Solicitation_RFP_No._NIHOD2015053_-_Regulatory_Compliance_and_Radiation_Safety_Support.pdf

RFP Number : NIHOD2015053

- 1 -

RFP TABLE OF CONTENTS

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. NOTICE OF SMALL BUSINESS SET-ASIDE

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. PERFORMANCE BASED ACQUISITION

e. COMMITMENT OF PUBLIC FUNDS

f. COMMUNICATIONS PRIOR TO CONTRACT AWARD

g. RELEASE OF INFORMATION

h. PREPARATION COSTS

i. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Separation of Technical and Business Proposals

4. Evaluation of Proposals

5. Potential Award Without Discussions

6. Use of the Metric System of Measurement

7. Privacy Act - Treatment of Proposal Information

8. Selection of Offerors

9. Past Performance Information

10. Information and Physical Access Security

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

- 2 -

3. Other Administrative Data

4. Qualifications of the Offeror

5. Subcontractors

6. Proposer's Annual Financial Report

7. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. MANDATORY QUALIFICATION CRITERIA

3. EVALUATION OF OPTIONS

4. TECHNICAL EVALUATION FACTORS

- 3 -

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

Independently, and not as an agent of the Government, the Contractor shall provide support to the National Institutes of Health (NIH), Division of Radiation Safety (DRS), Office of Research Services (ORS), radiation safety program in achieving compliance with some of the basic Nuclear Regulatory Commission license commitments by monitoring for contamination, surveying laboratories, performing security checks, calibrating meters and radioactive material receipt, inspection, delivery and inventory.

This requirement is being procured as an Indefinite Delivery Requirements type under FAR Part 12 (Commercial Items), FAR Part 15 (Contracting by Negotiation), and FAR Part 37.6 (Performance Based Acquisition).

ARTICLE B.2. OPTION PRICES

The final contract will contain the price/cost provisions agreed upon by the Government and the Offeror.

The Contractor shall furnish regulatory compliance and radiation safety support for the NIH for a twelve (12) month base period with four (4) twelve month option periods. The Contract Line Items (CLINs) shall be fixed unit prices in accordance with the schedule below.

a. The total estimated amount of this contract is To be determined at time of award.

b. Incentive Payments:

1. The Contractor's performance hereunder will be observed and evaluated continuously by the Government.

At the end of each evaluation period, the Contracting Officer's Representative will review performance based on the standards and criteria established in the Performance Work Statement, Attachment 5, Quality Assurance Surveillance Plan.

2.The findings of the evaluation will determine the amount of the available incentive payment earned by the Contractor for the identified evaluation period. In no event, however, will any unearned incentive payments become available in subsequent evaluation periods.

3. The Contracting Officer/Contracting Officer's Representative will notify the Contractor, in writing, of the available incentive payment actually earned for a given evaluation period. Upon receipt of this notification, the Contractor may submit an invoice for payment of the total incentive payment earned.

4. The evaluation/determination of incentive payment shall be binding on both parties and not subject to the Disputes Clause.

c. Upon delivery and acceptance of the services described in the Performance Work Statement of this contract and identified in the schedule of charges below, the Government shall pay to the Contractor the unit prices set forth below:

- 4 -

Base Year Period of Performance: __________________ through _______________

(To be completed at time of award)

Line Item

Task

Maximum Estimated Quantity

Unit

Unit Price

Total 1 Radiation Surveys 4,075 EA $ $ 2 Monthly Surveys 2,210 EA $ $ 3 Security Checks (In Hours) (Workday) 150 HR $ $ 4 Security Checks (In Hours) (Outside of M-F/9-5) 325 HR $ $ 5 Radiographic Unit Survey 13 EA $ $ 6 Fluoroscopic Unit Survey 19 EA $ $ 7 Bone Densitometer Survey 7 EA $ $ 8 Dental Radiographic Unit Survey 8 EA $ $ 9 Cabinet X-ray Unit Survey 34 EA $ $ 10 X-ray Diffraction Unit Survey 12 EA $ $ 11 CT Scanner Survey 10 EA $ $ 12 Linear Accelerator Survey 3 EA $ $ 13 Shielding (Thyroid, Gonads, Apron) Inspections 380 EA $ $ 14 Therapy Room 55 HR $ $ 15 Contamination Instrument Calibrations 1180 EA $ $ 16 Exposure Rate Instrument Calibrations 80 EA $ $ 17 Item Receipt and Inspection 2516 EA $ $ 18 On Campus Package Delivery 2181 Packages

Delivered

19 Delivery to Poolesville or Baltimore 235 Packages

Delivered

20 Delivery to Rockville 112 Packages

Delivered

21 Delivery to IRF 48 Packages

Delivered

22 On Campus Mail Delivery 52 EA $ $ 23 Annual Inventory (On Campus) 690 EA $ $ 24 Annual Inventory (Off Campus) 50 EA $ $ 25 Incentive Payment (Maximum bonus earned is 10% per billing period -monthly) Not to

Exceed

Base Year Estimated Total $

Option Year 1 Period of Performance: ________________ through ________________

2 Monthly Surveys 2,210 EA $ $

- 5 -

3 Security Checks (In Hours) (Workday) 150 HR $ $ 4 Security Checks (In Hours) (Outside of M-F/9-5) 325 HR $ $ 5 Radiographic Unit Survey 13 EA $ $ 6 Fluoroscopic Unit Survey 19 EA $ $ 7 Bone Densitometer Survey 7 EA $ $ 8 Dental Radiographic Unit Survey 8 EA $ $ 9 Cabinet X-ray Unit Survey 34 EA $ $ 10 X-ray Diffraction Unit Survey 12 EA $ $ 11 CT Scanner Survey 10 EA $ $ 12 Linear Accelerator Survey 3 EA $ $ 13 Shielding (Thyroid, Gonads, Apron) Inspections 380 EA $ $ 14 Therapy Room 55 HR $ $ 15 Contamination Instrument Calibrations 1180 EA $ $ 16 Exposure Rate Instrument Calibrations 80 EA $ $ 17 Item Receipt and Inspection 2516 EA $ $ 18 On Campus Package Delivery 2181 Packages

Delivered

19 Delivery to Poolesville or Baltimore 235 Packages

Delivered

20 Delivery to Rockville 112 Packages

Delivered

21 Delivery to IRF 48 Packages

Delivered

22 On Campus Mail Delivery 52 EA $ $ 23 Annual Inventory (On Campus) 690 EA $ $ 24 Annual Inventory (Off Campus) 50 EA $ $ 25 Incentive Payment (Maximum bonus earned is 10% per billing period -monthly) Not to

Exceed

Option Year 1 Estimated Total $

Option Year 2 Period of Performance: ________________ through ________________

2 Monthly Surveys 2,210 EA $ $ 3 Security Checks (In Hours) (Workday) 150 HR $ $ 4 Security Checks (In Hours) (Outside of M-F/9-5) 325 HR $ $ 5 Radiographic Unit Survey 13 EA $ $ 6 Fluoroscopic Unit Survey 19 EA $ $ 7 Bone Densitometer Survey 7 EA $ $ 8 Dental Radiographic Unit Survey 8 EA $ $ 9 Cabinet X-ray Unit Survey 34 EA $ $

- 6 -

10 X-ray Diffraction Unit Survey 12 EA $ $ 11 CT Scanner Survey 10 EA $ $ 12 Linear Accelerator Survey 3 EA $ $ 13 Shielding (Thyroid, Gonads, Apron) Inspections 380 EA $ $ 14 Therapy Room 55 HR $ $ 15 Contamination Instrument Calibrations 1180 EA $ $ 16 Exposure Rate Instrument Calibrations 80 EA $ $ 17 Item Receipt and Inspection 2516 EA $ $ 18 On Campus Package Delivery 2181 Packages

Delivered

19 Delivery to Poolesville or Baltimore 235 Packages

Delivered

20 Delivery to Rockville 112 Packages

Delivered

21 Delivery to IRF 48 Packages

Delivered

22 On Campus Mail Delivery 52 EA $ $ 23 Annual Inventory (On Campus) 690 EA $ $ 24 Annual Inventory (Off Campus) 50 EA $ $ 25 Incentive Payment (Maximum bonus earned is 10% per billing period -monthly) Not to

Exceed

Option Year 2 Estimated Total $

Option Year 3 Period of Performance: ________________ through ________________

2 Monthly Surveys 2,210 EA $ $ 3 Security Checks (In Hours) (Workday) 150 HR $ $ 4 Security Checks (In Hours) (Outside of M-F/9-5) 325 HR $ $ 5 Radiographic Unit Survey 13 EA $ $ 6 Fluoroscopic Unit Survey 19 EA $ $ 7 Bone Densitometer Survey 7 EA $ $ 8 Dental Radiographic Unit Survey 8 EA $ $ 9 Cabinet X-ray Unit Survey 34 EA $ $ 10 X-ray Diffraction Unit Survey 12 EA $ $ 11 CT Scanner Survey 10 EA $ $ 12 Linear Accelerator Survey 3 EA $ $ 13 Shielding (Thyroid, Gonads, Apron) Inspections 380 EA $ $ 14 Therapy Room 55 HR $ $ 15 Contamination Instrument Calibrations 1180 EA $ $ 16 Exposure Rate Instrument Calibrations 80 EA $ $

- 7 -

17 Item Receipt and Inspection 2516 EA $ $ 18 On Campus Package Delivery 2181 Packages

Delivered

19 Delivery to Poolesville or Baltimore 235 Packages

Delivered

20 Delivery to Rockville 112 Packages

Delivered

21 Delivery to IRF 48 Packages

Delivered

22 On Campus Mail Delivery 52 EA $ $ 23 Annual Inventory (On Campus) 690 EA $ $ 24 Annual Inventory (Off Campus) 50 EA $ $ 25 Incentive Payment (Maximum bonus earned is 10% per billing period -monthly) Not to

Exceed

Option Year 3 Estimated Total $

Option Year 4 Period of Performance: ________________ through ________________

2 Monthly Surveys 2,210 EA $ $ 3 Security Checks (In Hours) (Workday) 150 HR $ $ 4 Security Checks (In Hours) (Outside of M-F/9-5) 325 HR $ $ 5 Radiographic Unit Survey 13 EA $ $ 6 Fluoroscopic Unit Survey 19 EA $ $ 7 Bone Densitometer Survey 7 EA $ $ 8 Dental Radiographic Unit Survey 8 EA $ $ 9 Cabinet X-ray Unit Survey 34 EA $ $ 10 X-ray Diffraction Unit Survey 12 EA $ $ 11 CT Scanner Survey 10 EA $ $ 12 Linear Accelerator Survey 3 EA $ $ 13 Shielding (Thyroid, Gonads, Apron) Inspections 380 EA $ $ 14 Therapy Room 55 HR $ $ 15 Contamination Instrument Calibrations 1180 EA $ $ 16 Exposure Rate Instrument Calibrations 80 EA $ $ 17 Item Receipt and Inspection 2516 EA $ $ 18 On Campus Package Delivery 2181 Packages

Delivered

19 Delivery to Poolesville or Baltimore 235 Packages

Delivered

20 Delivery to Rockville 112 Packages $ $

- 8 -

Delivered

21 Delivery to IRF 48 Packages

Delivered

22 On Campus Mail Delivery 52 EA $ $ 23 Annual Inventory (On Campus) 690 EA $ $ 24 Annual Inventory (Off Campus) 50 EA $ $ 25 Incentive Payment (Maximum bonus earned is 10% per billing period -monthly) Not to

Exceed

Option Year 4 Estimated Total $

Grand Estimated Total (Base plus four (4) Option

Years)

d. The estimated contract amount and quantity for items set forth in paragraph a. & c. above are not a guarantee and are estimated quantities due to the number of work days and holidays per month and unexpected government closures.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. PERFORMANCE WORK STATEMENT

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Performance Work Statement, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

ARTICLE C.2. REPORTING REQUIREMENTS

The Contractor shall provide reports/deliverables as set forth in the Performance Work Statement.

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, To be completed upon award is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at: To be completed upon award

- 9 -

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be from To be completed upon award with options to extend for four (4) successive 12 month periods.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in Section H of this contract, the period of performance will be increased as listed below:

Period Year Option Year 1 Option Year 2 Option Year 3 Option Year 4

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be determined at time of award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.242-70 (January 2006)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible, if an individual must be replaced, for example, as a result of leaving the employ of the Contractor), the Contractor shall notify the

- 10 -

Contracting Officer and shall submit comprehensive justification for the diversion or replacement request (including proposed substitutions for key personnel) to permit evaluation by the Government of the impact on performance under this contract. The Contractor shall not divert or otherwise replace any key personnel without the written consent of the Contracting Officer. The Government may modify the contract to add or delete key personnel at the request of the Contractor or Government.

(End of Clause)

The following individuals are considered to be essential to the work being performed hereunder:

Name Title

Executive Manager

Project Manager

Senior Radiation Safety Specialist

Site Supervisor

ARTICLE G.3. METHOD OF ORDERING

a. Orders issued under this contract may be placed as follows:

[ ] in writing

[ ] via telephone

[ ] via facsimile (fax)

[ ] via electronic mail (e-mail)

[ ] Oral [Oral Orders will be confirmed in writing within days of issuance.

[X] Other Specify: A Task/Delivery Order Number shall be given to you at the time the order is placed. The Contractor is cautioned not to accept an order unless one of these number is issued.

b. The Contracting Officer is authorized to issue orders and provide written confirmation of oral orders, if applicable, under the contract.

ARTICLE G.4. INDEFINITE DELIVERY CONTRACT PAYMENT METHOD

To initiate and receive prompt payment, the Contractor shall comply with the following procedure:

a. A Task/Delivery Order Number shall be given to you at the time the order is placed. The Contractor is cautioned not to accept an order unless one of these numbers is issued.

b. Invoices shall be submitted monthly to the address indicated in Article G.5., Invoice Submission, of this contract.

Invoices shall cite the Contract Number and the Task/Delivery Order Number for each order for which payment is being requested. See Article G.5., Invoice Submission, for more information about submission of a proper invoice.

ARTICLE G.5. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract.

The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment and shall invoice on a monthly basis .

- 11 -

1. Payment requests shall be submitted to the offices identified below. Do not submit supporting documentation (e.g., receipts, time sheets, vendor invoices, etc.) with your payment request unless specified elsewhere in the contract or requested by the Contracting Officer.

a. The original invoice shall be submitted to the following designated billing office:

National Institutes of Health Office of Financial Management Commercial Accounts 2115 East Jefferson Street, Room 4B-432, MSC 8500 Bethesda, MD 20892-8500

b. One copy of the invoice shall be submitted to the following approving official:

i. Contracting Officer National Institutes of Health Office of Acquisitions, Team 2 - Red, OLAO 6011 Executive Boulevard, Room 541E, MSC 7663 Rockville, Maryland 20852

ii. COR's Address (To be completed at time of award)

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this contract is Office of Acquisitions (OLAO) Branch 2 .

b. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

c. DUNS or DUNS+4 Number. The DUNS number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid DUNS number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, DUNS, or VIN, contact the Contracting Officer.

d. Invoice Matching Option. This contract requires a Three-Way match.

e. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

f. The Contract Title is: Regulatory Compliance and Radiation Safety Support

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

- 12 -

ARTICLE G.6. GOVERNMENT PROPERTY

If this RFP will result in the acquisition or use of Government Property provided by the contracting agency or if the Contracting Officer authorizes in the preaward negotiation process, the acquisition of property (other than real property), this ARTICLE will include applicable provisions and incorporate the HHS Publication, entitled, "HHS Contracting Guide for Contract of Government Property," which can be found at: http://oamp.od.nih.gov/sites/default/ files/appendix_q_hhs_contracting_guide.pdf.

ARTICLE G.7. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually at the end of each year (base and option years).

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov

ARTICLE G.8. TECHNICAL DIRECTION

Work performance shall be subject to the technical direction of the Contracting Officer's Representative. The term"technical direction" is defined to include, without limitation, the following:

a. Directions to the Contractor which redirect the contract effort, such as shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual Performance Work Statement.

b. Provision of information to the Contractor which assists in the interpretation of drawings, specifications or technical portions of the work description.

Technical direction must be within the general scope of the work stated in the contract. The Contracting Officer's Representative does not have authority to and may not issue any technical direction which (i) constitutes an assignment of additional work outside the general scope of the contract; (ii) constitutes a change as defined in the contract clause entitled "Changes;" (iii) in any manner causes an increase or decrease in the total estimated contract cost, the fixed fee or the time required for contract performance; or (iv) change any of the expressed terms,conditions, or specifications of the contract.

Contractor shall proceed promptly with the performance of technical direction duly issued by the Contracting Officer's Representative in the manner prescribed by this Article and within his authority under the provisions of this Article.

If, in the opinion of the Contractor, any instruction or direction issued by the Contracting Officer's Representative is within one of the categories as defined in (a) through (b) above, the Contractor shall not proceed but shall notify the Contracting Officer in writing within five (5) working days after the receipt of any such instruction or direction and shall request the Contracting Officer to modify the contract accordingly. Upon receiving such notification from the Contractor, the Contracting Officer shall issue an appropriate contract modification or advise the Contractor in writing http://oamp.od.nih.gov/sites/default/files/appendix_q_hhs_contracting_guide.pdf http://oamp.od.nih.gov/sites/default/files/appendix_q_hhs_contracting_guide.pdf http://www.cpars.gov

- 13 -that, in his opinion, the technical direction is within the scope of this Article and does not constitute a change under the Changes clause of the contract. The Contractor shall thereupon proceed immediately with the direction given. A failure to the parties to agree upon the nature of the instruction or direction or upon the contracting action to be taken with respect thereto shall be subject to the provisions of the contract clause entitled "Disputes."

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. NEEDLE DISTRIBUTION

The Contractor shall not use contract funds to carry out any program of distributing sterile needles or syringes for the hypodermic injection of any illegal drug.

ARTICLE H.2. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.3. AVAILABILITY OF FUNDS FOR NEXT FISCAL YEAR (FAR 52.232-19) (APR

1984)

Funds are not presently available for performance under this contract beyond the Government's current fiscal year.

The Government's obligation for performance of this contract beyond that date is contingent upon the availability of appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise for performance under this contract beyond the Government's current fiscal year, until funds are made available to the Contracting Officer for performance and until the Contractor receives notice of availability, to be confirmed in writing by the Contracting Officer.

ARTICLE H.4. PRIVACY ACT, HHSAR 352.224-70 (January 2006)

This contract requires the Contractor to perform one or more of the following: (a) Design; (b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations. The term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)). The Contractor shall ensure that each of its employees knows the prescribed rules of conduct and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records [5 U.S.C. 552a(m)(1)]. The contract work statement: (a) identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and (b) specifies the disposition to be made of such records upon completion of contract performance.

(End of clause)

45 CFR Part 5b contains additional information which includes the rules of conduct and other Privacy Act requirements and can be found at: http://www.access.gpo.gov/nara/cfr/waisidx_06/45cfr5b_06.html.

http://www.access.gpo.gov/nara/cfr/waisidx_06/45cfr5b_06.html

- 14 -

ARTICLE H.5. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-9, Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given at least 60 days prior to the expiration date of this contract, and the price of the contract will be increased as set forth in the OPTION PRICES Article in SECTION B of this contract.

ARTICLE H.6. INFORMATION AND PHYSICAL ACCESS SECURITY

A. HHS-Controlled Facilities and Information Systems Security

a. To perform the work specified herein, Contractor personnel are expected to have routine (1) physical access to an HHS-controlled facility; (2) physical access to an HHS-controlled information system; (3) access to sensitive HHS data or information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

b. To gain routine physical access to an HHS-controlled information system, and/or access to sensitive data or information, the Contractor and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; Office of Management and Budget Memorandum (M-05-24); and Federal Information Processing Standards Publication (FIPS PUB) Number 201; and with the personal identity verification and investigations procedures contained in the following documents:

1. HHS-OCIO Information Systems Security and Privacy Policy ( http://www.hhs.gov/ocio/policy/ #Security)

2. HHS HSPD-12 Policy Document, v. 2.0 ( http://www.whitehouse.gov/sites/default/files/omb/assets/ omb/memoranda/fy2005/m05-24.pdf)

3. Information regarding background checks/badges ( http://idbadge.nih.gov/background/index.asp)

c. Position Sensitivity Levels:

This contract will entail the following position sensitivity levels:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (MBI).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

d. The personnel investigation procedures for Contractor personnel require that the Contractor prepare and submit background check/investigation forms based on the type of investigation required. The minimum Government investigation for a non-sensitive position is a National Agency Check and Inquiries (NACI) with fingerprinting. More restricted positions - i.e., those above non-sensitive, require more extensive documentation and investigation.

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract who will develop, have the ability to http://www.hhs.gov/ocio/policy/#Security http://www.hhs.gov/ocio/policy/#Security http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf http://idbadge.nih.gov/background/index.asp

- 15 -access and/or maintain a Federal Information System(s). The roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days after the effective date of the contract. The Contracting Officer shall notify the Contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: https://ocio.nih.gov/aboutus/publicinfosecurity/ acquisition/Documents/SuitabilityRoster_10-15-12.xlsx.

Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

e. Investigations are expensive and may delay performance, regardless of the outcome of the investigation.

Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

f. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

g. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

h. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

i. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

B. Standard for Security Configurations, HHSAR 352.239-70, (January 2010)

a. The Contractor shall configure its computers that contain HHS data with the applicable Federal Desktop Core Configuration (FDCC) (see http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

Note: FDCC is applicable to all computing systems using Windows XPTM and Windows VistaTM, including desktops and laptops - regardless of function - but not including servers.

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx http://nvd.nist.gov/fdcc/index.cfm

- 16 -

b. The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of HHS. The following security configuration requirements apply:

c. The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with FDCC Scanner capability to ensure its products operate correctly with FDCC configurations and do not alter FDCC settings - see http:// scap.nist.gov/validation. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products met the latest FDCC major version and subsequent major versions.

d. The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

e. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

f. The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant ( http:// csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf), Homeland Security Presidential Directive 12 (HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR Subpart 4.13, Personal Identity Verification.

g. The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

C. Standard for Encryption language, HHSAR 352.239-71, (January 2010)

a. The Contractor shall use Federal Information processing Standard (FIPS) 140-2-compliant encryption (Security) Requirements for Cryptographic Module, as amended) to protect all instances of HHS sensitive information during storage and transmission. (Note: The Government has determined that HHS information under this contract is considered "sensitive" in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004).

b. The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/groups/STM/cmvp/) to confirm compliance with FIPS 140-2 (as amended). The Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

c. The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

d. The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

http://scap.nist.gov/validation http://scap.nist.gov/validation http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://csrc.nist.gov/groups/STM/cmvp/ http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

- 17 -

e. The Contractor shall ensure that this standard is incorporated into the Contractor's property management/ control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive HHS information.

f. The Contractor shall ensure that its subcontractors (all tiers) which perform work under this contract comply with the requirements contained in this clause.

D. Security Requirements For Federal Information Technology Resources, HHSAR 352.239-72, (January 2010)

a. Applicability. This clause applies whether the entire contract or order (hereafter "contract"), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term "information technology (IT)", as used in this clause, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services) and related resources. This clause does not apply to national security systems as defined in FISMA.

b. Contractor responsibilities. The Contractor is responsible for the following:

1. Protecting Federal information and Federal information systems in order to ensure their -

a. Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity;

b. Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

c. Availability, which means ensuring timely and reliable access to and use of information.

2. Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS.

3. Adopting, and implementing, at a minimum, the policies, procedures, controls and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

c. Contractor security deliverables. In accordance with the timeframes specified, the Contractor shall prepare and submit the following security documents to the Contracting Officer for review, comment, and acceptance:

1. IT Security Plan (IT-SP) - due within 30 days after contract award. The IT-SP shall be consistent with, and further detail the approach to, IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The IT-SP shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract. If the IT-SP only applies to a portion of the contract, the Contractor shall specify those parts of the contract to which the IT-SP applies.

a. The Contractor's IT-SP shall comply with applicable Federal laws that include, but are not limited to, the Federal Information Security Management Act (FISMA) of 2002 (Title III of the E- Government Act of 2002, Public Law 107-347), and the following Federal and HHS policies and procedures:

- 18 -

i. Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automation Information Resources.

ii. National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-18, Guide for Developing Security Plans for Information Systems, in form and content, and with any pertinent contract Statement of Work/Performance Work Statement (SOW/ PWS) requirements. The IT-SP shall identify and document appropriate IT security controls consistent with the sensitivity of the information and the requirements of Federal Information Processing Standard (FIPS) 200, Recommend Security Controls for Federal Information Systems. The Contractor shall review and update the IT-SP in accordance with NIST SP 800-26, Security Self-Assessment Guide for Information Technology Systems and FIPS 200, on an annual basis.

iii. HHS-OCIO Information Systems Security and Privacy Policy.

2. IT Risk Assessment (IT-RA) - due within 30 days after contract award. The IT-RA shall be consistent, in form and content, with NIST SP 800-30, Risk Management Guide for Information Technology Systems, and any additions or augmentations described in the HHS-OCIO Information Systems Security and Privacy Policy. After resolution of any comments provided by the Government on the draft IT-RA, the Contracting Officer shall accept the IT-RA and incorporate the Contractor's final version into the contract for Contractor implementation and maintenance. The Contractor shall update the IT-RA on an annual basis.

3. FIPS 199 Standards for Security Categorization of Federal Information and Information Systems Assessment (FIPS 199 Assessment) - due within 30 days after contract award. The FIPS 199 Assessment shall be consistent with the cited NIST standard. After resolution of any comments by the Government on the draft FIPS 199 Assessment, the Contracting Officer shall accept the FIPS 199 Assessment and incorporate the Contractor's final version into the contract.

4. IT Security Certification and Accreditation (IT-SC&A) - due within 3 months after contract award.

The Contractor shall submit written proof to the Contracting Officer that an IT-SC&A was performed for applicable information systems - see paragraph (a) of this clause. The Contractor shall perform the IT-SC&A in accordance with the HHS Chief Information Security Officer's Certification and Accreditation Checklist; NIST SP 800-37, Guide for the Security, Certification and Accreditation of Federal Information Systems; and NIST 800-53, Recommended Security Controls for Federal Information Systems. An authorized senior management official shall sign the draft IT-SC&A and provided it to the Contracting Officer for review, comment, and acceptance.

a. After resolution of any comments provided by the Government on the draft IT SC&A, the Contracting Officer shall accept the IT-SC&A and incorporate the Contractor's final version into the contract as a compliance requirement.

b. The Contractor shall also perform an annual security control assessment and provide to the Contracting Officer verification that the IT-SC&A remains valid. Evidence of a valid system accreditation includes written results of:

i. Annual testing of the system contingency plan; and

ii. The performance of security control testing and evaluation.

d. Personal identity verification. The Contractor shall identify its employees with access to systems operated by the Contractor for HHS or connected to HHS systems and networks. The Contracting Officer's Representative (COR) shall identify, for those identified employees, position sensitivity levels that are commensurate with the responsibilities and risks associated with their assigned positions. The Contractor shall comply with the HSPD-12 requirements contained in "HHS-Controlled Facilities and Information Systems Security" requirements specified in the SOW/PWS of this contract.

- 19 -

e. Contractor and subcontractor employee training. The Contractor shall ensure that its employees, and those of its subcontractors, performing under this contract complete HHS-furnished initial and refresher security and privacy education and awareness training before being granted access to systems operated by the Contractor on behalf of HHS or access to HHS systems and networks. The Contractor shall provide documentation to the COR evidencing that Contractor employees have completed the required training.

f. Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

g. Subcontracts. The Contractor shall incorporate the substance of this clause in all subcontracts that require protection of Federal information and Federal information systems as described in paragraph (a) of this clause, including those subcontracts that -

a. Have physical or electronic access to HHS' computer systems, networks, or IT infrastructure; or

b. Use information systems to generate, store, process, or exchange data with HHS or on behalf of HHS, regardless of whether the data resides on a HHS or the Contractor's information system.

h. Contractor employment notice. The Contractor shall immediately notify the Contracting Officer when an employee either begins or terminates employment (or is no longer assigned to the HHS project under this contract), if that employee has, or had, access to HHS information systems or data.

i. Document information. The Contractor shall contact the Contracting Officer for any documents, information, or forms necessary to comply with the requirements of this clause.

j. Contractor responsibilities upon physical completion of the contract. The Contractor shall return all HHS information and IT resources provided to the Contractor during contract performance and certify that all HHS information has been purged from Contractor-owned systems used in contract performance.

k. Failure to comply. Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause shall be grounds for the Contracting Officer to terminate this contract.

(End of Clause)

Note: The NIST Special Publication SP-800-26 cited in subparagraph c.1.a.(ii) of this clause has been superseded by NIST SP 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems and Organizations" for use for the assessment of security control effectiveness. See http://csrc.nist.gov/ publications/PubsSPs.html to access NIST Special Publications (800 Series).

E. Additional NIH Requirements

1. SECURITY…