categories and Levels

Confidentiality Level: [X] Low [ ] Moderate [ ] High Integrity Level: [X] Low [ ] Moderate [ ] High Availability Level: [X] Low [ ] Moderate [ ] High

Overall Level: [X] Low [ ] Moderate [ ] High

6. Information Security Training

The Contractor shall comply with the below training:

a. Mandatory Training

(1) All Contractor employees having access to (1) Federal information or a Federal information system or (2) sensitive data/information as defined at HHSAR 304.1300(a)(4), shall complete the NIH Computer Security Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this Task Order. Thereafter, Contractor employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this Task Order.

The Contractor shall also ensure subcontractor compliance with this training requirement.

(2) The Contractor shall maintain a listing by name and title of each Contractor/Subcontractor employee working on this Task Order and having access of the kind in paragraph 12.5a(1) above, who has completed the NIH required training. Any additional security training completed by the Contractor/Subcontractor staff shall be included on this listing. The list shall be provided to the COR and/or Contracting Officer upon request.

b) Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or more HHS systems. Read further guidance about "NIH Information Security Awareness and Training Policy," at: https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final- InfoSecAwarenessTrainPol.doc .

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this Task Order. The list shall be provided to the COR and/or Contracting Officer upon request.

c) Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior ( http://irtsectraining.nih.gov/ https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final-InfoSecAwarenessTrainPol.doc https://ocio.nih.gov/InfoSecurity/Policy/Documents/Final-InfoSecAwarenessTrainPol.doc https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx ), which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov .

20.13. Personnel Security Responsibilities

The Contractor shall comply with the below personnel security responsibilities:

a) In accordance with Paragraph (h) of HHSAR 352.239-72, the Contractor shall notify the Contracting officer and the COR within five working days before a new employee assumes a position that requires access to HHS information systems or data, or when an employee with such access stops working on this Task Order. The Government will initiate a background investigation on new employees assuming a position that requires access to HHS information systems or data, and will stop pending background investigations for employees that no longer work under the Task Order or no longer have such access.

b) New contractor employees who have or will have access to HHS information systems or data: The Contractor shall provide the COR with the name, position title, e-mail address, and phone number of all new contract employees working under the Task Order and provide the name, position title and position sensitivity level held by the former incumbent. If an employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate position sensitivity level.

c) Departing contractor employees: The Contractor shall provide the COR with the name, position title, and position sensitivity level held by or pending for departing employees. The Contractor shall perform and document the actions identified in the Contractor Employee Separation Checklist ( https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf ) when a Contractor/subcontractor employee terminates work under this Task Order. All documentation shall be made available to the COR upon request.

d) Commitment to Protect Non-Public Departmental Information and Data.

The Contractor, and any subcontractors performing under this Task Order, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- Public Law 96-511 (Paperwork Reduction Act)

Each employee, including subcontractors, having access to non-public Department information under this Task Order shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx http://irtsectraining.nih.gov/ http://irtsectraining.nih.gov/ https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Non disclosure.pdf . A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the COR prior to performing any work under this Task Order.

20.14. Loss and/or Disclosure of Personally Identifiable Information (PII) –

Notification of Data Breach

Not applicable to this Task Order.

20.15. Vulnerability Scanning Requirements

Not applicable to this Task Order.

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf