Amendment000002-SolicitationNo.NIHOD2007039.pdf

, 11, THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

!XIThe above numbered solicitation is amended as set forth in Item 14. The hour and date specifiedforreceiptof Offers ~ is extended. D is notextended.

Offers must acknowledge recept of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing

Items 8 and 15, and retuning 1 copies of the amendment; (b) By acknowledging recept of this amendment on each copy of the offer submUed; or (c) By separate letteror telegramwhichincludesa referenceto the solicitationand amendmentnumbers. FAILUREOF YOUR ACKNOW-EDGEMENT TO BE RECEIVEDAT THE PLACEDESIGNATEDFORTHE RECEIPT OF OFFERS PRIORTO THE HOLR AND DATESPECIFIEDMAY RESULT IN REJECTION OF YOUR OFFER If by virtue of this amendmentyou des;-e to change an offer aready submitted, such change may be madeby telegramor letter, provided each I3legramor letter makes reference to the solicitationand this amendment,and is received prior to the openine hour and date specified.

12. ACCOUNTING AND APf'ROPRIATION DATA (/I required)

13, THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS, IT MODIFIES THE CONTRACTIORDER NO, AS DESCRIBED IN ITEM 14, CHECK ONE

A. THIS CHANGE ORDER IS ISSUEDPURSUANT TO; (Specify authority) THE CHANGESSET FORTH IN ITEM 14 ARE MADE INTHE CONTRACT

ORDER NO. IN ITEM 10A

B. THE ABOVE NUMBEREDCONTRACT/ORDER IS MODIFIED TO REFLECT THEADMINISTRATIVECHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THEAUTHORITY OF FAR 43.1O'l:b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

O. OTHER (Specify type of modification and authority)

E.IMPORTANT: Contractor D is not. D is required to sign this documentand return copies to the issuing office.

14. DESCRIPTIONOF AMENDMENTIMODIFICATION(Organized by UCF section headings, includingsolicitation/contractsubject matter where feasib/e.)

The referenced solicitation number listed in item

9A of this Standard Form 30, is hereby amended to reflect the following questions answers, delete and replace Article H.14. INFORMATION SECURITY, and to extend the due date.

and proposal

Ql.Is the NIA NHP Tissue Bank Database a Microsoft Access file or is it an application?

AI. Microsoft Access database.

Q2. If it is a file are we simply getting a current copy of the file to be placed and continually updated on a designated computer?

Continued. . .

Except as provided herein, all teoms and cond[ions of the document referenced in Item 9A or 10A, as heretofore chang3d, remains unchanged and in fullforce and effect.

15A NAME AND TITLE OF SIGNER (Type or print) 116A NAME AND TITLE OFCONTRACTING OFFICER (Type or print)

ANDREW L. MAINE

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED 16C. DATE SIGNED

(Signature of person authorized to sign)

NSN 7540.01.162.8070 STANDARD FORM 30

Presa-ibed by GSA

FAR (48 CFR) 53.243

Previous edition unusabe

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

11. CONTRACT ID COrE I PA:E O[ PAGES 3

2. AMENDMENTlr.IElBlrlEI:.1I!HJ NO. 3. EFFECTIVE DATE 4. REOUISITION/PURCHASE REO. NO.

15. PROJECT NO. (/I applicab/e)000002 02/22/2008

6. ISSUEDBY CODE

IO-OD/OLAO

7. ADMINISTEREDBY(I/otherthan Item 6) CODE IADM-OD/OLAO

National Institutes of Health National Institutes of Health

OD - Office of Logistics and OD - Office of Logistics and

Acquisition Operations Acquisition Operations Bethesda Bethesda

MD 20892-7511 MD 20892-7511

8. NAMEAND ADDRESS OF CONTRACTOR (No.,street,county,State andZIPCode) .Q1

9A AMENDMENT OF SOLICITATION NO.

NIHOD2007039

X

9B. DATED (SEE ITEM 11)

11/26/2007

10A MODIFICATIONOF CONTR'\CT/ORDER NO.

108. DATED (SEE ITEM 11)

CODE FACILITYCODE

CONTINUATION SHEET I REFERENCE NO. OF DOCUMENT BEING CONTINUED

NIHOD2007039/000002

NAME OF OFFEROR OR CONTRACTOR

ITEM NO.

(A)

SUPPLIES/SERVICES

(B)

A2. Yes.

Q3. If the NIA NHP Tissue Bank Database is an application can you describe the type of application and how it is to be used?

A3. N\A

Q3.a Is it a web based application?

A3.a N\A

Q3.b Is it a local application that we will place on our servers?

A3.b N\A

Q3.c Is it an application stored on an NIA server that we will have an interface with?

A3.c N\A

ARTICLE H.14. INFORMATION SECURITY, of the referenced solicitation number listed in item 9A of this Standard Form 30, is hereby deleted and replaced with the new Article H.14. INFORMATION

SECURITY, contained in attachment 1 of this amendment as a result of the following questions:

1. In RFP Article H.14 Information Security, subparagraph d. Information Systems Security

Plan, reference is made to a subparagraph which is not included in the RFP.

Your attention is directed to H.14.d., the second paragraph, last sentence: GThe details contained in the contractorGs SSP shall be commensurate with the size and complexity of the requirements of the SOW based on the System Categorization determined above in subparagraph (b) GSecurity

Categories and Levels of this ArticleG [emphasis added]. Subparagraph b of Article H.14 is

Personnel Security Responsibilities.

The referenced subparagraph entitled Security

Categories and Levels of this Article appears to be missing from the RFP. Please provide the security categories and security levels or indicate if no such security requirements exist Continued. . .

NSN 7540-01-152-8067

QUANTITYIUNIT

(C) (D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

CONTINUATION SHEET IREFERENCE NO. OF DOCUMENT BEING CONTINUED

NIHOD2007039/000002

NAME OF OFFEROR OR CONTRACTOR

ITEM NO.

(A)

NSN 7540-01-152-8067

SUPPLIES/SERVICES

(B) for personnel.

2. Further clarification is sought pertaining to

RFP Article H.14 Information Security, subparagraph d. Information Systems Security

Plan. Since neither security categories nor levels of security are provided, is a Draft

Security Plan required?

3. If a Draft Security Plan is required, please provide the necessary security level/categories in order to develop a proper Security Plan.

NOTE: Offerors are required to acknowledge receipt of this amendment prior to 02/29/2008, 3 pm local time.

Period of Performance: 09/01/2008 to 08/31/2012

QUANTITYIUNIT

(C) (D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

The proposal due date has been changed as follows:

PROM: 02/29/2008, 3:00 p.m., local time.

TO: 03/07/2008, 3:00 p.m., local time.

RFP Number: NIHOD2007039 Amendment 000002 Attachment 1

ARTICLE H.14. INFORMATION SECURITY

The Aged Non-human Primate Tissue Bank Statement of Work (SOW) requires the contractor to develop or access Federal automated information systems; therefore, the contractor shall comply with the "DHHS Information Security Program Policy" (http://ww\v.hhs.gov/read/irmpolicv/FINALHllS [nformationSecuritvProgramP .doc) as set forth below. The contractor shall include this provision in any subcontract awarded under this contract.

a. Information Type

[-Y]

Administrative; Management and Support Information:

Mission Based Information:

C.2.8.9 Personal Identity and Authentication D.19.1 Scientific and Technical Research and Innovation D.20.1 Research and Development

b. Security Categories and Levels

Overall

Level: [ ] Low [-Y]Moderate [ ] High Level: [ ] Low [-Y]Moderate [ ] High Level: [-Y]Low [ ] Moderate [ ] High

Level: [ ] Low [-Y]Moderate [ ] High

Confidentiality Integrity Availability

c. Position Sensitivity Designations

(1) The following position sensitivity designations and associated clearance and investigation requirements apply under this contract:

[ ] Level 6: Public Trust -High Risk (Requires Suitability Determination with a BI). Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

[ ] Level 5: Public Trust -Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIe), Page 1 of7

(2)

(3) a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[-V] Levell: Non Sensitive (Requires Suitability Determination with an NACI). Contractor employees assigned to a Levell position are subject to a National Agency Check and Inquiry Investigation (NACI).

The contractor shall submit a roster, by name, position and responsibility, of all IT staff working under the contract. The roster shall be submitted to the Project Officer, with a copy to the Contracting Officer, within 14 days of the effective date ofthe contract. Any revisions to the Roster as a result of staffing changes shall be submitted within fifteen (15) calendar days ofthe change. The Contracting Officer shall notify the contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at:

1;1ttg;LLyjrtuaJ.11Qi.nih,ggy!S~Ur.liYfRo1i0yLaissp!contractor IforI1)0.!Suitilhil.i1Y:

roster .xlshttp://a1s.nci.n1l1.gov/fbrms/Su1tabil itv-roster .xls

Upon receipt of the Government's notification of applicable Suitability Investigation required, the contractor shall complete and submit the required forms within 30 days of the notification. Additional submission instructions can be found at the "NCI Information Technology Security Policies, Background Investigation Process" website: http://ais.ncLnih.gov.

Contractor employees who have had a background investigation conducted by the U.S. Office of Personnel Management (OPM) within the last five years may only require an updated or upgraded investigation.

Contractor employees shall comply with the DHHS criteria for the assigned position sensitivity designations prior to performing any work under this contract.

The following exceptions apply:

Levels 5 and 1: Contractor employees may begin work under the contract after the contractor has submitted the name, position and responsibility of the employee to the Project Officer, as described in paragraph c. (2) above.

Level 6: In special circumstances the Project Officer may request a waiver of the preappointment investigation. If the waiver is granted, the Project Officer will provide written authorization for the contractor employee to work under the contract.

Page 2 of7

RFP Number: NIHOD2007039

d. Systems Security Plan

Amendment 000002 Attachment 1

The contractor shall protect Federal automated information systems that are developed or accessed by the contractor. The Systems Security Plan (SSP) that the contractor submitted with its offer shall be finalized in coordination with the Project Officer no later than 90 calendar days after contract award. The plan must:

(1) Include a plan of present and proposed systems security programs commensurate with the size and complexity ofthe requirements ofthe Statement of Work. The minimum areas to be addressed include, but are not limited to administrative, technical, and physical security as follows:

(i) (ii)

(iii)

(iv)

(v)

Security Awareness Training Logical Access Control

-Network (ex: firewall) -System (ex: network OS, tcp wrappers, SSH) -Application (ex: S-LDAP, SSL) -Remote Access (ex: VPN) -Monitoring and support (ex: IDS, pager, NOC)

Protection against data loss -OS security (ex: patch management, configuration) -Application security (ex: patch management) -Database security -Back-up and recovery -Fault tolerance, high availability

Malicious Code Protection (ex: Antivirus, filtering of e-mail attachments, etc) Physical Security

-Access control (ex: locks, guards) -Power conditioning and/or UPS -Air conditioning -Fire protection

(Offerors are welcome to use:

NIH Systems Security Plan Template (detailed) at:

http://irm.dtnih.gov/security/secpJantemp.doc; or NIH Systems Security Plan Outline (outline only) at:

(2) Include an acknowledgment of its understanding of the security requirements.

(3) Provide similar information for any proposed subcontractor developing or accessing an AIS.

Page 3 of7

e. Rules of Behavior

The contractor shall comply with the NIH Information Technology General Rules of Behaviorat: ht irm.cit.nih. i trob.html. NOTE:

Please be aware that some links within this link are sensitive and therefore, restricted to NIH Only.

f. Information Securitv Training

Each contractor employee shall complete the NIH Computer Security Awareness Training (httJ21!irt~~!r..pjning,nih,g~)VDprior to performing any contract work, and on an annual basis thereafter, during the period of performance of this contract.

The contractor shall maintain a listing by name and title of each individual working under this contract that has completed the NIH required training. Any additional security training completed by contractor staff shall be included on this listing. The listing of completed training shall be included in the first technical progress report. (See Article C.2. Reporting Requirements) any revisions to this listing as a result of staffing changes shall be submitted with next required technical progress report.

g. Personnel Security Responsibilities

The contractor shall perform and document the actions identified in the "Employee Separation Checklist", attached and made a part of this contract, when a contractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

h. Commitment to Protect Departmental Information Systems and Data

(1) Contractor Agreement

The Contractor shall not release, publish, or disclose Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information:

-18 V.S.C. 641 (Criminal Code: Public Money, Property or Records) -18 V.S.C. 1905 (Criminal Code: Disclosure of Confidential Information) -Public Law 96-511 (Paperwork Reduction Act)

(2) Contractor-Employee Non-Disclosure Agreements

Each contractor employee who may have access to sensitive Department information under this contract shall complete Commitment To Protect Non-

Page 4 of7

RFP Number: NIHOD2007039

1.

(4)

(5)

(6)

(7)

(8)

(9)

(10)

(11)

(12)

(13)

(14)

Amendment 000002 Attachment 1

Public Information -Contractor Agreement. A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under the contract.

References

(1)

(2)

DHHS Information Security Program Policy:

DHHS Personnel Security/Suitability Handbook:

http://v'lVvw .hhs. gQV/ohr Imanuatl pssh. pdf

NIST Special Publication 800-16, Information Technology Security Training Requirements:

http://csrc.njstgov/pub.licalions/ni.§1Ql1bsL800-16/800-1&J2Qt' Appendix A-D: ht.!l?:/I<.:srcJli~tgoyLm!bUcations/nistPJlh§!.:~16/Am29ndixA- P:12dJ NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems:

(3)

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I:

http://csrc.nistgov Ipub]ications/nistpubs/800-60/SP800-60Y I-11nal.pdf NIST SP 800-60, Guide for Mapping Types ofInformation and Information Systems to Security Categories, Volume II:

NIST SP 800-64, Security Considerations in the Information System Development Life Cycle:

NIH Computer Security Awareness Training Course:

Roster of Employees Requiring Suitability Investigations:

http://ais.nci.nih .goyIEwm),/S tt!tab i Ii tL::EPster:!:-f!s NCI Information Technology Security Policies, Background Investigation Process:

NIH Systems Security Plan Template (detailed):

http://irm .e itni h. gO'll securi tv 1seep] an temp.ct oc

NIH Systems Security Plan Outline (outline only):

http://irm.citnih.gov /nihsecuritvISecmit'l Plan Out!ine.doc NIH Information Technology General Rules of Behavior:

http://irm.citnih.gov/securitv/nillitrob.htmI Commitment To Protect Non-Public Information - Contractor Agreement:

Page 5 of7

Commitment to Protect Non-Public Information

Contractor Agreement

Access to sensitive information from the files of the National Institutes of Health (NIH) is required in the performance of my official duties, under contract number between (NIH IIC Name or Component) and my employer (Employer's Name) . I agree that I shall not release, publish, or disclose such information to unauthorized personnel, and I shall protect such information in accordance with relevant laws and regulations available for research and review at any Law Library. Among these laws may be various provisions of:

a) 18 V.S.C. 641 (Criminal Code: Public Money, Property or Records; 2pgs.long)

b) 18 V.S.c. 1905 (Criminal Code: Disclosure of Confidential Information; 2 pgs.long)

c) Public Law 96-511 (Paperwork Reduction Act; Encyclopedic in length)

I affirm that I have received a written and/or verbal briefing by my company concerning my responsibilities under this agreement. I understand that violation of this agreement may subject me to criminal and civil penalties.

Signed:

Type or Print Name:

Date:

Witnessed by:

Date:

Copies are to be retained by: NIH Project Officer Contractor's Contract Management

Individual Signatory

Page 6 of7

EMPLOYEE SEPARATION CHECKLIST

Contractor: Contract No:

Departing Staff Member's Name: Separation Date:

Check and complete one of the columns below as appropriate:

CERTIFICATION: By signing below, I certify that the above actions were taken on the dates indicated.

Signature and Date Typed Name of Individual Authorized to Certify for Contractor

Title of Individual Authorized to Certify for Contractor

Page7of7

I. FRIENDLY SEPARATION II. UNFRIENDLY SEPARATION

Date Date

(Mandatory) Action (Mandatory) Action

Remove all network and system access Disable system access as quickly as possible-privileges. preferably just before the individual is notified 0 his or her dismissal.

Collect any authentication tokens. Terminate access to systems immediately when an employee notifies the Department of a resignation that is on unfriendly terms.

Retrieve any access cards 0 Notify support functions (e.g., help desk) that an Departmental identification badges. employee is no longer authorized access.

Recover all keys. Restrict the area and function of employees during the period between termination and leaving.

Brief employee on continuing Immediately notify the Project Officer, confidentiality and privacy appropriate NIH security officials (including the responsibilities. NIH Help Desk at 301-496-4357), and the assigned IT Systems Manager of the time 0 removal.

Review any employee contracts that Request the Project Officer to have the remain valid after separation. combinations changed on all locks to which the contractor employee has access.

Return property belonging to the United Collect any authentication tokens.

States Government.

Identify any unique problems, filing Retrieve any access cards or Departmental schemes, or data backups created by identification badges.

the employee.

Instruct employees on proper "clean up" Recover all keys.

procedures for their personal computers (PC) before leaving.

Determine the employee's access Review the employee's duties and termination date, and notify the Project responsibilities under this contract with the Officer, appropriate NIH security Project Officer and assess the level of risk to officials (including the NIH Help Desk at the Government.

301-496-4357), and the assigned IT Systems Manager within 24 hours 0 the time of termination.

Notify the Project Officer in writing upon Escort individual off premises in cases where completion of these actions. the potential for retaliation is high.

Notify the Project Officer in writing upon completion of these actions.