OWH Birth Outcomes SOW.pdf

Description/Specifications/Statement of Work

TITLE: Interagency Coordinating Committee on the Promotion of Optimal Birth Outcomes:

Maternal Health Data and Outcomes and Technical Assistance for the HHS Maternal Health Portfolio

1. PROGRAM DESCRIPTION AND BACKGROUND

Introduction

Purpose

This contract further supports the Office on Women’s Health Maternal Health Portfolio, including the Interagency Coordinating Committee on the Promotion of Optimal Birth Outcomes, in coordinating efforts among agencies to achieve the best possible maternal-infant health outcomes by addressing contributing factors. This program aims to improve national maternal-infant health efforts, track maternal and infant health trends, promote transparency across federal agencies and the public, and support policy and evidence-based decision-making.

Key aspects of this work include:

1. Production of an annual progress report of activities and outcomes of HHS maternal-infant health programs.

2. Maintain and enhance the HHS Interagency Maternal–Infant Health Outcome Dashboard (the Dashboard).

3. Statistical analyses, interpreting, and summarizing birth outcome health data.

Background

The Office on Women’s Health (OWH) coordinates women's health efforts across HHS. It addresses critical women's health issues by informing and advancing policies, educating health care professionals and consumers, and supporting innovative programs. OWH leads the Interagency Coordinating Committee on the Promotion of Optimal Birth Outcomes (the Committee) to oversee and coordinate the HHS Plan to improve maternal health in America, in response to House Report 119-55 accompanying the Fiscal Year 2026 Consolidated Appropriations Act. The Committee implements the goals of HHS to improve birth outcomes, including identifying key conditions contributing to maternal-infant mortality and morbidity.

Support is needed to produce an annual progress report that reports on activities and outcomes of the HHS programs directed toward improving the nation's maternity outcomes, refine and implement a data measurement framework to create and maintain an HHS Interagency Maternal- Infant Health Dashboard that will assess the current state of maternal-infant health outcomes and to provide technical assistance in the form of statistical analyses, interpreting and summarizing the data to support report development and dissemination.

OWH requires the ability to collect standardized and stratified maternal-infant health measure data across multiple agencies including state and federal as well as other non-federal data into a single tool or dashboard, that can be used to support outcome and performance monitoring and conduct relevant analysis to support improvement of U.S. maternal health outcomes (including but not limited to severe maternal morbidity, mortality, and co-morbidities). Additionally, OWH requires the ability to develop and deliver reports, manuscripts, and visualizations focused on various aspects of women's, infants', and maternal health.

Program Goal and Support Functions

This contract aims to improve health in the United States (U.S.). Department of Health and Human Services' (HHS) vision is to ensure that the U.S. is one of the safest countries in the world in which to give birth. This contract will further support the Office on Women’s Health Maternal Health Portfolio, including the Interagency Coordinating Committee on the Promotion of Optimal Birth Outcomes, to coordinate efforts among agencies to achieve the best possible maternal-infant health outcomes by addressing contributing factors. This program aims to improve national maternal-infant health efforts, track maternal and infant health trends, promote transparency across federal agencies and the public, and support policy and evidence-based decision-making.

The tasks in this SOW are structured around improving maternal-infant health outcomes.

Throughout the 12-month base period and each of the four (4) option years (if exercised), the COR and the Project Officer will meet with the contractor to provide details on the specific projects requiring support. Specific project work plans will be developed for each project, with a budget estimate by task and cost justification.

The contractor will support the following functions:

• Provide an effective project management work plan, monthly progress and budget reports, and attend weekly and requested ad hoc project management meetings to ensure that defined tasks and work products are delivered on time, within budget, and to the satisfaction of HHS.

• Maintain and enhance a maternal and infant health measure data collection tool or “dashboard” containing aggregated maternal and infant health outcome measures drawn from state, federal, and non-federal data sources to support outcome and performance monitoring, data visualization, and analytics.

• Synthesize and analyze the landscape of maternal and infant health measures and best practices to support designing and implementing program evaluation to identify how these measures relate to each other, existing data gaps, and opportunities to develop new measures.

• Provide technical assistance and develop work products, including various quantitative and qualitative analyses and associated written documents.

• Analyze measure data using advanced biostatistics methods, including regression analyses and microsimulation modeling, to address example research topics such as:

o Understanding the relationship between various pre-existing medical conditions and other risk factors and severe maternal morbidity and mortality.

o Assessing outcomes (beyond programmatic outputs) that are the focus of HHS initiatives.

o Estimating the costs and benefits of policy proposals under consideration by the

Department or Congress o Work with Committee members on maternal and infant health innovations, market trends, and opportunities to identify gaps in knowledge for quantitative and qualitative analysis.

• Support the Committee and key designated HHS staff with developing an annual report for public dissemination of birth outcome statistics and results from HHS programs and policies that impact U.S. women and birth outcomes.

• Write and edit meeting materials and written reports, including:

o Prepare analysis plans and reports.

o Develop briefing papers and/or reports.

o Develop and produce progress reports that inform on activities and outcomes of

HHS programs directed toward improving maternity outcomes.

o Prepare publication-quality data analysis tables and plots for HHS and peer publications.

2. STATEMENT OF WORK – Non-Severable Services

The Contractor shall furnish all the necessary personnel, materials, services, facilities (except as otherwise specified herein), and otherwise do all the things necessary for or incident to the performance of the work as set forth below:

This is a 60-month contract with multiple projects. The contractor shall provide the necessary personnel, materials, equipment, support, and supplies to complete the tasks listed below unless it is explicitly indicated in this SOW that the COR or the Project Officer (PO) will provide personnel, materials, equipment, support, or supplies. All work done under this order shall be performed under the general guidance of the COR and/or the PO and is subject to the COR’s approval. The COR and PO will be responsible for monitoring the contractor’s technical progress under the SOW for specific projects, including surveillance and assessment of the contractor’s work performance, the timeliness of deliverables, budget estimates and costs, and compliance with all project objectives. The COR and/or the PO will work with the contractor on technical matters, such as selecting alternative methods or approaches for each project, and assist the COR in ensuring that contract requirements are met and services are delivered.

Certain work products delivered under this scope of work may be released to the public, while others may be for internal technical use only. Upon receipt of any work products designated for public use (as requested by the COR or the PO), the contractor shall provide the necessary services to make a work product ready for publication (in print or electronically) and shall comply with all HHS 508 compliance requirements as specified in the contract for final versions of work products. Only publicly released work products will require HHS 508 compliance and must meet all HHS 508 compliance requirements; however, all documents should be prepared with the assumption that they may become public at any time, therefore, they should be structured in a way so that becoming 508 compliant should be as easy as possible unless otherwise noted by the COR and/or the PO.

All final-version deliverables shall be quality-checked by a senior writer-editor to ensure compliance with applicable HHS and OWH style guides, manuals, and standards, as well as the requirements defined prior to delivery to the COR or the PO. The contractor shall ensure that all work products are policy-relevant, clearly written in plain language, and include appropriate tables, figures, and graphs. The contractor should have policies in place to ensure high-quality work with minimal editing of drafts and final deliverables. The contractor shall ensure it can maximize quality, minimize costs, and deliver multiple drafts of deliverables for any requested work. Please see the Quality Assurance Surveillance Plan for more details on performance related to high-quality deliverables.

C.2.1 SERVICES COMPONENT

TASK 1 - PROJECT MANAGEMENT

Subtask 1.1: Kick-Off Meeting

The Contractor shall meet with the Contracting Officer’s Representative (COR) and Project Officer (PO) within two (2) weeks after base and option year awards to ensure clarification of project goals, scope of work, routine communication standards, quality control standards, and deliverable and invoice submissions. The purpose of the meeting will be to discuss the objectives of the contract and to reach a common understanding of how the contractor will complete the work, the timelines, and the deliverable schedule for projects under this contract. The contractor shall be prepared to discuss critical activities requiring immediate attention and the project execution process. The COR and PO may also discuss anticipated requests with the contractor.

The contractor may provide COR with a list of questions or issues in advance of the Kick-Off meeting. After the meeting, the contractor shall submit a memo to the COR summarizing the meeting and any decisions made.

Deliverable(s): (A) Kick-Off Meeting (B) Meeting Summary Memo

Subtask 1.2: Weekly COR and PO Meetings

The contractor shall prepare a draft project management plan for the contract that details the intended approach to supporting the women’s health portfolio during the period of performance.

The management plan shall be brief (up to 5 pages) and include: an overall approach to performing tasks and managing projects, plans for communication, processes for budget and cost estimation, and a plan for how to resolve any issues that present themselves over the contract period of performance (i.e., changes in key personnel, delays in obtaining critical data).

The contract management plan shall specify: the contractor’s strategy for planning and preparing analytic products on short, medium, or long-term projects; how appropriate or necessary analysts, experts (including academic or other institutions), or sub-contractors are identified, and a strategy for conducting any data or policy analysis that may be requested for work products, including a process for receiving input from the COR and/or PO during the development of each product.

The contract management plan shall also include draft elements for the monthly progress report and a template for the budget report (Subtask 1.4).

Deliverable(s): (A) Draft Contract Management Plan (B) Final Contract Management Plan

Subtask 1.3: Monthly Reports

The COR and/or PO will submit a project request to the contractor for each specific project under this contract, including background information, research questions to be addressed, tasks, and a draft schedule of deliverables. Upon receipt of the request, the contractor may request a meeting with the COR and PO assigned to the project to determine the specific scope and proposed approach for each project. These meetings may take place via a video conferencing platform (e.g. Microsoft Teams, Zoom, Webex), email, conference call, or in conjunction with a weekly conference call (Subtask 1.4), and may occur as needed over the course of the project.

Each project (See Task 2) will require a project work plan and a proposed subject matter team of experts.

The contractor shall draft a project work plan for each project request, submit it to the COR and PO for review and approval within two (2) weeks of receipt, and host a meeting to discuss it. The project work plan shall detail the project's technical approach and schedule (see Task 2).

Specifically, the project work plan shall include a description of the technical approach; any anticipated challenges to completing the project and how the contractor will address them;

staffing and management responsibilities; and the allocation of project resources, including projected hours per staff member. The project work plan shall also include a timeline that identifies the start and completion dates, as well as other milestones, for each deliverable specified in the plan. The project work plan shall be based on the project request from the COR and PO, as well as discussions and other decisions made at the project work plan meeting. The COR and PO may modify the project work plan, including completion dates, after consultation with the contractor, if needed. All approved project requests must be completed by the end of the contract's period of performance or discontinued by mutual agreement of the contractor, the COR, and the PO.

Draft project work plans shall be submitted to the COR and PO for review and approval no later than two (2) weeks after the project work plan development meeting or otherwise agreed upon by the COR and PO. Upon incorporating comments from the COR and PO and final approval by the COR and PO, a final work plan shall be submitted to the COR and PO no later than one (2) weeks after final approval.

Deliverable(s): (A) Draft Contract Management Plan, (B) Final Project Work Plan(s)

Subtask 1.4: Standing Project Management Conference Calls

Standing conference calls between the contractor, the COR, and the PO shall be scheduled within one week of the EDOC. The contractor, the COR, and the PO will decide on the periodicity of project management calls, which may change during the contract period to reflect HHS OWH's evolving needs, but should be assumed to occur weekly. During each call, the contractor shall be prepared to discuss any issues that have arisen since the last monthly progress report (Subtask 1.5) and to provide key updates on current projects, including any changes to the estimated budget or costs. The contractor shall develop an agenda prior to the call and, within one week, distribute the meeting minutes, including key points and decisions, to the COR and PO.

Deliverable(s): (A) Standing Call Agendas (B) Standing Call Action Items Summaries

Subtask 1.5: Monthly Progress and Budget Reports

The contractor shall submit monthly progress reports (not to exceed four (4) pages, excluding tables or charts) outlining all work accomplished during the previous month. At a minimum, such reports should cover the following items:

• Discussion of the progress in accomplishing the tasks specified in this Contract.

• Difficulties encountered and remedial action(s) taken.

• Activities anticipated during the upcoming reporting period.

• Personnel and other management changes.

Monthly progress reports are due within the first week of each month following the Kick-Off Meeting (Subtask 1.1), or as otherwise agreed upon by the COR and the contractor and shall be sent by the Principal Investigator directly to the COR via email. Monthly progress reports should specify the use of funds by project, including staff hours for each project and for overall administration of the contract.

Deliverable(s): (A) Draft and Final Budget Tool (B) Monthly Progress and Budget Reports

TASK 2: INTERAGENCY COORDINATING COMMITTEE ON THE PROMOTION OF

OPTIMAL BIRTH OUTCOMES: THE OFFICE ON WOMEN’S HEALTH MATERNAL

HEALTH PORTFOLIO

Subtask 2.1: Data Collection Tool

The contractor shall develop and produce an annual progress report to Congress detailing the HHS activities and outcomes. This report will be prepared for the Office of the Assistant Secretary for Health (OASH), Office on Women's Health (OWH), in concert with other agencies within the U.S. Department of Health and Human Services (HHS) that include activities and outcomes of HHS programs addressing birth outcomes. The report should describe trends in birth outcomes, the key drivers of maternal-infant health outcomes, and how HHS addresses each. The report will consist of annual updates on HHS maternal health activities. To support report development, the contractor will frequently liaise with OWH and other federal agencies to assess their activities in support of report development. The contractor will develop a report completion timeline that includes a specified, agreed-upon timeframe to meet the required Report to Congress deadlines.

Deliverable(s): Develop the Annual Maternal Health Report to Congress as specified in the work plan.

Subtask 2.2: Maintain and Enhance the HHS Interagency Maternal Infant Health Outcome Dashboard (the Dashboard).

The contractor shall continue to maintain and make necessary enhancements to the HHS Interagency Maternal Infant Health Outcome Dashboard (the Dashboard). The Dashboard will serve as the maternal-infant measure data-collection tool and an aggregated outcomes dashboard for visualization, tracking, and monitoring progress in improving maternal health outcomes. Data sources will be acquired from state and federal agencies and other non-federal data sources, reporting maternal health outcome measures, analyzing such measures, and advancing an HHS-wide maternal health data strategy.

The contractor will work with HHS to continuously define objectives to understand the needs and requirements of Dashboard’s various agency stakeholders. The contractor will conduct thorough discussions and gather insights from key HHS stakeholders, including agency leadership, department heads, IT experts, analysts, and end users, to identify metrics aligned with the defined objectives. These metrics should be measurable, and performance or progress toward the HHS maternal-infant health strategy and goals should be clearly understood. The contractor shall develop the Dashboard to promote transparency in birth outcome data across HHS agencies by synthesizing large databases and modernizing and improving maternal-infant health data sources and databases, making them centralized and interoperable for data collection and statistical analysis to understand the root causes of maternal-infant death and harm. The Dashboard’s development will include the ability to populate HHS- and public-facing visualizations of specified birth outcome data.

The contractor shall populate the Dashboard solution using metrics derived from federal and state data sources, as well as data provided and approved by HHS agencies. An essential component of this work will be identifying gaps and opportunities in the measurement of birth outcomes. The contractor will utilize HHS-determined analytic solutions such as Tableau, Power

BI, or Smartsheet, and focus on presenting data in a clear, interactive, and engaging way, allowing users, as indicated, to drill down into data, filter by different criteria, and explore trends within specific data points. The Dashboard will include a user guide containing additional details or explanations to help users understand the data presented, including insights and recommendations.

The Dashboard is designed to enable the use of information to enhance HHS measure visualization, perform analyses, and address research questions, such as gaining a better understanding of the root causes of severe maternal morbidity and mortality and identifying opportunities to improve birth outcomes in the U.S.

The contractor shall use the dashboard to perform analyses specified by the COR and/or PO to prepare reports conveying the findings of such studies. They shall work with specified HHS team members to support the development and evaluation of HHS's web content, social media, and supporting technologies associated with the development and publication of the Dashboards.

Contractor personnel who work directly with the HHS Interagency Maternal-Infant Health Dashboard within the HHS workspace are subject to HSPD-12 PIV credentialing requirements and will consistently maintain HHS GFE-provided equipment, security clearance, badging, and training requirements to support contract deliverables. Contractor personnel may not begin work that requires access to the HHS dashboard workspace, information, or information systems until codified credentialing standards are met and HSPD-12 badges have been issued. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/OASH training, such as the Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award), before performing any work under this contract. Thereafter, the employees must complete HHS/OASH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All training provided must comply with HHS training policies. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days of contract award, annually thereafter, or upon request.

Deliverable(s): As specified in the work plan.

Subtask 2.3: Technical assistance with statistical analyses, interpreting, and summarizing birth outcome health data.

The contractor shall provide technical assistance and build work products, including various quantitative and qualitative analyses and associated written documents. Analytic and technical assistance support is defined as including, but not necessarily limited to: analytic and technical assistance support in the form of; program evaluation design and implementation; quantitative and qualitative research and analyses; statistical analyses of data sets including survey analyses;

conducting, interpreting and summarizing statistical analyses (including microsimulation models); conduct analyses related to emerging or priority policy issues; describe analysis results in policy papers and/or graphical displays through data visualization or other techniques;

estimate costs and benefits of policy proposals under consideration by the Department or Congress; and other technical assistance related to HHS priorities on maternal health. In addition to the measure data, information can be collected through literature reviews, environmental scans, and discussions with government officials and subject-matter experts. Work products include policy papers, case studies, issue briefs, and briefings for OWH and other HHS staff and leadership.

The contractor shall support research, drafting, and editing, and provide technical writing and final preparation of White Papers, reports, and publications associated with other HHS OWH programs such as the HHS Maternal Morbidity and Mortality Data and Analysis Initiative, including any additional quantitative and qualitative analyses and supporting associated written documents.

As determined by the COR and/or PO, the contractor shall conduct research, drafting, and editing, provide technical assistance to support OWH-determined research, and provide technical writing and final preparation of White Papers, reports, and publications. Annual technical assistance support includes conducting up to four (4) TBD statistical analyses and developing associated white papers, briefings, reports/manuscripts related to HHS and OWH priority topics.

Communications related to the products may include reports, press releases, blogs, social media posts, and other such materials used to communicate OWH priority topics in women’s health.

Deliverable(s): As specified in the work plan, the contractor will conduct up to four (4) TBD statistical analyses and develop associated reports/manuscripts related to HHS and OWH priority topics.

The contractor shall manage all logistics related to working with the experts/analysts/contributors to all work products. The contractor may subcontract to other experts or firms to ensure the required expertise is available if it does not have it. The contractor should be willing to work with subcontractors identified by OWH as needed. For all requests for analytical and technical assistance, the contractor shall work with the COR and PO to determine the most appropriate staff, experts, analysts, and/or contributors for all projects.

3. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

REQUIREMENTS

***to be included when applicable per March 3, 2021 HHS Policy for Information Technology

Procurements - Security And Privacy Language (https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language#appendix-b). The program office should consult with their CISO and Privacy Official to complete the Appendix D Information Security & Privacy Certification Checklist with acquisition specific details to be included in this section.

This section provides the baseline IT Security language. Highlighted sections should be completed or confirmed accurate, in accordance with your specific requirement. The language below is current with HHS policy as of 2/16/24.

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/OASH policies and the level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/OASH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language#appendix-b https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language#appendix-b http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, HHS/OASH SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system, is as follows:

Confidentiality: [X] Low [ ] Moderate [ ] High Integrity: [X] Low [ ] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Impact Level: [X] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/OASH, regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/OASH Information Security Program to ensure the confidentiality, integrity, and availability of government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/OASH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OASH privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determine if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency in conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed of as part of the contract. The PTA will determine whether a full Privacy Impact Assessment (PIA) is required.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency in completing a PIA for the system or information within 5 business days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduce new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented, the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately.

ii. Disclosed to authorized personnel on a Need-To-Know basis.

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations , applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations , if handled by an internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution validated to the current FIPS 140 validation certificates from the NIST

CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any person except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and OASH policies. Unauthorized disclosure of information will be subject to the HHS/OASH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6), available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify the use of prohibited ICT products and/or services during contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured to use Hypertext Transfer Protocol Secure (HTTPS) with the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to use HTTPS at all times, reducing the number of insecure redirects and protecting against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required but highly recommended.

Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use the provided templates, policies, forms, and other agency documents as specified in the contract to comply with contract deliverables as appropriate.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with an encryption solution that is validated with the current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e., desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and HHS/OASH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificates from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 5 business days of contract award.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the HHS/OASH non-disclosure agreement. The contractor shall request a copy of the HHS/OASH non-disclosure agreement template from the COR, as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/OASH Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete HHS/OASH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All training provided must comply with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must http://csrc.nist.gov/publications/ complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior and HHS Rules of Behavior for Privileged Users.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HHS/OASH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be submitted as a separate deliverable to the CO and/or COR per the timelines defined above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/OASH IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with an encryption solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting

Officer or representative, the Contractor must send OASH approved notifications to affected individuals within 3 calendar days as instructed by the Contracting Officer or designated representative.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HHS/OASH Incident Response Team (IRT), ISSO, COR, CO, HHS/OASH SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OASH OS and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include, at a minimum, company and point-of-contact information, impact classifications/threat vectors, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach.

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of

Personally Identifiable Information, and HHS/OASH and OS privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract: Public Trust

6. Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

7. Roster The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number, and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within 5 business days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within 3 business days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation as instructed by the COR. to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within 5 business days before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or OASH policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the HHS/OASH Contractor Employee Separation Checklist (COR will provide a copy of the checklist upon request) when an employee terminates work under this contract within 5 business…