SOW.pdf

Statement of Work

Purpose The NINR DIR investigators require total RNA extraction from PAXGene RNA tubes with globin reduction followed by rRNA elimination and sample library preparation for total RNA sequencing and next generation sequencing service to complete genomic analyses in on-going and future projects.

Scope The contractor shall provide laboratory expertise related to high throughput next generation sequence assay along with RNA extraction, its library preparation and quality control is required. To keep consistency of high data quality and minimum batch effect, NovaSeq run for the entire 246 samples from the same vendor from the previous studies is strongly recommended. In addition, primary data analysis is needed for initial evaluation of sequence data quality .

Task 1-Direct Research Support Through in Person Meetings and Email

• Give consultation on selection of assay kits and planning sample processing.

• Provide details of laboratory procedures performed on samples.

• Provide QC results for each laboratory steps

• Provide on-site visit for NINR investigators to check facility status

Task 2 - Project Management and Reporting Support (Task Order Management Plan)

• Meetings with NINR investigators at each Quality Check step (RNA extraction, library preparation, and sequencing) and after the final data transfer are required.

• Facility on-site visits to check data quality.

• Provide laboratory service for RNA extraction, library preparation and quality control for total RNA-seq

• Provide more than 50 million paired-end 150bp reads of sequencing data per sample with encrypted external hard drive for data security.

• Analyze initial quality control data step by step for excluding potential laboratory and analytic errors. This requires meetings to discuss with NINR investigators, as well as participation in document preparation for these documents. In addition, figures and diagrams are needed to provide summary of analyses.

Government Responsibilities The government will:

• Provide PAXGene RNA blood samples

• Organize meetings and on-site visits of vendor facility

• Follow instruction for sample shipment

• Inform any critical changes in sample collection

Responsibilities of the Contractor

• P rovide archive data including quality control assays and sequence data

• updates, discussion and progress projects

• To be available during normal business hours to address critical issues for on-site facility visit by NINR investigators to discuss data Quality Check, analyses and interpretation as needed

• To supply all necessary next generation sequencer infrastructure including quality control equipment and meeting place

Duty Station 10 Center Drive, Building 10, Room 2A19, Bethesda, MD, 20892

Period of Performance 3 Months from date of award.

Contract Type Firm Fixed Price

Deliverables

Deliverables/Reports

Due (within the following timeframes after Contract Award)

Initial quality control data of RNA Within 1 weeks after the beginning

Meetings and on-site visit Kickoff and once every week afterwards

Initial quality control of library Within 2 weeks after the beginning

Initial sequence data delivery Within 4 weeks after the beginning

Additional sequence data delivery Within 2 weeks after initial sequence data delivery, if needed

Summary and Consult meeting Whenever required by NINR investigators

Section 508

This language is applicable to Statements of Work (SOW) or Performance Work Statements (PWS) generated by the Department of Health and Human Services (HHS) that require a contractor or consultant to (1) produce content in any format that could be placed on a Department-owned or Department-funded Web site; or (2) write, create or produce any communications materials intended for public or internal use; to include reports, documents, charts, posters, presentations (such as Microsoft PowerPoint) or video material that could be placed on a Department-owned or Department-funded Web site.

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that

Federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal

Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information

Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section

508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition

Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via

HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow

Federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors11) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

References:

HHS Policy for Section 508 Electronic and Information Technology (E&IT) (January 2005):

http://www.hhs.gov/od/Final_Section_508_Policy.html

HHS Section 508 Web site: http://508.hhs.gov/

HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html

US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm

Management Requirements

The Contractor shall guarantee strict confidentiality of the information/data that is provided by the Government during the performance of this contract. The Contractor must commit to protecting non-public Departmental information and data. The Contractor and any subcontractors performing under this contract shall not release, publish, or disclose non-public Departmental information to unauthorized personnel and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

• Public Law 96-511 (Paperwork Reduction Act) http://www.hhs.gov/od/Final_Section_508_Policy.html http://508.hhs.gov/ http://www.hhs.gov/web/policies/index.html http://www.section508.gov/index.cfm

Disclosure of the information/data, in whole or in part, by Contractor can only be made after Contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the Contract, the Contractor shall obtain a written determination from the NINR Project Officer. The Contractor is not allowed to incur local travel costs associated with traveling to and from NIH's facilities.

All computer code, data and information obtained during this project will be the property of NINR.

Privacy and Security Requirements

All personnel and activities must conform to all Federal, HHS, NIH and NCI policies and guidelines regarding security, confidentiality and privacy.

Information Security is applicable to this SOW. The SOW requires the contractor to perform one, or any combination, of the following on behalf of the Government:

1. Develop, have the ability to access, and maintain a Federal information system(s).

2. Access or use of sensitive information or Personally Identifiable Information (PII).

3. Remotely access federal information or physically remove sensitive federal information or PII beyond agency premises or control.

Pursuant to Federal and HHS Information Security Program Policies the following requirements apply to this task order:

Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub. L.

No. 107-347 (Dec. 17, 2002); http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

Security Categories and Levels

The security level for this task order is:

a) Confidentiality Level: [x] Low [ ] Moderate [ ] High

b) Integrity Level: [ ] Low [ ] Moderate [x] High

c) Availability Level: [ ] Low [ x ] Moderate [.] High

Overall Level: [ ] Low [x] Moderate [ ] High

Position Sensitivity Designations

The following sensitivity level(s), clearance type(s), and investigation requirements apply to this contract:

Level 1: NACI.

The Contractor shall submit a roster by name, position, e-mail address, phone number, and responsibility of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the

Project Officer, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at http://ocio.nih.gov/docs/public/Suitability-roster.xls

Suitability investigations are required for contractors who will need access to NIH information systems and/or to

NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH

ID Badge. Each contract employee needing a suitability investigation will be contacted via e-mail by the NIH

Office of Personnel Security and Access Control (DPSAC) within 30 days. The DPSAC e-mail message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete. Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp.

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://ocio.nih.gov/docs/public/Suitability-roster.xls http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract. Contractors may begin work after the fingerprint check has been completed.

Personnel Security Responsibilities

The Contractor shall perform and document the following actions:

The contractor shall notify the Contracting Officer, the NINR Project Officer, and the Security Investigation

Reviewer within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this acquisition. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

• New employees: Provide the name, position title, e-mail address, and phone number of the new employee.

Provide the name, position title and suitability determination level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate suitability level.

• Departing employees: Provide the name, position title, and suitability determination level held by or pending for the individual.

All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

Information Security Training

Contractors/subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements.

The Contractor shall ensure that each contractor/subcontractor employee has completed the following training

(located at http://irtsectraining.nih.gov/) prior to performing any task order work, and thereafter completing the

NIH-specified fiscal year refresher course during the period of performance of this acquisition:

1. Information Security Awareness Training course (including agreement to NIH Rules of Behavior),

2. Securing Remote Computers and

3. Privacy Awareness Course

The Contractor shall maintain a list by name and title of each Contractor/Subcontractor employee working under this acquisition who has completed the NIH required training. The list (along with any subsequent updates to the list) shall be provided to the Project Officer. Any additional security training completed by

Contractor/Subcontractor staff shall be included on this list. Additional security training requirements commensurate with the position may be required as defined in NIST Special Publication 800-16, Information

Technology Security Training Requirements (http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf). This document provides information about information security training that may be useful to the Contractor.

Contractor/subcontractor staff may be required to complete additional training prior to performing any work under this acquisition as directed by the NINR ISSO, CIO, or Executive Officer. The list of completed training shall be included in the first status report submitted to the Project Officer. Any revisions to this list as a result of staffing changes shall be submitted with the next required status report.

Disclosure of information/data provided by the Government during the performance of the task order, in whole or in part, by the Contractor can only be made after the Contractor receives prior written approval from the

Contracting Official. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the Contractor shall obtain a written determination from the Contracting

Official.

The offeror shall include in the “Information Security” section of its Technical Proposal, the name and title of its official who will be responsible for all information security requirements should the offeror be selected for an award.

http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf

Contractor Employee Non-Disclosure Agreement

Each Contractor/subcontractor employee who may have access to non-public Department information under this task order shall agree to the NIH Non-Disclosure Agreement (NDA). The NDA is now part of the Information

Security Awareness Training. Upon reviewing and agreeing to the slide, the contractor has completed the NIH

NDA requirement.

Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach

The Contractor shall be responsible for reporting all incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH CISO thru the NINR ISSO within one hour of discovering the incident by using one of the following two forms:

• NIH PII Spillage Report http://ocio.nih.gov/security/sec_policy.html (PII Procedures)

• NIH Lost or Stolen Assets Report http://ocio.nih.gov/security/sec_policy.html (PII Procedures)

The notification requirements do not distinguish between suspected and confirmed breaches.

The Contractor will have access to PII due to administrative privileges and/or maintenance and troubleshooting responsibilities. The contractor is not expected to nor is the contractor authorized to access PII except as required for installation, maintenance and customer support duties. In the event the contractor discovers PII that is not in compliance with HHS/NIH policy the PII information must be identified and brought to the attention of the

COTR and ISSO immediately in order to ensure adequate protections are put in place. PII shall not be removed from the NIH perimeter without written permission from the Data Owner, COTR, NINR CIO and ISSO even on

Government provided laptops or USB drives. PII should never be included in any logs or other troubleshooting material that may need to be communicated to a vendor for troubleshooting. PII is not authorized to be collected, transmitted or stored on contractor equipment.

Data Encryption

The following applies to all Contractor/subcontractor laptop computers containing HHS data at rest and/or HHS data in transit:

1. All laptop computers used on behalf of the government shall be secured using a Federal Information

Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic

Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. All mobile devices, including non-HHS laptops and portable media, that contain sensitive HHS information shall be encrypted using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. A FIPS 140-2 compliant key recovery mechanism shall be used so that encrypted information can be decrypted and accessed by authorized personnel. Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on

Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

4. Encryption keys shall comply with all HHS and NIH policies http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf and shall provide adequate protection to prevent unauthorized decryption of the information.

5. All media used to store information shall be encrypted until it is sanitized or destroyed accordance with

NIH procedures. Contact the NIH Center for Information http://www.cit.nih.gov/ServiceCatalog/SERVICES.HTM?SERVICE=MEDIA%20SANITIZATION%20S

ERVICE.

6. Link to NIH Web Page Privacy Policy (NIH Manual Chapter

2805): http://www3.od.nih.gov/oma/manualchapters/management/2805

7. NIH Manual 1745 - NIH Information Technology (IT) Privacy Program:

http://www3.od.nih.gov/oma/manualchapters/management/1745/

8. Information Security Program Policy:

http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf

9. Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002) http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://ocio.nih.gov/security/sec_policy.html http://ocio.nih.gov/security/sec_policy.html http://csrc.nist.gov/cryptval http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf http://www.cit.nih.gov/ServiceCatalog/SERVICES.HTM?SERVICE=MEDIA%20SANITIZATION%20SERVICE http://www.cit.nih.gov/ServiceCatalog/SERVICES.HTM?SERVICE=MEDIA%20SANITIZATION%20SERVICE http://www3.od.nih.gov/oma/manualchapters/management/2805 http://www3.od.nih.gov/oma/manualchapters/management/1745/ http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

Using Secure Computers to Access Federal Information

1. The Contractor shall configure its computers that contain HHS data with the applicable United States government Configuration Baseline, USGCB (http://USGCB.NIST.gov), (formerly Federal Desktop Core

Configuration, FDCC, http://nvd.nist.gov/fdcc/index.cfm) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level.

2. The Contractor shall ensure IT applications operated on behalf of HHS are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capability to ensure its products operate correctly with USGCB configurations and do not alter USGCB settings – see http://nvd.nist.gov/validation.cfm. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products met the latest USGCB major version and subsequent major versions.

3. The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with the requirements contained in this clause.

4. As needed, the Government shall provide logical access to NIH resources via a terminal server solution to the Contractor.

5. A Privacy Act Notification Statement (NS) and NINR disclaimer must be posted on all websites, paper and electronic forms which collect information in identifiable form (IIF), that is, information that is personal in nature and which may be used to identify an individual. NOTE: The acronyms IIF and PII (personally identifiable information) mean the same thing.

NIH Physical Access Security

In accordance with OMB Memorandum M-05-24, background investigations must be completed for all contractor/subcontractor personnel who have (1) access to sensitive information, (2) access to Federal information systems, (3) regular or prolonged physical access to Federally-controlled facilities, or (4) any combination thereof.

The SOW requires the Contractor to have regular or prolonged physical access to a Federally-controlled facility and/or have access to Federal Information systems, thereby requiring compliance with the following regulations/policies:

1. HHS Information Security Program Policy:

http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf

2. Homeland Security Presidential Directive/HSPD-12, Policy for a Common Identification Standard for

Federal Employees and Contractors (08-27-04):

3. http://www.dhs.gov/xabout/laws/gc_1217616624097.shtm#1

4. OMB Memorandum M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 –

Policy for a Common Identification Standard for Federal Employees and Contractors (08-05-05):

http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf

5. Federal Information Processing Standards Publication (FIPS PUB) 201-1 (Updated June 26, 2006):

http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf

6. HHS Interim Policy: Contractual Implementation of Homeland Security Presidential Directive (HSPD)

12, Policy for a Common Identification Standard for Federal Employees and Contractors [Draft]

7. HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook (02-01-05):

http://www.hhs.gov/ohr/manual/pssh.pdf

Privacy Act

This Statement of Work requires the Contractor to have incidental or administrative access to data covered under the following but not all inclusive Privacy Act System of Records.

The Contractor agrees to comply with the policies and practices defined in the System of Records listings for this data and any other Privacy Act system the contractor may have access to, and to the Privacy Act clauses for

FAR 52.224.1 and 52.224-2, herein incorporated by reference.

http://usgcb.nist.gov/ http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf http://www.dhs.gov/xabout/laws/gc_1217616624097.shtm#1 http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf http://www.hhs.gov/ohr/manual/pssh.pdf

Privacy Act

This Statement of Work requires the Contractor to have incidental or administrative access to data covered under the following but not all inclusive Privacy Act System of Records.

The Contractor agrees to comply with the policies and practices defined in the System of Records listings for this data and any other Privacy Act system the contractor may have access to, and to the Privacy Act clauses for

FAR 52.224.1 and 52.224-2, herein incorporated by reference.

Technical Evaluation Criteria

The evaluation factors are used by the technical evaluation committee when reviewing the technical proposals.

The factors below are listed in the order of relative importance with weights assigned for evaluation purposes.

No. Criterion Points

1 Personnel Qualifications

Adequacy and feasibility of the proposed professional staff to conduct the services and meet research goals and objectives; including:

• Ph.D. in a basic science discipline

• Expertise in the analysis of levels of PAXGene RNA. Specifically, expertise related to RNA extraction with globin reduction is required.

• Previous publication of the methods used, is preferred.

• Experience in the field of next generation sequence assay

2 Past Performance

• Experience in working with NIH IC in learning the required assay.

3 Technical Approach

Adequacy and feasibility to establish and maintain sensitivity and accuracy:

• Able to meet and explain results to non-basic scientists

• Able to assist in interpreting data

• Able to write methods and results