RFP 75D30122R72236.doc

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

PAGE OF

2. CONTRACT NO.

3. SOLICITATION NO.

75D301-22-R-72236

4. TYPE OF SOLICITATION

X

NEGOTIATED (RFP)

5. DATE ISSUED

04/12/2022

6. REQUISITION/PURCHASE NO.

00HCUBBB-2022-64672

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Approved as to Form and Legality: _____________________________

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder.”

SOLICITATION

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in 2900 Woodcock Blvd, Atlanta, GA 30341 until 2:00pm local time 05/12/2022 CAUTION -- LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Liubov Kriel

B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER: EXT:

(770) 488-2856

C. E-MAIL ADDRESS

vyh1@cdc.gov

11. TABLE OF CONTENTS

(x)

DESCRIPTION

(x)

DESCRIPTION

X

REPRESENTATIONS, CERTIFICATIONS, AND

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52-232-8)

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CODE

FACILITY

16. NAME AND ADDRESS OF PERSON AUTHORIZED TO SIGN OFFER

15B. TELEPHONE NO.

AREA CODE NUMBER EXT.

15C. CHECK IF REMITTANCE ADDRESS

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

21. ACCOUNTING AND APPROPRIATION

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

ITEM

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta, GA 30341-4004

Centers for Disease Control and Prevention (FMO)

PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT -- Award will be made on this form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33 (REV. 9-97)

PREVIOUS EDITION IS UNUSABLE

Prescribed by GSA

FAR (48 CFR) 53.214©

Section B - Supplies Or Services And Prices/Costs

Base Period Items (9 months):

· T&M/LH CLIN

· CLIN 0001 is a Severable Line Item Performance Period: 06/29/2022* – 03/28/2023

* Anticipated start date is 06/29/2022 if a transition period is needed; if no transition period is needed the anticipated start date will be 09/29/2022.

Total Base Period Value: $________(NTE) Option Period 1 Items (12 months):

· T&M/LH CLIN

· CLIN 1001 is a Severable Line Item Performance Period: 03/29/2023 – 3/28/2024

Total Option Period 1 Value: $________(NTE) Option Period 2 Items (12 months):

· T&M/LH CLIN

· CLIN 2001 is a Severable Line Item Performance Period: 03/29/2024 – 3/28/2025

Total Option Period 2 Value: $________(NTE) Option Period 3 Items (12 months):

· T&M/LH CLIN

· CLIN 3001 is a Severable Line Item Performance Period: 03/29/2025 – 3/28/2026

Total Option Period 3 Value: $________(NTE) Option Period 4 Items (12 months):

· T&M/LH CLIN

· CLIN 4001 is a Severable Line Item Performance Period: 03/29/2026 – 3/28/2027

Total Option Period 4 Value: $________(NTE) Optional Line Item:

· Firm-Fixed Price CLIN

· CLIN 4002 is a Non-severable Line Item Performance Period: 12/29/2026 – 3/28/2027

Total Optional Line Item 4002 Value: $___________

CONTRACT TOTAL

(Base Period, 4 Options &

1 Optional Line Item):

$__________(NTE)

This is a Time-and-materials/ Labor-hour solicitation.

Estimated hours & hourly rates are as follows:

Base Period Items: Performance Period: 06/29/2022 – 03/28/2023

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Option Period 1 Items: Performance Period: 03/29/2023 – 3/28/2024

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Option Period 2 Items: Performance Period: 03/29/2024 – 3/28/2025

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Option Period 3 Items: Performance Period: 03/29/2025 – 3/28/2026

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Option Period 4 Items: Performance Period: 03/29/2026 – 3/28/2027

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Optional Item 4002: Performance Period: 12/29/2026 – 3/28/2027

* The proposal shall be priced by CLIN and shall contain vendor’s proposed labor categories, labor hours by category, and proposed materials and equipment.

Section C - Description/Specification/Work Statement

TITLE:

Biologic Specimen Repository and Inventory Management for the National Center on Birth Defects and Developmental Disabilities (NCBDDD) Projects

1.

Overview/Background:

Overview

The National Center on Birth Defects and Developmental Disabilities (NCBDDD) has a requirement for immediate and on-going storage and inventory management of biologic specimens collected under several projects including the National Birth Defects Prevention Study (NBDPS), and the Division of Blood Disorders’ (DBD) projects for the reduction and prevention of complications due to blood disorders.

Background:

It is estimated that about three percent of babies in the United States (or about 120,000 babies each year) are born with a birth defect. More than 5,000 of these babies die in their first year of life – making birth defects a leading cause of infant mortality in the United States. Birth defects are also a major cause of infant morbidity and a leading cause of potential years of life lost. Many birth defects result in life-long disabilities. A primary mission of the Division of Birth Defects and Infant Disorders (DBDID) is to decrease the morbidity and mortality associated with birth defects, stillbirth, and other infant and childhood diseases. A mission of the Division of Blood Disorders (DBD) is to reduce and prevent the complications of bleeding disorders and blood-borne infections, complications of the use of blood products such as inhibitor development, and conduct surveillance for blood borne pathogens and other conditions of concern to persons with non-malignant blood disorders through routine collection and testing of serum or plasma specimens. Approximately 697,518 specimens are currently stored at the CDC contracted storage facility in Rockville, Maryland (MD).

The National Birth Defects Prevention Study (NBDPS)

The NBDPS is a population-based, multi-site, case-control study of genetic and environmental risk factors for major birth defects. Data on exposures during pregnancy were collected using a computer-assisted telephone interview at each of the study sites. Data from ten study sites were included. Buccal cells were self-collected from parents and the index child using cytobrushes mailed to each family. DNA was extracted from the buccal cells, human-specific DNA was quantified, and quality was assessed at the CDC Central Lab. As of February 2022, the NBDPS has collected DNA specimens from approximately 69,500 mothers, fathers, and infants since 1998. DNA specimens were subaliquotted into 2.0ml and 0.5ml cryovials at the CDC Central Lab and submitted to the biorepository for storage at -80°C or in the vapor phase of liquid nitrogen. Each aliquot contains a bar-coded label with its 9-digit numeric study ID, 8-digit numeric specimen ID, and an 8-digit alpha-numeric CDC unique ID. As of February 2022, the NBDPS has approximately 539,142 vials in storage.

Investigators with research projects that have been approved by the NBDPS Data Sharing Committee make requests for aliquots of DNA specimens from the biorepository through the collection custodian. Specimens extracted before May 1, 2008 were subaliquotted and the specimen aliquots are available for shipment to investigators. Specimens extracted in the CDC Central Lab on or after May 1, 2008 are subaliquotted “on demand”. Two aliquots per specimen were initially submitted to the biorepository until an investigator requests an aliquot of the specimen. At that time, the collection custodian will request that one of the two specimen aliquots be shipped to the CDC Central Lab on dry ice where it will be subaliquotted into five 0.5ml cryovials and returned to the biorepository. At that time, the specimen aliquots will be available for retrieval. Aliquots of DNA specimens are retrieved from the NBDPS collection and are shipped overnight on dry ice to the requesting investigator. Several DNA collections are maintained for the NBDPS including the main NBDPS collection of specimens available to study investigators as well as NBDPS inconsistent, failed, quality control (QC), and New Jersey local collections that are not available to study investigators. A Utah local collection will be added during the contract Base Year and Option Year 1. Records of NBDPS shipped and destroyed specimen aliquots are also maintained in the biorepository inventory management system. The investigators will continue to request specimens for approved projects.

In the later option years, there may be the potential for collection of DNA specimens from sources other than cytobrushes. Some possibilities include saliva collection and use of residual newborn blood spots. Storage procedure modifications are not expected for DNA collected from saliva. However, modifications to storage for newborn blood spot cards include stacking cards between glassene papers and storing them in low-gas permeable bags that include a desiccant pack and a humidity indicator card with a spot for 30% humidity that indicates when the desiccant pack needs to be replaced. The bags would be stored either in a -20°C or -80°C freezer. Estimated quantities and protocol are unknown at this time. Prior to collection and storage of these saliva and/or blood spot specimens, a specimen protocol will be developed and a request for contract modification will be initiated.

In another project prior to the NBDPS, DBDID collected specimens from participants in the Birth Defects Risk Factor Study (BDRFS). The biorepository currently stores 4,056 BDRFS specimens in the vapor phase of liquid Nitrogen2 (LN2).

Division of Blood Disorders (DBD)

In the 1990s in the wake of the epidemic of HIV infection among persons who received contaminated blood products, the Division of Blood Disorders received a mandate from Congress to reduce and prevent the complications of bleeding disorders. Initially targeted towards hemophilia, DBD programs later expanded to include thalassemia, women with bleeding disorders, Diamond Blackfan Anemia, iron overload and sickle cell disease. Among the complications addressed by these programs are those of blood-borne infections and other complications of the use of blood products such as inhibitor development. The DBD conducts surveillance for blood borne pathogens and other conditions of concern to persons with non-malignant blood disorders through routine collection and testing of serum or plasma specimens for HIV and viral hepatitis from patients attending blood disorders clinics across the United States and its territories. A portion of each specimen is retained for possible future testing as new transmissible threats to the blood supply are discovered. Projects previously conducted include the Universal Data Collection (UDC) which collected specimens on persons with clotting factor deficiencies, and the National Data Collection (NDC) which collected specimens on persons with thalassemia. Currently the Community Counts! project, successor to UDC, collects serum and plasma from persons with bleeding disorders. Both the conditions being tested for as well as the populations monitored are expected to be expanded in the future; this may necessitate the collection of other specimens which may require storage conditions different from those of the currently collected specimens.

At this time, Community Counts! collects 5-10mL of blood from each participant at roughly annual intervals. The participating clinics centrifuge the blood to obtain serum or plasma and ship the specimens to the CDC serum bank in Atlanta, GA. The serum bank aliquots the specimens by 0.5mL and distributes a routine number of aliquots to the DBD labs for routine testing and the remainder is stored for future use at -20C or -80C. Aliquots are distributed from the serum bank to the DBD labs or elsewhere at the request of the CDC Principal Investigator or other authorized CDC personnel. Each aliquot bears a bar coded label with a unique 10-digit specimen number assigned by the serum bank. Currently, there are 154,320 aliquots in long-term storage. The Community Counts! project is expected to continue for the foreseeable future.

II.

Objective:

The overall NCBDDD objective is to reduce the morbidity and mortality of birth defects and blood disorders. We require ongoing contractor support services to help accomplish this objective. The objective of this contract is to (1) transfer to and safely store existing biologic specimens at the contractor’s facility, (2) ship selected specimens to a CDC laboratory for subaliquotting and receive and store newly subaliquotted specimens from CDC, (3) ship selected specimens to collaborators for data analysis, (4) routinely perform activities such as vial re-labeling, aliquot destruction, or inventory audits, and (5) maintain an accurate inventory system of all biologic specimens.

III.

Scope of Work:

To provide NCBDDD with state-of-the-art specimen storage that includes sufficient storage capacity for future growth and a high-quality inventory management system that allows timely entry and retrieval of specimens and maintains accurate historical records.

IV.

Technical Requirements Currently, the biologic specimens are stored and maintained in a CDC contracted facility in Rockville, MD. The continuity of the services without interruption or harm to the specimens is critical to the success of the program. Therefore, the contractor shall be required to provide and execute an approved transition plan that will provide a smooth transition (in the beginning of the contract and at the end of 4.5 years of the contract) to ensure continuous service and storage of biologic specimens.

The contractor shall review and analyze existing protocols, utilize existing database ID numbers and variables, Office of Management and Budget (OMB) clearance materials, Institution Review Board (IRB) and Confidentiality requirements and secure any additional IRB, OMB or other approvals necessary to continue work under the project.

The Biologic Specimen Repository shall include the following technical requirements and specifications.

Task 1. The Facility and equipment shall have the following specifications:

1.1 -80°C freezers and liquid Nitrogen2 (LN2) containers for specimen aliquots in 0.5 and 2.0ml cryovials. As of February 2022, 172,702 specimen aliquots are in cryovials that cannot be stored in LN2 and must be stored in -80°C freezers. The remainder and all new specimens received shall be stored in the vapor phase of LN2.

1.2. The contractor shall have space for the Biologic Specimen Repository in alignment with the following:

a. Current number of specimen aliquots as of February 2022 is 697,518 comprised of approximately 543,198 for NBDPS/BDRFS and 154,320 for DBD.

b. Ability to obtain -80°C freezers, facility space, and labor to receive and store the additional aliquots received annually.

c. Estimated number of specimen aliquots received from the CDC Central Lab per year: 3,000 – 5,000 specimens returned after subaliquotting “on demand” for all years except the Base Year and Option Year 1. During the base year and option year 1, 8,500 – 19,500 specimens will be received from the CDC Central Lab, with ~19,000 from the new Utah local collection. Please see Attachment 1 with the estimated quantities.

d. Estimated number of specimen aliquots retrieved and shipped to study sites, CDC, and NIH per year: 10,000 for all years except the Base Year. During the Base Year, 5,000 will be retrieved and shipped. Please see Attachment 1 with the estimated quantities.

1.3. Utilize handheld scanners and printers for bar-coded labels; ability to use software to generate barcodes with the same format and variables that are currently included on labels (8-digit barcoded alphanumeric ID, 9-digit human readable numeric ID, 8-digit human readable numeric ID with additional human readable alphanumeric notations that vary by label); dry ice, freezer boxes, and racks for specimen aliquot receipt, storage, retrieval, and shipment.

1.4.

Facility that meets the minimum size and ventilation requirements for heat production of the equipment.

1.5.

Facility shall have smoke detectors, fire suppression systems, and access control.

1.6.

A minimum of 1 empty backup -80C freezer and 1 empty backup LN2 freezer maintained at temperature in the event of power or equipment failure.

1.7.

Have a Standard Operating Procedure (SOP) for transfer of specimens to alternative freezer space in the event of a widespread power or equipment failure.

1.8.

A minimum of 1 empty freezer maintained at temperature as temporary storage to accommodate large specimen shipments received at short notice.

1.9.

Emergency back-up diesel and/or gas generators.

1.10.

A 24/7/365 alarm monitoring with on-call manpower for after hour alarms.

1.11.

24/7/365 security system and process that limits access to specimen storage area and equipment to authorized staff and records the identify and time when staff access the specimens.

1.12.

Equipment validated by contractor staff or installer prior to use and monitored 24/7/365.

1.13.

Calibrated freezers to ensure operation within controlled parameters.

1.14.

Perform maintenance on equipment to keep it operating in accordance with the manufacturer’s recommendations.

1.15.

Ability to maintain a tracking log of all freezer-related information such as location and relocation, validation and calibration, preventive maintenance and repair, specimen integrity, freeze/thaw events, and storage temperatures.

1.16.

Staff to oversee specimen storage and provide training of personnel on equipment SOP compliance.

Task 2. Inventory management

2.1.

The contractor shall oversee specimen management, inventory, transfers, and provide training to in specimen SOP compliance.

2.2.

The contractor shall ensure that off-site redundant hard-drive data storage and hard copies are archived in fire-retardant storage.

2.3.

The contractor shall employ a system to track all specimen movements.

2.4.

Specimen receipt, storage, retrieval, destruction, and shipment as indicated in Tasks to be Performed section.

Task 3. Specimens - transfer at start-up:

3.1.1.

As necessary, the contractor under this contractor shall coordinate with current contractor (Fisher BioServices) on the transfer and receipt of all specimen aliquots from the current Rockville, MD location to the contractor’s facility in -80C or LN2 vapor phase temperature storage. Capture of existing data fields in all current NBDPS and DBD collections into new contractor’s inventory management system with 100% cross checking of vial labels with manifest. The new contractor shall set up a secure data transfer system between CDC and new contractor (e.g., secure file transfer protocol [SFTP]).

3.1.2.

The contractor shall provide detailed transfer summary after each specimen shipment that includes temperature monitoring and specimen receipt report.

Task 3.2. Specimens - receipt:

3.2.1.

Import data from manifests into contractor specimen inventory management system and track location from which specimens were received, receipt date, carrier, and condition upon receipt.

3.2.2.

100% scan cross check of vial labels with manifest and with freezer location in inventory management system.

3.2.3.

Storage of aliquots from one specimen in a minimum of two freezer units. There are currently 64,537 specimens with at least 2 aliquots needing separate storage.

3.2.4.

Maintenance of specimens at temperature during receipt process.

3.2.5.

Notify Contracting Officer Representative (COR) within 24 hours of discovering any problems or issues and include proposed resolution.

3.2.6.

Time between specimen receipt and inventory entry shall not exceed one week with a specimen receipt report and discrepancy report (if needed) provided to the COR via a secure data transfer system. Following resolution of each discrepancy, a final specimen receipt report provided to the COR within one week of resolving the discrepancy.

Task 3.3. Specimen - retrieval:

3.3.1.

Import data for specimen retrieval from Excel spreadsheets into inventory management system to identify specimen locations. The contractor shall retrieve a minimum of 2,000 specimens in one week if retrieval order is not specified. If retrieval order is specified, to the contractor shall retrieve a minimum of 1,000 specimens in one week.

3.3.2.

Maintenance of specimens at temperature during retrieval process.

3.3.3.

Accurate retrieval process (100% validation of requested specimens).

3.3.4.

Notify the COR within 24 hours of discovering any problems or issues and include proposed resolution.

Task 3.4. Specimen - shipment:

3.4.1.

Maintain shipment history including shipment date, location shipped to, and carrier.

3.4.2.

Maintain compliance with Department of Transportation regulations.

3.4.3.

Ship in cryogenic shipping containers with dry ice sufficient for 72 hours.

3.4.4.

Provide electronic shipment notifications on the secure data transfer site with the carrier tracking numbers the day of the shipment.

3.4.5.

Provide hard copies and electronic copies of shipping manifests that include for each aliquot: collection name, study site, study ID, specimen ID, CDC unique ID, family member, aliquot number, aliquot type, and vial type. Electronic shipping manifests shall be posted to the secure data transfer site the day of the shipment.

3.4.6.

Ship specimens via priority overnight.

Task 3.5. Specimen – destruction and database:

3.5.1.

Destroy specimens by incineration within 2 weeks of receiving specimen list on Excel spreadsheet from CDC. The contractor shall estimate for a maximum of 2-3 requests for destruction per year involving less than 1,000 specimens per year total. Maintain records of specimen aliquots destroyed and provide certificate of destruction within 24 hours of sample incineration.

3.5.2.

Create or modify specimen inventory fields or tables (e.g., renaming a field from ‘available’ to ‘in inventory’ or separating into different tables records of specimens currently in the inventory from specimens that have been removed from the inventory).

3.5.3.

Re-label specimens using cryogenic labels appropriate for freezer storage temperatures and data variables currently on labels. Current labels include: 8-digit barcoded alphanumeric ID, 9-digit human readable numeric ID, 8-digit human readable numeric ID with additional human readable alphanumeric notations that vary by label.

3.5.4. Complete physical specimen and data record audits.

Task 4. Meetings, reports, and data disposition:

4.1.1.

The contractor shall furnish a monthly progress report, monthly specimen inventory report, and quarterly equipment report. Refer to the specifications in the Deliverables and Reporting Requirements section below.

4.1.2.

Post award meetings: CDC personnel will visit the contractor’s storage facility a minimum of once per year to meet with contractor laboratory personnel and inspect the facilities.

4.1.3.

Data disposition: The specimen inventory report and monthly reports shall be maintained by the contractor and retained for a period of one year after the end of the contract. After this time, the contractor shall destroy the inventory report and monthly reports and other documents by shredding and incineration. The contractor is not permitted to disclose the contents of the inventory and monthly reports to outside entities without prior written approval from the COR.

V.

Deliverables and Reporting Requirements:

Reporting Requirement #1- The Monthly Progress Report shall contain the following information:

Reports must be generated from the first calendar day of each month to the last calendar day of each month. (e.g., January 1-31, etc.).

a. Brief summary of accomplishments during the reporting period and significant events.

b. Deliverables submitted or progress on deliverable.

c. Any current or anticipated problems and possible solutions.

d. Number of specimens shipped and received each month.

e. Specimens received (project name, received from, date received, vial count, problems, recommendations).

f. Specimens shipped (project name, shipped to, date shipped, vial count, problems, recommendations).

g. Specimens destroyed (project name, date destroyed, date certification paperwork provided to CDC, method of destruction, vial count, problems, recommendations).

h. Specimens re-labeled (project name, date re-labeled, vial count, problems, recommendations).

i. Adverse freezer events (project name, date of event, date notified CDC, problems, recommendations).

j. Key staff (project manager, lab manager) anticipated leave and point-of-contact while on leave.

k. Staffing changes and point-of-contact during transition.

Reporting Requirement #2 – Month-end specimen inventory:

Each month, provide a month end snapshot of specimen inventory by location by NCBDDD project, and access to real-time web-based inventory. Monthly snapshot shall include total number of specimen aliquots stored and for each aliquot: collection name, study site, study ID, specimen ID, CDC unique ID, family member, aliquot number, aliquot type, date received, quantity, unit of measure, vial type, location (e.g., rack, box, row), and availability for requests. Records for main NBDPS collection specimens that are available to study investigators shall be maintained separately from other collections (inconsistent, failed, QC, New Jersey local, shipped, and destroyed). Records for shipped specimen aliquots shall include additional fields for destination, created date, and shipped date. Records for destroyed specimen aliquots shall include date destroyed and reason.

Reporting Requirement #3 – Quarterly equipment report:

Each quarter, provide a quarter end equipment report that includes current location, validation and calibration dates, preventive maintenance and repairs, temperature fluctuations, freeze/thaw events, and overall conditions of each piece of equipment.

MS Word or Excel format

Microsoft Excel format

VI.

Government Furnished Information:

CDC will provide the following items needed for off-site delivery of services.

1. Access to the various NBDPS and DBD databases, data replication, CDC Secure Access Management Service, CDC specific software, and other NBDPS and DBD project specific documents and tools necessary to accomplish contract requirements.

2. List or examples of appropriate freezer labels, SATO printer, cytobrushes, and other lab supplies in order for the contractor to purchase for their use on this contract.

VII.

Place of Performance:

The required tasks shall be performed at the contractor’s facility.

VII.

Special Clearances:

1. Design of any data collection or evaluation measurement tools or activities should take into account the requirements for exemptions to OMB public survey clearance procedures as specified under PHS Generic Approval to Conduct Customer Satisfaction Surveys under EO 12862. For any methods requiring OMB or IRB clearance, the contractor shall prepare the appropriate packages for clearance.

2. Data produced hereunder shall become and remain the property of CDC. No release or publication of information under this contract will be authorized without prior written consent of the CDC Contracting Officer.

Privacy Act

Appropriate security controls and Rules of Behavior should be incorporated to protect the confidentiality of information, proprietary, sensitive, and Personally Identifiable Information (PII) the Contractor may come in contact with during the performance of this contract.

Capital Planning and Investment Control/Project Management

The Federal Government mandates the prudent management of IT investments. Capital Planning and Investment Control (CPIC) is a continuous and integrated process for managing the risks and returns of information technology (IT) investments. The CPIC process fully integrates with the CDC’s overall budget, finance, acquisition, strategic planning, enterprise architecture, security, and other relevant processes. CPIC also aligns with DHHS Enterprise Performance Life Cycle (EPLC) framework and is used for all IT related decisions.

The contractor will follow the EPLC framework which will provide a standard structure for planning, managing, and overseeing IT projects over their entire life cycle. The framework consists of ten life cycle phases. Within each phase, activities, responsibilities, reviews and deliverables are defined. Templates for the deliverables are available to the contractor after award. Exit criteria are established for each phase and Stage Gate reviews are conducted through CDC’s IT Governance process to ensure that the project’s management quality, soundness, and technical feasibility remain adequate and the project is ready to move forward to the next phase. All IT projects in support of this task must adhere to the EPLC requirements and pass each State Gate as appropriate. More information about EPLC can be found at http://www.hhs.gov/ocio/eplc/.

Mobile Application Development

All mobile applications must comply with CDC-related technical and security standards, processes and procedures as stated in the IT Security section of the RFTOP. In addition, the following considerations should be addressed in the proposal:

· The target platform(s) for the mobile application (e.g., iPhone, iPad, Android, Blackberry)

· Approach to 508 compatibility for the platform of choice

· If the mobile application will be made available in a related platform’s online store (e.g., iTunes, Android Market), the process for making it available in a desired store will be managed by and through CDC, resulting in a CDC branded mobile application. The contractor will also be responsible for ensuring the mobile application complies with all standards and specifications for the desired store.

Records Retention All data created during the course of this contract must be retained, stored and disposed of in accordance with the appropriate CDC Records Control Schedule.

Data Rights

Pursuant to FAR 52.227-14(d)(2), this contract expressly provides additionally as follows: The government has unlimited rights to all documents/material or other products first produced under this contract. All documents, materials or other products, to include the source codes of any software, first produced under this contract shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government. These documents and materials may not be used or sold by the contractor without prior written permission from the Contracting Officer. All materials supplied to the government shall be the sole property of the government and may not be used for any other purpose. This right does not abrogate any other government rights.

Data Collection

The contractor should collect or create only that information or data necessary for the proper performance of CDC functions and which has practical utility. Limit the collection or creation of information which identifies individuals to that which is legally required, authorized, and necessary for the proper performance of CDC functions. Data collections should only include the minimum information reasonably necessary to conduct public health activities. Unless there is a valid public health purpose, personally identifiable data (i.e., name, date of birth, phone number) should not be collected or maintained. Prior to implementing data collections, minimum data elements should be specified and consideration should be given to whether data collections of identifiable data will be necessary to achieve the intended public health goals.

To ensure the issues of confidentiality, proprietary use, and informed consent are correctly addressed, a data management plan must be initiated during the project planning phase as to how the contractor will collect, analyze, distribute, and make available the data collected.

Electronic and Information Technology Accessibility

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-aboard.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

504 Authoring Tools

602 Support Documentation

603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Requirements for Information Security and/or Physical Access Security Information Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed..

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality:

[X] Low [ ] Moderate [ ] High

Integrity:

Availability:

Overall Risk Level:

[X] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR and ISSO within 30 days of contract award.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover…