RFP 75F40126R00009 FIRF IDIQ.pdf

75F40126R00009

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP) REQUEST FOR

SEALED BID (IFB) INVITATION FOR BID

5. DATE ISSUED

1. This Contract is a Rated Order under the Defense Priorities and Allocations RATING PAGE OF PAGES

1 107

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXTENSIONNUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 3304 (a) ( 10 U.S.C. 3204 (a) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION UNDER THE

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

09/04/2026 X

DAO

DHHS/FDA/OAGS/DAO

11601 Landsdown St.

13th Floor North Bethesda MD 20852

1400 ET 09/21/2026

MELINDA KIM 301

MELINDA.KIM@FDA.HHS.GOV

796-0607

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

NICHOLAS C. BISHER

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1-3

5-27 30-32 33-42 43-50

51-84

86-90

91-102

103-107

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____120_________ calendar days (60 calendar days unless a different period is inserted

PROPOSAL

UNITED STATES CODE AT:

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 107

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

75F40126R00009

(A) (B) (C) (D) (E) (F)

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format set forth at Revolutionary Federal Acquisition Regulation

(FAR) Overhaul (RFO) FAR 12.202(b)(1) (Apr. 20, 2026) [adopted via Department of

Health and Human Services (HHS) FAR Class Deviation (CD) No. 2025-09, Amendment 1

(Nov. 3, 2025)]. This announcement constitutes the only solicitation. Offers are being requested, and a separate written solicitation will not be issued. This acquisition is exclusively set aside for Service-Disabled Veteran-Owned Small

Business (SDVOSB) concerns in accordance with RFO FAR 19.106-2 (Feb. 20, 2026)

[adopted via HHS FAR CD No. 2026-01, Amendment 2 (Apr. 24, 2026)]. Status as an

SDVOSB concern is determined by the Small Business Association (SBA) in accordance with 13 Code of Federal Regulations (CFR) part 128. Solicitation number

75F40126R00009 is issued as a request for proposal (RFP) for Contractor-Hosted Fully

Integrated Records Facility (FIRF) services. The Government anticipates awarding a single Indefinite Delivery, Indefinite Quantity (IDIQ) contract that will allow for

Time-and-Materials (T&M), Labor-Hour (LH), and Firm-Fixed Price (FFP) type Task

Orders, or a combination thereof. This anticipated IDIQ will contain a five (5) year ordering period, which will be from the date of award through five (5) years unless extended as applicable.

Period of Performance: 10/30/2026 to 10/29/2031

1 Contractor-Hosted Fully Integrated Records

Facility (FIRF) services.

IDIQ ceiling: $50,000,000.00.

IDIQ guaranteed minimum: $10,000.00.

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

Contractor-Hosted Fully Integrated Records Facility (FIRF) IDIQ Recompete Request for Proposal (RFP) No. 75F40126R00009

Part I – The Schedule

Section A, Solicitation/contract form

A.1 NOTICE OF COMBINED SYNOPSIS/SOLICITATION FOR COMMERICAL SERVICES

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format set forth at Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) FAR 12.202(b)(1) (Apr. 20, 2026) [adopted via Department of Health and Human Services (HHS) FAR Class Deviation (CD) No. 2025-09, Amendment 1 (Nov. 3, 2025)]. This announcement constitutes the only solicitation. Offers are being requested, and a separate written solicitation will not be issued. Solicitation number 75F40126R00009 is issued as a request for proposal (RFP) for Contractor-Hosted Fully Integrated Records Facility (FIRF) services. This is a request for proposal (RFP) for commercial services in accordance with the procedures of RFO FAR Part 12 – Acquisition of Commercial Products and Commercial Services, in conjunction with the procedures of RFO FAR Part 15 – Contracting by Negotiation. See RFO FAR 12.201-2 (Apr. 20, 2026) [adopted via HHS FAR CD No. 2025-09, Amendment 1 (Nov. 3, 2025)].

A.2 NOTICE OF NAICS/SET-ASIDE

This acquisition is a set-aside for Service-Disabled Veteran-Owned Small Business (SDVOSB) concerns eligible under the SDVOSB Program in accordance with RFO FAR 19.106-2 (Feb. 20, 2026) [adopted via HHS FAR CD No. 2026-01, Amendment 2 (Apr. 24, 2026)]. The associated North American Industry Classification System (NAICS) code is 541611- Administrative Management and General Management Consulting Services. The associated small business size standard is $24.5 million.

Pursuant to RFO FAR clause 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (Deviation Date) [HHS FAR CD 2026-01, Amendment 2 (Apr. 24, 2026), RFO FAR 19.106-4(a) (Feb. 20, 2026), RFO FAR 52 (July 1, 2026)], Offers are solicited only from concerns designated in the System for Award Management (SAM) as SDVOSB concerns certified by the Small Business Administration (SBA) in accordance with 13 Code of Federal Regulations (CFR) part 128. Offers received from concerns that are not SDVOSB concerns certified by SBA will not be considered. Any award resulting from this solicitation will be made only to a concern designated in SAM as an SDVOSB certified by SBA.

A.3 NOTICE OF FAC

This solicitation document incorporates FAR provisions and clauses in effect through Federal Acquisition Circular (FAC) 2026-01, effective March 13, 2026. This solicitation incorporates provisions and clauses by reference. The full text of provisions and clauses may be accessed electronically at https://www.acquisition.gov/far/part-52 and at https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52.

The Department of Health and Human Services (HHS) Acquisition Regulation (HHSAR) provisions and clauses referenced in this solicitation can be found on the following websites:

• HHSAR (effective February 2, 2022): https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses

• HHSAR Class Deviations: https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/index.html

• RFO HHSAR Part 352: https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/rfo-part-352-solicitation-provisions-contract-clauses/index.html https://www.acquisition.gov/far/part-52 https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52 https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/index.html https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/index.html https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/rfo-part-352-solicitation-provisions-contract-clauses/index.html https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/hhsar-overhaul/rfo-part-352-solicitation-provisions-contract-clauses/index.html

Section B, Supplies or services and prices/costs

B.1 OVERVIEW OF PRICING SCHEDULE

Offerors shall propose labor categories and labor rates as a completed version of Attachment C: IDIQ Pricing Worksheet, to be included in the “Volume 2 – Business/Price Proposal” submission (see Section L, Instructions, conditions, and notices to offerors or respondents).

The Contractor’s pricing schedules for labor categories shall contain fully burdened hourly rates. The fully burdened hourly rates for each labor category shall include wages, indirect costs, fringe benefits, overhead, general and administrative, and profit. Hourly rates shall apply to services at both Government and non-Government sites.

By mutual agreement of the parties, additional labor categories may be added to this IDIQ contract to support the tasks of this contract.

B.2 PRICING TERMS

The Contractor shall comply with paragraph (i), Payment, of RFO FAR clause 52.212-4 Terms and Conditions— Commercial Products and Commercial Services (Deviation Date) [HHS FAR CD 2025-09, Amendment 1 (Nov. 3, 2025), RFO FAR 12.205(b)(1) (Apr. 20, 2026), RFO FAR 52 (July 1, 2026)], regarding the firm-fixed prices for individual Task Orders.

The Contractor shall comply with paragraph (i), Payments, of RFO FAR clause 52.212-4 Terms and Conditions— Commercial Products and Commercial Services (Deviation Date), Alternate I (Deviation Date) [HHS FAR CD 2025-09, Amendment 1 (Nov. 3, 2025), RFO FAR 12.205(b)(1) (Apr. 20, 2026), RFO FAR 52 (July 1, 2026)], regarding the ceiling prices for individual Time-and-Materials (T&M) or Labor-Hour (LH) Task Orders.

B.3 TYPE OF CONTRACT

The Government anticipates awarding a single Indefinite Delivery, Indefinite Quantity (IDIQ) contract that will allow for Time-and-Materials (T&M), Labor-Hour (LH), and Firm-Fixed Price (FFP) type Task Orders, or a combination thereof. This anticipated IDIQ will contain a five (5) year ordering period, which will be from the date of award through five (5) years unless extended as applicable.

B.4 MINIMUM AND MAXIMUM CONTRACT VALUE

(a) The guaranteed minimum for this IDIQ contract is $10,000.00. It is anticipated that the $10,000.00 guaranteed minimum will be obligated at time of IDIQ contract award.

(b) The maximum ceiling for this IDIQ contract is $50,000,000.00.

Section C, Description/specifications/requirements

U.S. FOOD & DRUG ADMINISTRATION (FDA)

CONTRACTOR-HOSTED FULLY INTEGRATED RECORDS FACILITY (FIRF)

INDEFINITE DELIVERY-INDEFINITE QUANTITY (IDIQ)

STATEMENT OF WORK (SOW)

C.1 INTRODUCTION

The mission of the U.S. Food and Drug Administration (FDA) is to protect the health of the American public. For more than one hundred years, FDA has been the international leader ensuring safe food, cosmetics, human drugs, biologics, veterinary products, medical and radiological devices, and tobacco products. As part of its mission, the FDA receives documents from a variety of public and private entities, including regulated industry. Throughout FDA’s history, document control and records management has played a vital role in the Agency’s regulation process and, ultimately, in the mission to protect public health. This allows FDA to comply with federally mandated document control and record keeping requirements, while maintaining a high level of accountability to the citizens of the United States. To ensure proper organization and management of documents and records materials, the FDA complies with regulations set forth in the Federal Records Act per United States Code (U.S.C.), Title 44, Chapters 29 thru 33; Title 36 Code of Federal Regulations (CFR), Chapter 12; and National Archives and Records Administration (NARA) guidance.

C.2 BACKGROUND

Document control and records management practices are exercised throughout the FDA. This contract encompasses processing documents and records material related to scientific advancement and public health issues at the Contractor-Hosted Fully Integrated Records Facility (FIRF). Due to business strategic initiatives for managing documents and records material, FDA has an ongoing need for flexible accommodations/infrastructure for processing documents and records material.

The FDA regulatory mission supports many laws and Federal regulations that give FDA its mandate. This includes, but is not limited to, Federal Food, Drug and Cosmetic Act, Food and Drug Administration Amendments (FDAAA), Food and Drug Administration Safety and Innovation Act (FDASIA), and other relevant statutes, as follows:

Prescription Drug User Fee Act (PDUFA), Medical Device User Fee Act (MDUFA), Clinical Laboratory Improvement Amendments (CLIA), Medical Device Amendments, Safe Medical Devices Act, Electronic Product Radiation Control Provisions of the Food Drug and Cosmetics Act (formerly the Radiation Control for Health and Safety Act), Biosimilar User Fee Act (BsUFA), Animal Drug User Fee Act (ADUFA), Animal Generic Drug User Fee Act (AGDUFA), Mammography Quality Standards Act (MQSA), Export Reform and Enhancement Act (EREA), Freedom of Information Act (FOIA), Family Smoking Prevention and Tobacco Control Act (FSPTCA), and Food Safety Modernization Act (FSMA).

The FDA is required by law to regulate the cosmetic, pharmaceutical, food, tobacco, animal drug, and medical device industries. Regulatory submissions are applications submitted by industry that describe the content and use of products and require FDA review.

Regulatory submissions vary across Centers but typically fall in one of the following categories: pre-market or post-market. Pre-market submissions include pre-application materials, investigational applications, new product applications, and license applications. Post-market submissions include supplemental applications to marketed products, registration and listing information, export applications and certificates, allegations of regulatory misconduct, recalls, Freedom of Information Act (FOIA) requests, and promotional materials. For more detail regarding specific regulatory submissions and associated forms, see the following hyperlink:

https://www.fda.gov/about-fda/reports-manuals-forms/forms.

C.2.1. DOCUMENT/RECORDS MANAGEMENT TECHNICAL ENVIRONMENT

FDA’s Contractor-Hosted Fully Integrated Records Facility (FIRF) ensures timely receipt, processing, temporary storage, and distribution of applications to the FDA reviewer community. Currently, there is an off-site Contractor-hosted FIRF. This FIRF provides full life cycle records operations and support.

FDA desires to further the cost savings to the Agency and address space constraints through the consolidation of like functions performed by contractors supporting the off-site Contractor-hosted FIRF. This type of work environment provides FDA with increased flexibility regarding managing space constraints to achieve cost savings.

The FDA FIRF processed over 3,529,079 paper and electronic application submissions in Fiscal Year (FY) 2025.

Each application submission may have multiple record keeping transactions (e.g., document preparation, imaging, login, hold, amendments, log out, and issuance of correspondence for purposes of gathering additional information to support or close the review). Therefore, the number of transactions will be substantially greater than the number of unique application submissions.

The FDA receives materials from sources internal and external to the agency, which includes, but is not limited to, paper and electronic. Materials include e-mails, documents, letters, memoranda, completed forms, URLs, graphics, photographs, audio and video recordings, diskettes, DVDs, CDs, microfiche, microfilm, USB drives, and hard drives. In addition, FDA receives physical artifacts such as labels, bottles, syringes, laboratory samples, feed bags, and boxes.

In addition, some Centers accept electronic copies (eCopy submissions). An electronic copy is an exact duplicate of a paper submission. It may be received on a CD, DVD, USB drive, or external hard drive accompanied by a copy of the signed cover letter. It may also be received electronically through the electronic submissions gateway or CDRH Portal with no accompanying cover letter. CDRH also accepts eSTAR submissions. Certain submission types are required in eSTAR format instead of eCopy format. When eSTAR is required, the CDRH Portal or electronic submissions gateway is also required, with few exceptions.

C.2.2. 21ST CENTURY ELECTRONIC BASED RECORDS INFORMATION MANAGEMENT (RIM)

ENVIRONMENT

The FDA strives towards a streamlined 21st Century electronic Records Information Management (RIM) Lifecycle environment that preserves the integrity of public records while creating cost efficiencies that allow the Agency to focus on advancing in scientific and public health efforts. FDA recognizes that electronic submissions have many advantages over paper submissions. By storing electronic submissions in Electronic Document Rooms (EDRs), they are always readily accessible to reviewers. The FDA’s goal is to be 100% electronic.

Currently, FDA receives electronic submissions in structured and unstructured formats for regulatory submissions.

Cosmetic, pharmaceutical, food, and medical device or electronic product regulatory submissions, which are applications submitted by industry, provide required information to the FDA to comply with the regulations for regulated products. Regulatory submissions vary across Centers but typically fall into one of the following categories: pre-market or post-market.

C.3 PURPOSE

The purpose of this Indefinite Delivery-Indefinite Quantity (IDIQ) contract is to obtain Contractor services related to several document control and records-related activities throughout FDA, to be performed at the Contractor-Hosted FIRF. This includes receiving, processing, inventorying, scanning services, disposing of documents and records materials, cataloguing, storage of documents, materials, redaction, data entry, helping firms with submitting information electronically, running reports/queries, correcting, and entering data into electronic systems and emailing correspondence to firms.

C.4 OBJECTIVES

The Contractor shall provide services and solutions for the processing of documents, records material and information, such as:

1. Standardizing records management processes;

2. Promoting transparency and accountability by better documenting Agency actions and decisions;

3. Moving to near 100% electronic environment for new premarket and postmarket submissions;

4. Implementing and promoting operational efficiencies; and

5. Implementing and promoting cost efficiencies.

C.5 SCOPE

Independently and not as an agent of the Government, the Contractor shall furnish the necessary personnel, materials, services, and facilities to do all things necessary for or incidental to the performance of the work for Contractor-hosted offsite document control services. This includes receiving, processing, inventorying, scanning services, disposing of documents and records materials, cataloguing, storage of documents and materials, redaction, data entry, helping firms with submitting information electronically, running reports/queries, correcting, and entering data into electronic systems and emailing correspondence to firms. The Contractor shall be responsible for complete management of the FIRF in which services are provided.

C.6 TASKS AREAS

The FDA Off-Site regulatory document and records control and electronic submissions handling processes are divided into the following major task areas:

• Task Area 1: Program and Task Order Management Support;

• Task Area 2: Document Processing, Handling, Correspondence, and Delivery;

• Task Area 3: Document Scanning, Photocopying, Conversion, and Pre-market Services;

• Task Area 4: Document Data Entry Services, Data Analysis, Tracking Services, and Stakeholder Support;

• Task Area 5: Tracking and Temporary Storage of Government Records; and

• Task Area 6: Transition Work Activities

C.6.1. TASK AREA 1: PROGRAM AND TASK ORDER MANAGEMENT SUPPORT

The Contractor shall provide the program management services necessary to plan, structure, coordinate, schedule, manage, communicate, report, and steward all Task Orders (TOs) and activities throughout the IDIQ contract’s period of performance. The Contractor shall provide both Contract-level Program Management task support and TO-level project management task support to establish control, management, monitoring, and notification mechanisms, and shall work with the Government Contracting Officer (CO), Contracting Officer’s Representative (COR), Task Order Project Managers (TOPMs), and Subject Matter Experts (SMEs) to ensure that tasks stay on track and important milestones are met.

C.6.2. TASK AREA 2: DOCUMENT PROCESSING, HANDLING, CORRESPONDENCE, AND

DELIVERY

Documents and records material shall be received at the FIRF. The Contractor shall receive U.S. Mail and deliveries via commercial, private couriers, and will also receive electronic documents (e.g., via online portals, email, or other mechanisms that require processing). Specific mail room processes will be identified in the individual TOs. The Contractor shall be required to staff the mail room, monitor electronic document systems, including emails, sort documents received, prioritize, triage, scan, bar-code/track, and distribute both hard copy and electronic regulatory submissions to the FDA community, or coordinate with U.S. mail couriers and others. The Contractor shall be responsible for tracking all documents to and from the FIRF and the FDA White Oak campus.

As tasked, the Contractor shall process required and voluntary eCopies of submissions provided to FDA on an electronic media (e.g., CD) into the official repository. The Contractor shall perform at least 95% same-day processing for each submission type.

The FDA creates and receives a variety of non-regulatory Federal records. This includes, but is not limited to, program records, office administration records, and dockets. The Contractor shall provide user support services to internal and external stakeholders. Some examples of user support services are responding to inquiries regarding the status of documents being processed, assisting firms with entering data into an electronic system to comply with regulatory requirements, and searching for records to respond to Freedom of Information Act (FOIA) requests.

In addition, the Contractor shall perform tasks related to, but not limited to, document and records information processing. As tasked, the Contractor shall provide courier service to multiple FDA facilities each weekday. The Contractor shall be responsible for providing courier services and distributing mail and stored files between off-site and on-site locations and coordinating pick-up and drop-offs as identified in individual TOs. The FDA distributes documents and records materials to FDA employees, managers, and Contractor staff. New incoming regulatory submissions are primarily distributed to the FDA reviewer community. Non-regulatory material may go to the FDA reviewer community, Contractor staff, administrative staff, and program managers, as needed/or instructed.

Distribution locations can be modified or changed throughout the review process for various reasons; thus, requiring data entry changes in the applicable tracking system. The Contractor shall also provide expedited delivery services of FDA materials. Expedited delivery is within one (1) to two (2) hours of an order being placed. The Contractor shall deliver records materials after hours, as required. After hours are after normal business hours (8:00 am – 5:00

pm) Monday through Friday, weekends, and holidays. The Contractor shall be responsible for providing back-up couriers/drivers services in the event courier support services are required after hours.

C.6.3. TASK AREA 3: DOCUMENT SCANNING, PHOTOCOPYING, CONVERSION, AND PRE-

MARKET SERVICES

The Contractor shall perform off-site scanning services for pre-market and post-market documents (paper, legacy (historical) paper copy and microfiche submissions), which may range from digitizing legacy material to processing new physical documents and records material. The Contractor shall first verify whether the submission is loaded into IMAGE. If the submission has not been loaded into IMAGE, the Contractor shall scan and index the submission and perform a Quality Control (QC) on the images to ensure the quality and accuracy of the scans. Once the submission has been verified in IMAGE, the Contractor shall destroy the documents immediately (unless subject to applicable Federal records policy). Most scanned services will be from paper to electronic images. The Contractor shall also convert material such as film, videos, microfiche, blowbacks, and physical artifacts into digitized images.

Requirements for off-site scanning, photocopying, conversion, and pre-market services will vary and will be outlined in the individual TOs.

C.6.4. TASK AREA 4: DOCUMENT DATA ENTRY SERVICES, DATA ANALYSIS, TRACKING

SERVICES, AND STAKEHOLDER SUPPORT

The Contractor shall be responsible for using a database system (i.e., a combination of FDA existing systems and the Contractor’s system which will be used to determine where a document is located at any given time) to conduct scheduled inventories of documents and records located at the FIRF and to track the real-time file movement (and status of files) between FDA on-site and off-site locations. FDA Document and Records Managers need real-time access to the inventory data which allows FDA to track the location of documents and determine the status of documents (e.g., change status of files from active to inactive). As tasked, the Contractor shall upload inventories of documents and records information into Center-specific tracking systems and databases and provide direct access to their tracking system by Application Programming Interface (API) or some other means to allow for real time data acquisition by FDA. The Contractor’s tracking system must meet all requirements listed in the FDA/CDRH Document Control Center (DCC) Tracking System Requirements (Attachment A: Statement of Work Appendices, Appendix 5: FDA-CDRH Document Control Center (DCC) Tracking System Requirements).

C.6.5. TASK AREA 5: TRACKING AND TEMPORARY STORAGE OF GOVERNMENT RECORDS

The Contractor shall be responsible for notifying the IDIQ COR, TO COR, Task Order Project Manager (TOPM), and Center’s Records Manager when the Records Control Schedules (RCSs) indicate a file is ready for retention and/or disposal. The Contractor shall obtain written authorization from the Center’s Records Manager before moving or disposing of files. The FDA classifies retention and disposal schedules by the following record types:

administrative, program, or Center-Specific. The Agency regularly analyzes, develops, produces, and updates FDA RCSs for the Agency, as well as for the individual Centers.

C.6.6. TASK AREA 6: TRANSITION WORK ACTIVITIES

Transition activities shall take place to efficiently transition TO requirements from the predecessor Contractor to the successor Contractor, upon the completion of this contract, if necessary. As tasked, the Contractor may be required to develop transition-in and transition-out plans for individual TOs issued against this IDIQ contract based on individual requirements.

C.6.6.1. TRANSITION-IN

A smooth and orderly transition-in from the predecessor Contractor to the successor Contractor is necessary to ensure minimum disruption to vital FDA business. Transition-In Plans shall include, at a minimum, a description of parallel operations, management plans, personnel on-boarding process tracking, and an updated list of Contractor personnel, with anticipated start dates and responsibilities. The Contractor shall cooperate fully in transition activities. The Contractor shall work with the FDA Help Desk Support during the transition to implement the Help Desk Support Project Plan for any large-scale relocation/movement of equipment. This shall include, but may not be limited to, the relocation/movement of FDA IT computer equipment, such as computer monitors, keyboards, mice, laptop and desktop computers, printers, scanners, or any other peripherals.

C.6.6.2. TRANSITION-OUT

A smooth and orderly transition-out from the predecessor Contractor to the successor Contractor is necessary to ensure minimum disruption to vital FDA business. The Contractor shall be required to submit and execute a Transition-Out Plan to ensure business continuity for the FDA in the event there is a successor Contractor. This shall include, at a minimum, the following:

• Transition-Out Plan and Schedule;

• Scheduling of knowledge walkthrough sessions;

• Providing “shadowing” and other knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor;

• Submitting knowledge transfer documentation, to include current and up-to-date Standard Operating

Procedures (SOPs); and

• Providing FDA with current inventory of all Government-owned assets used by the Contractor, along with full support in the reconciliation of this inventory.

To accommodate strategic initiatives for creating cost and operational efficiencies, the FDA anticipates FIRF locations and housed documents may change between various locations during the life of this IDIQ contract. As tasked, the Contractor shall assist with the preparation and movement of documents between current facilities and new or existing sites. The Contractor shall be required to manage documents and other submissions in a timely and secure manner during day-to-day planned activities and facility relocation in accordance with FDA processing guidance and policies.

C.7 FACILITY REQUIREMENTS

C.7.1. INFRASTRUCTURE AND EQUIPMENT REQUIREMENTS

All infrastructure must obtain an Authorization to Operate (ATO) certificate from FDA, which certifies the FIRF and IT equipment that are proposed to process FDA’s documents are compatible with FDA’s physical and logical environments.

All Contractor-provided equipment connected to FDA’s network must be isolated for FDA business exclusively and may not be used to process any non-FDA business. Therefore, the FDA technical environment must be separated from the Contractor’s internal technical environment.

C.7.2. FDA DIRECT DATA CABLE

Upon award of the first TO issued under this IDIQ contract, the Government will be responsible for purchasing, installing, and maintaining a Verizon data cable line that directly connects from the FDA White Oak Campus to the Contractor’s facility, if applicable.

The Contractor shall safely conceal data outlets, and the associated wiring used to transmit data to workstations must be in floor ducts, walls, columns, or below access flooring. The Contractor shall provide outlets, which must include rings and pull strings to facilitate the installation of the data cable. When cable consists of multiple runs, the Contractor shall provide ladder-type or other acceptable cable trays to prevent Government-provided cable from coming into contact with suspended ceilings or sprinkler piping. Cable trays must form a loop around the perimeter of the Government-demised area such that they are within a 30-foot horizontal distance of any single drop.

C.7.3. OFF-SITE FACILITY MANAGEMENT

The FIRF must comply with Federal Information Security Management Act (FISMA) and supplemental policies for securing document and records material and information.

The Contractor shall comply with all Federal, state, and local laws, codes and ordinances applicable to use and occupancy of Real Property, including, without limitation, laws applicable to the construction, ownership, alteration, maintenance or operation of all buildings, structures, and facilities located thereon, and obtain all necessary permits, licenses and similar items at its own expense. This contract shall be governed by Federal law.

C.7.4. PHYSICAL ACCESS CONTROLS

Entrance into the Contractor-Hosted FIRF must be through controlled entry point(s). Visitors shall be required to sign in and out at the entrance and state the purpose of their visit. A log shall be kept of all such visits. Persons that do not have a legitimate business need related to the facility operation shall not be allowed access to the FIRF.

C.7.5. NETWORK ACCESS CONTROLS

Contractors accessing FDA’s Virtual Private Network (VPN) from off-site locations to manage records information must be connected to the FDA network through an FDA authorized secure channel, such as Cisco AnyConnect/Zscaler. All Contractor staff accessing FDA’s network from remote locations are subject to FISMA regulations. The FDA reserves the right to inspect the FIRF to verify FISMA compliance. Please note, Contractor staff may not access the FDA network via their personal computers. If a direct connection is required from the FIRF to the FDA network due to bandwidth or security reasons, the Government will provide the Contractor with all necessary specifications for the Contractor to provide proper connectivity.

C.8 KEY PERSONNEL

The Contractor shall provide sufficient personnel possessing the skills, knowledge, training, and security clearances to perform the services required by this IDIQ. The Government requires a balanced team of personnel to ensure operational (budgetary/financial) and technical aspects of the IDIQ are successful.

It is critical that the Contractor is committed to maintaining consistency in key personnel and staff assignments for the duration of the FIRF IDIQ contract and Task Orders issued under the IDIQ.

The Contractor shall ensure that personnel maintain generally required professional certifications, accreditations, and proficiency relative to their areas of expertise (as defined in the labor category descriptions and minimum requirements set forth in Attachment F: Labor Category Descriptions). The training of Contractor personnel to fulfill these requirements shall be provided at the Contractor’s expense. The Contractor shall retain documentation of such records.

C.8.1. HEALTH AND HUMAN SERVICES ACQUISITION REGULATION (HHSAR) 352.237-75 KEY

PERSONNEL (DEC 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

The following individual will be designated as Key Personnel at the IDIQ contract level:

Position Labor Category Name of Individual Program (Contract) Manager To be determined at time of award To be determined at time of award

Key Personnel may also be identified within each TO.

C.9 LABOR CATEGORY DESCRIPTIONS AND MINIMUM REQUIREMENTS

See Attachment F: Labor Category Descriptions in Section J, List of attachments.

C.10 OCCUPATIONAL SAFETY AND HEALTH TERMS AND CONDITIONS

GENERAL OCCUPATIONAL SAFETY AND HEALTH TERMS AND CONDITIONS:

1. The contractor is responsible for ensuring contractor personnel comply with applicable OSHA requirements, report unsafe conditions or activities to the Contracting Officer’s Representative (COR), and avoid actions and conditions that may result in an accident.

2. The contractor shall submit to the COR a site-specific safety and accident prevention plan and OSHA 300A reports from the past three calendar years.

3. The contractor shall report all workplace incidents, accidents, injuries, and near-misses that occur within the scope of the acquisition (whether OSHA-recordable or not) to the COR by email as soon as possible, but no more than 24-hours after discovery of the incident, illness or injury, or near-miss.

4. The contractor shall provide an investigation report at no cost to the Government for all workplace incidents, accidents, injuries, and near-misses that occur within the scope of the acquisition (whether OSHA-recordable or not) to the COR by email as soon as possible, but no more than 24-hours after the conclusion of the investigation of the incident, illness or injury, or near-miss.

5. The contractor shall report all activities or conditions that pose imminent danger or harm to persons, animals, or Government property immediately upon discovery to FDA Security or directly to local emergency services, as appropriate. In addition, the contractor shall report the incident to the COR immediately thereafter.

6. The contractor shall be responsible for any and all costs, expenses, and other obligations paid or incurred, due to the contractor’s noncompliance with federal, state, and/or local laws or ordinances.

7. As applicable, the contractor shall provide personal protective equipment (e.g., hard hats, safety glasses, work gloves) for anticipated hazards and ensure that contractor personnel wear the prescribed safety and health equipment within the work area, as prescribed by 29 CFR part 1910, Subpart I. The contractor shall provide instructions to personnel on the proper wear, maintenance, and limitations of the personal protective equipment prior to commencement of any work under the acquisition.

8. Prior to bringing any hazardous material to an FDA facility, the contractor shall provide the COR copies of any Safety Data Sheets (SDS) to obtain advance, written authorization.

a) Unless otherwise specified in the acquisition, the contractor is responsible for removing any hazardous material, or any material with an SDS, that the contractor brought with them for use at an FDA facility before or during performance of the acquisition.

C.11 PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR PHYSICAL ACCESS

SECURITY

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

• Confidentiality: [ ] Low [ ] Moderate [X] High

• Integrity: [ ] Low [ ] Moderate [X] High

• Availability: [ ] Low [X] Moderate [ ] High

• Overall Impact Level: [ ] Low [ ] Moderate [X] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf

FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/ contract involves:

[ ] No PII [X] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI.

32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information."

81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries.

h. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability…