RFP_75F40125R00105.pdf

RFP_75F40125R00105

Access to Satellite Data for AI-Based Risk Management of Produce Safety in Farms

Table of Contents Background

Objectives

Scope

Tasks

1.1. Task 1 – Satellite Data Acquisition and Preparation

1.2. Task 2 – Leafy Green Farm Identification and Classification

1.4. Task 4 – ArcGIS Dashboard Development

1.5. Task 5 – Code and Documentation Delivery

Project Milestones

Deliverables

Period of Performance

Place of Performance

Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI) . 7

Security

Section 508 Compliance

Order Type

Government Points of Contact

Observance of Federal Holidays

Clauses

Basis of Award and Evaluation Criteria

Confidence Ratings

Proposal Instructions

Attachments

Statement of Work (SOW)

Background HFP is undertaking a comprehensive effort to understand and mitigate the root causes of foodborne illness outbreaks linked to leafy greens. A key component of this effort involves the development of spatial layers and geospatial tools that can be used to analyze environmental and agricultural conditions in leafy green production regions. Prior work by HFP has focused on mapping potential sources of contamination, including Concentrated Animal Feeding Operations (CAFOs), grazing lands, and irrigation infrastructure.

According to the United States Department of Agriculture’s National Agricultural Statistics Service (USDA-NASS), approximately 84% of the nation’s leafy green production takes place in California.

The Centers for Disease Control and Prevention (CDC) reports that leafy greens are among the most common sources of foodborne outbreaks and have been linked to some of the most severe and fatal incidents. In order to proactively address this public health concern, it is essential to accurately locate, characterize, and monitor leafy green farms throughout California.

This project will leverage high-resolution satellite imagery (e.g., PLANET) and publicly available datasets (e.g., USDA-NASS) in combination with artificial intelligence (AI) and machine learning methods to identify leafy green farms and detect CAFOs. CAFO detection will involve the automated analysis of spatial patterns, infrastructure features, and land use characteristics to delineate facility boundaries and classify each site based on operational status, proximity to water bodies, and other risk-relevant attributes. The project will result in a series of geospatial data layers and analytical tools that will aid in identifying risk factors and guiding outbreak investigations.

Objectives The objective of this project is to develop a high-resolution, spatially explicit dataset of leafy green farm locations across California and detect CAFOs in other states along with relevant crop and environmental data, to support outbreak investigation and pre-harvest risk assessment. Specifically, the vendor shall:

• Identify and map both current (most recent season) and historical (last five years) leafy green farm boundaries, classifying each by type of leafy green produce in California.

• Determine the number of harvest cycles per season for each identified leafy green crop, incorporating this information into the spatial dataset to enhance understanding of farm activity and potential risk exposure.

• Detect and classify CAFOs in selected high-priority states that pose elevated risk for foodborne outbreaks. For each CAFO, the vendor shall generate spatial boundaries and attribute data, including area, proximity to water bodies, operational status (active/inactive), and classification confidence metrics.

This information will be integrated into a user-friendly ArcGIS dashboard to support stakeholders involved in food safety, agriculture, and public health.

Scope The vendor shall employ remote sensing technologies, AI-based image classification, and data fusion techniques to analyze satellite imagery and other geospatial datasets. This analysis will result in the identification of leafy green farm boundaries, crop types, and associated contextual data (e.g., proximity to CAFOs, water canals, and surrounding land use). The work must be compatible with ArcGIS systems and support spatial analysis and visualization.

Additionally, the vendor shall identify the number of harvest cycles per season for each detected leafy green crop, using a combination of satellite data (e.g., phenological signatures), agricultural calendars, and relevant datasets. This information shall be attributed to each farm feature in the spatial dataset and documented in the metadata.

Furthermore, the vendor shall apply automated detection and classification methods to identify CAFOs across proposed states identified as high priority for leafy green outbreak investigation by the Human Foods Program (HFP). For each detected CAFO, the vendor shall provide spatial and attribute data including location, area, proximity to water bodies, operational status (active/inactive), and model performance metrics (e.g., precision, recall, or overall accuracy). The results must be delivered in ArcGIS-compatible formats and integrated into the broader outbreak investigation geospatial framework.

Tasks

1.1. Task 1 – Satellite Data Acquisition and Preparation

The vendor shall acquire and prepare high-resolution satellite imagery, including both current and historical (past five years) data, covering leafy green production regions in California. This task includes securing licenses, preprocessing imagery (e.g., atmospheric correction, tiling), and integrating public datasets such as USDA-NASS and CAFO locations. Milestone: Delivery of raw and preprocessed imagery inventory with metadata and data license documentation.

1.2. Task 2 – Leafy Green Farm Identification and Classification

Using AI and machine learning methods, the vendor shall identify and delineate leafy green farm boundaries in California. This includes classification by leafy green type (e.g., romaine, spinach, iceberg) and temporal analysis for seasonal and historical trends.

Milestone: Delivery of spatial datasets (shapefiles or feature classes) for current and five prior growing seasons with classification confidence values.

1.3. Task 3 – CAFO detection and Classification

The vendor shall apply advanced artificial intelligence (AI) and machine learning (ML) techniques to identify and delineate Concentrated Animal Feeding Operations (CAFOs) within the proposed states prioritized for leafy green outbreak investigations. This task includes the automated detection of CAFO boundaries using high-resolution satellite imagery and relevant spatial datasets, followed by detailed classification and attribute extraction. Each detected CAFO shall be characterized by its spatial area, proximity to nearby water bodies, and operational status (active or inactive), based on visual indicators such as animal presence, waste lagoons, or infrastructure activity. The vendor shall also report model performance metrics—such as accuracy, precision, and confidence scores—to assess the reliability of the classification process. All outputs must be delivered in ArcGIS-compatible formats and include fully attributed spatial layers with comprehensive metadata. A technical summary describing the classification methodology, data sources, and validation approach shall also be provided to support transparency and reproducibility of the results.

1.4. Task 4 – ArcGIS Dashboard Development

The vendor shall develop an interactive ArcGIS dashboard integrating all spatial data layers (leafy green farms, CAFOs, water canals, surrounding land uses). The dashboard must support zoom, search, and layer filtering functionality for end-user investigations. Milestone: Delivery of a fully functional, web-based ArcGIS dashboard with user documentation.

1.5. Task 5 – Code and Documentation Delivery

The vendor shall provide complete, well-documented source code used to generate all data products and tools. Code must be reproducible, with instructions for environment setup and execution.

Milestone: Delivery of codebase in structured folders with README files, environment requirements, and sample execution.

Project Milestones Task Number Work Milestone Projected Completion Date

4.1 Imagery acquisition and

public data integration

Month 1

4.2 Delivery of classified leafy

green farm layers

Month 3

4.3 Delivery of detected and

classified CAFOs

Month 4

4.4 Deployment of ArcGIS

dashboard

Month 5

4.5 Delivery of final codebase

and documentation

Month 6

All Tasks Final QA review and project closeout

Month 9

Deliverables The vendor shall provide the following deliverables:

1.6. Leafy Green Farm Spatial Data

• A geospatial dataset containing the locations and boundaries of leafy green farms in

California, for both the current growing season and the past five years.

• Attributes shall include farm area, estimated date(s) of production, number of crop/harvest cycles per season and geolocation data.

• Format: ArcGIS-compatible formats such as shapefiles (.shp), file geodatabases (.gdb), or feature classes.

1.7. Crop Classification by Type

• Classification of leafy green produce at each identified site, specifying crop type where detectable (e.g., romaine, spinach, iceberg lettuce, arugula, etc.).

• Metadata shall include classification confidence and methodology used.

1.8. CAFO Detection and Classification

• Detect and delineate Concentrated Animal Feeding Operations (CAFOs) in the selected high-priority states using high-resolution satellite imagery and AI/ML methods. The detection should capture a range of facility sizes and configurations relevant to food safety risk.

• Classify each detected CAFO by livestock type—dairy, beef, poultry, and swine—based on spatial features, infrastructure layout, and auxiliary data sources.

• Attribute each CAFO with key metadata, including facility area, geographic location, proximity to water bodies, operational status (active/inactive), and classification confidence metrics.

• Deliver results in ArcGIS-compatible formats (e.g., shapefiles or geodatabases) with comprehensive metadata, and provide a technical summary detailing detection methodology, classification approach, and model performance indicators.

1.9. ArcGIS Dashboard

• A dynamic, interactive dashboard built using ArcGIS Online or ArcGIS Enterprise.

• Dashboard shall include layers for:

o Leafy green farm locations and boundaries o Nearby CAFOs and grazing lands o Water canals and irrigation infrastructure o Surrounding land use categories (e.g., residential, industrial, agricultural)

• Functionality should include zoom, search, layer toggling, and basic analytical tools (e.g., buffer zone creation, spatial query).

1.10. Complete Written Code and Documentation Complete Written Code and Documentation

• All code used in satellite image analysis, AI modeling, classification, and dashboard development.

• Documentation shall include software dependencies, installation instructions, usage guidelines, and example outputs.

• Code must be reproducible and written in a commonly used language such as Python or R, with appropriate open-source geospatial libraries.

SOW

Deliverable Title

Description Quantity Frequency Required Format

Due Date Recipient

4.1 Imagery and

Data Package

Raw and preprocessed imagery, metadata, and license documentation package

Once Digital (GeoTIFF, CSV)

Month 1 Project Officer

4.2 Leafy Green

Farm Dataset

Shapefiles for current and historical farm boundaries and classifications

1 dataset set

Once ArcGIS format

Month 3 Technical Lead

4.3 CAFO

Detection and Classification

Shapefiles and reports identifying and classifying CAFOs (dairy, beef, poultry, swine) in selected states

1 dataset + report

Once ArcGIS format +

PDF

Month 4 Technical Lead

4.4 Interactive

ArcGIS Dashboard

Web-based dashboard with all spatial layers and filtering tools dashboa rd

Once Web application

Month 5 Project Officer

4.5 Source Code

and Documentation Package

All AI models, code scripts, and user documentation package

Once ZIP/PDF/ Markdown

Month 6 Technical Lead

Be advised that FDA does not accept documents which contain the use of macros. When submitting documents via email, DO NOT include .exe, .mso, or any other executable file types that could potentially trigger email security protections (i.e. email blocks, quarantine). Document submissions required throughout the award period(s) shall not have macro enabled functionality and any document delivered having that functionality will be deemed delinquent, if not corrected prior to the due date.

Be advised that FDA does not accept documents which contain the use of macros. When submitting documents via email, DO NOT include .exe, .mso, or any other executable file types that could potentially trigger email security protections (i.e. email blocks, quarantine). Document submissions required throughout the award period(s) shall not have macro enabled functionality and any document delivered having that functionality will be deemed delinquent, if not corrected prior to the due date.

Acceptance Criteria All deliverables will be reviewed by HFP for completeness, accuracy, and usability. Acceptance will be based on the following criteria:

• Accurate delineation and classification of leafy green farm boundaries

• Usability and interactivity of the ArcGIS dashboard

• Completeness and clarity of the codebase and documentation

• Compliance with ArcGIS compatibility and spatial data standards

Period of Performance The period of performance includes a 6-month base period.

Base Period: September 22, 2025 – March 22, 2026

Place of Performance All work shall be performed using the contractors’ own facilities.

Government-Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI) The Government will not furnish any property, materials, equipment, or information in support of this requirement. The contractor is expected to obtain and utilize all necessary resources—including hardware, software, data, and imagery—from commercial, open-source, or proprietary sources as part of their technical approach. This includes, but is not limited to, satellite imagery, computing infrastructure, geospatial datasets, and analytical tools required for the execution of the tasks described in this Statement of Work. The contractor shall ensure that all tools and data used are compliant with applicable licensing agreements and are suitable for integration into the final deliverables specified herein.

Security The contractor will not have access to any government-owned facilities, buildings, or computer systems during the performance of this contract. As a result, there are no special security clearance requirements, access badges, or escort provisions associated with this effort. All work shall be performed using the contractor’s own resources at their own facilities or through secure cloud-based platforms, as appropriate. The contractor is responsible for ensuring the confidentiality, integrity, and security of all data handled or generated during the performance of this contract, in accordance with applicable federal data protection standards and best practices. No government-issued identification, system access credentials, or physical access privileges will be granted or required.

Section 508 Compliance All electronic and information technology (EIT) deliverables produced under this contract must comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d), and conform to the Revised 508 Standards issued by the U.S. Access Board. This includes, but is not limited to, any ArcGIS dashboards, digital documents, datasets, user interfaces, and web-based content. The contractor shall ensure that all deliverables are accessible to individuals with disabilities, including those using screen readers or other assistive technologies.

At a minimum, the following criteria must be met:

• All web-based dashboards and applications must conform to WCAG 2.1 Level AA standards.

• Documents (e.g., reports, metadata, code documentation) must be provided in accessible formats (e.g., tagged PDFs or accessible HTML).

• Data visualizations must include alternative text or descriptive labels to ensure interpretability.

• Any user interfaces or forms must be navigable via keyboard and provide appropriate focus indicators.

The contractor shall perform accessibility testing and provide a written certification of Section 508 compliance with the final deliverables. The Government reserves the right to test all deliverables for compliance and request remediation of any non-conforming elements.

Order Type This will be a Firm Fixed Price Order (FFP).

Government Points of Contact Contracting Officers Representative (COR): Mehran Niazi (Mehran.Niazi@fda.hhs.gov) Contracting Officer (CO): James Jenrette (James.JenretteIII@fda.hhs.gov) Contracting Specialist (CS): Amanda Edger (Amanda.Edger@fda.hhs.gov)

Observance of Federal Holidays The Government will not require support at the Government facility on Saturdays, Sundays, or the Federal holidays shown below, or days of government closure due to inclement weather:

1. New Year's Day 1 January

2. Martin Luther King's Birthday Third Monday in January

3. President's Day Third Monday in February

4. Memorial Day Last Monday in May

5. Juneteenth (Observed) 19 June

6. American Independence Day (Observed) 4 July

7. Labor Day First Monday in September

8. Columbus Day Second Monday in October

9. Veteran's Day 11 November

10. Thanksgiving Day Fourth Thursday in November

11. Christmas Day (Observed) 25 December

The Contractor shall not schedule training during federal holidays or Government closure. As necessary, training scheduled during unexpected Government closures may be rescheduled following coordination with the COR. The contractor shall not bill the Government for any training that the Contractor did not perform due to any Government closures.

Inclement Weather – The Vendor is not required to provide on-site service on days when the Federal Government is closed due to inclement weather. In the event the Federal Government is closed by order of the President of the United States or the U.S. Office of Personnel Management for any reason, or the agency, the center or the building is closed for administrative or safety reasons, the Vendor shall follow directives issued by responsible officials concerning reporting for work.

Clauses HHSAR 352.232-71 Electronic Submission of Payment Requests (FEB 2022)

(a) Definitions. As used in this clause— Payment request means a bill, voucher, invoice, or request for BPA financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this BPA.

(b) Except as provided in paragraph (c) of this clause, the Vendor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Vendor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Vendor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of clause)

Federal Acquisition Regulation (FAR) Provisions Incorporated by Reference

FAR Clause Title Date 52.204-7 System for Award Management OCT 2018 52.204-8 Annual Representations and Certifications MAY 2024 52.204-8 Annual Representations and Certifications MAR 2020 --Alternate I 52.204-16 Commercial and Government Entity Code AUG 2020 Reporting 52.204-24 Representation Regarding Certain NOV 2021 Telecommunications and Video Surveillance Services or Equipment 52.204-26 Covered Telecommunications Equipment or Services— OCT 2020 Representation 52.209-11 Representation by Corporations Regarding Delinquent FEB 2016 Tax Liability or a Felony Conviction under any Federal Law

Federal Acquisition Regulation (FAR) Provisions Incorporated in Full Text

FAR 52.252-1 Solicitation Provisions Incorporated by Reference This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

https://acquisition.gov/far/ (End of clause)

Federal Acquisition Regulation (FAR) Clauses Incorporated by Reference

FAR Clause Title Date 52.204-10 Reporting Executive Compensation and First-Tier JUN 2020 Subcontract Awards 52.204-14 Service Contract Reporting Requirements OCT 2016 52.204-21 Basic Safeguarding of Covered Contractor Information NOV 2021 Systems 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and NOV 2021 https://acquisition.gov/far/

Other Covered Entities 52.204-25 Prohibition of Contracting for Certain Telecommunications NOV 2021 and Video Surveillance Services or Equipment 52.209-6 Protecting the Government’s Interest When Subcontracting NOV 2021 with Contractors Debarred, Suspended, or Proposed for Debarment 52.209-10 Prohibition on Contracting with Inverted Domestic NOV 2015 Corporations 52.219-6 Notice of Total Small Business Set-Aside NOV 2020 52.219-6 Notice of Total Small Business Set-Aside--Alternate I MAR 2020 52.219-28 Post-Award Small Business Program Rerepresentation MAR 2023 52.222-21 Prohibition of Segregated Facilities APR 2015 52.222-26 Equal Opportunity SEP 2016 52.222-35 Equal Opportunity for Veterans JUN 2020 52.222-36 Equal Opportunity for Workers with Disabilities JUN 2020 52.222-37 Employment Reports on Veterans JUN 2020 52.222-50 Combating Trafficking in Persons NOV 2021 52.224-3 Privacy Training JAN 2017 52.226-8 Encouraging Contractor Policies to Ban Text MAY 2024 Messaging While Driving 52.232-1 Payments APR 1984 52.232-33 Payment by Electronic Funds Transfer— OCT 2018 System for Award Management 52.232-40 Providing Accelerated Payments to Small Business MAR 2023 Subcontractors 52.233-3 Protest after Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004

Federal Acquisition Regulation (FAR) Clauses Incorporated in Full Text

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

Also, the full text of a clause may be accessed electronically at this/these address(es):

https://acquisition.gov/far/

FAR 52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023)

(a) Definitions. As used in this clause— Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

https://acquisition.gov/far/

Information technology, as defined in 40 U.S.C. 11101(6)—

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use—

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

(b) Prohibition. Section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L.

117- 328), the No TikTok on Government Devices Act, and its implementing guidance under Office of Management and Budget (OMB) Memorandum M-23-13, dated February 27, 2023, “No TikTok on Government Devices” Implementation Guidance, collectively prohibit the presence or use of a covered application on executive agency information technology, including certain equipment used by Federal contractors. The Contractor is prohibited from having or using a covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor’s employees; however, this prohibition does not apply if the Contracting Officer provides written notification to the Contractor that an exception has been granted in accordance with OMB Memorandum M-23 13.

(c) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts, including subcontracts for the acquisition of commercial products or commercial services.

(End of clause)

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

a. All Invoice submissions for goods and or services must be made electronically through the U.S.

Department of Treasury's Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.htm

b. Invoice Submission for Payment means any request for BPA financing payment or invoice payment by the Vendor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), "Content of Invoices" and the applicable Payment clause included in this BPA, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov

1. The Agency will enroll the Vendors new to IPP. The Vendor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Vendor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the BPA award for new contracts or date of modification for existing contracts.

2. Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Vendor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

3. The Vendor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

4. If your company is already registered to use IPP, you will not be required to re-register.

5. If the Vendor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

d. Invoices that include time and materials or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

e. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as BPA cumulative amounts. At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

• Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

• Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)-show rate, base and total amount;

• Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

• Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

• Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Vendor;

• Other Direct Costs - include a listing of all other direct charges to the BPA, i.e., office supplies, telephone, duplication, postage; and

• Fee - amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

f. Vendor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for BPA administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted (2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject BPA or order (c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

g. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Vendor has certified that labor charges are accurate.

h. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Vendor shall not be paid, or shall be paid an amount negotiated by the CO.

i. Payment to the Vendor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Vendor personnel are performing. This may, however, be justification for excusable delays.

j. The Vendor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

k. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the BPA number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

(End of clause)

PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR PHYSICAL

ACCESS

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an

FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [X] Low [] Moderate [] High Integrity: [X] Low [] Moderate [] High Availability: [X] Low [] Moderate [] High Overall Risk Level: [X] Low [] Moderate [] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [] Yes PII http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [] Low [] Moderate [] High [X] N/A

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with

OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf http://inside.fda.gov:9003/downloads/administrative/forms/fda/ucm013733.pdf and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Basis of Award and Evaluation Criteria From a technical perspective, the Government will evaluate whether the work plan included in the submission will comply with the tasks and goals described in the Statement of Work (SOW) and whether the implementation approach described by the Offeror is technically sound, following standard practices while adhering to government guidelines and regulations.

From a business perspective, the Government will evaluate whether the Offeror’s submission demonstrates a clear understanding of the labor skill mix and level‐of‐effort required to meet the proposed deliverables and whether the labor categories, proposed hours, and overall staffing plan is in line with government assumptions and estimates for the task and is adequate to meet the outlined work plan.

Confidence Ratings The Government will assess its confidence level in the Offeror’s ability to successfully perform all requirements based on the proposal’s demonstration of technical understanding, personnel qualifications, and management approach. Each proposal will be evaluated according to four primary factors: Technical Plan/Approach, Key Personnel, Management Plan and Relevant Experience. Confidence ratings of High, Some, or Low will be assigned to each factor to reflect the Government's level of confidence in the Offeror’s approach to meeting solicitation requirements. This confidence-based evaluation framework enables a best-value assessment, where proposals demonstrating a higher confidence level may justify trade-offs in other factors to achieve the best outcome for the Government.

Confidence Rating Table

Evaluation Factor

High Confidence Some Confidence Low Confidence

Factor 1:

Technical Plan/Approach

Proposal demonstrates a comprehensive and logical technical approach, with a strong understanding of the work’s purpose, methodologies, and objectives. Proven and innovative methodologies, especially those relevant to scientific and regulatory agencies, are clearly identified and likely to succeed.

Proposal shows an adequate understanding of the objectives and methodologies, addressing the scope with general relevance and adequacy. Some innovations or proven methodologies may be included.

Limited or unclear technical approach, lacking detail or proven methodologies, leading to low confidence in effective performance and achieving objectives.

Factor 2: Key Personnel

Staffing plan presents a highly qualified team with relevant experience, with all staff matched to appropriate tasks. All

Staffing plan generally meets qualifications, with adequate skills and relevant experience. Some

Limited experience or mismatched qualifications among personnel, raising

Evaluation Factor

High Confidence Some Confidence Low Confidence key personnel demonstrate the required expertise for analysis, synthesis, and communication.

key personnel require clarification on task relevance or commitment.

doubts on capability to perform required tasks, impacting performance confidence.

Factor 3:

Management Plan

Management approach is robust, with a clear organizational structure, proactive management controls, and strong collaboration plans with FDA and subcontractors. Risk management measures are extensive and well-suited for program goals.

Management approach is reasonable, with outlined plans for organizational resources and collaboration, though some areas may lack specificity in risk management or resource use.

Management approach lacks detail or clarity in structure, coordination, or risk controls, leading to low confidence in managing timelines and objectives effectively.

Factor 4:

Relevant Experience

Professional capabilities present a highly qualified team with relevant experience, with all staff matched to appropriate tasks. All professional personnel demonstrate the required expertise for analysis, synthesis, and communication.

Plan generally meets qualifications, with adequate skills and relevant experience. Some personnel require clarification on task relevance or commitment.

Limited experience or mismatched…