RFP_75N95023R00002.pdf

National Institute on Drug Abuse Request for Proposal (RFP) No. 75N95023R00002

“Pharmacokinetic and Pharmacodynamic Trials for Medication Development in SUD”

Issued by:

Josh Lazarus, Contracting Officer NIDA Section, Contracts Management Branch Red Office of Acquisitions, NIDA National Institute on Drug Abuse, NIH c/o 3WFN MSC 6012 301 N Stonestreet Ave Bethesda, MD 20892 Point of Contact: Scott Duernberger, Contract Specialist E-Mail: scott.duernberger@nih.gov Phone: (301) 594-0670

DATE ISSUED: Friday, November 3, 2022

PROPOSAL DUE DATE: Thursday, December 15, 2022, 3:00 P.M. Eastern Time

The National Institute on Drug Abuse invites you to submit a proposal responding to the requirements of this RFP No. 75N95023R00002 titled “Pharmacokinetic and Pharmacodynamic Trials for Medication Development in SUD”.

Please refer to Section M for mandatory criteria. All offerors must be REGISTERED and have an ACTIVE System for Award Management "http://www.sam.gov/"(www.sam.gov) account at the time an offer/proposal is submitted to the Government. All offerors registered in the System for Award Management http://www.sam.gov/ (www.sam.gov) must be in full compliance with FAR 52.204-13 System for Award Management Maintenance to be eligible to submit a proposal. The Government will not accept proposals from offerors who do not meet the SAM requirement.

This RFP is prepared in accordance with the Uniform Contract Format (UCF) prescribed for Government wide application by the Federal Acquisition Regulation (FAR). The UCF is both an RFP and contract award document. The resulting contract will consist of Parts I, II, III of the Uniform Contract Format.

NIDA anticipates that one (1) indefinite delivery, indefinite quantity (IDIQ), task order contract will be awarded with a contract ordering period of five (5) years. NIDA may award either cost reimbursement and/or fixed price task orders under this contract.

These individual task orders may include options and/or options quantities. If options or option quantities are utilized for an individual task order the will be clearly defined in the Task Order RFP and be determined and evaluated at the time of task order solicitation and award. NIDA anticipates that at least one task order will be awarded with the contract. Future funding will be made through issuances of task orders and will be dependent on NIDA programmatic needs and availability of funds

General

Part IV of the RFP contains instructions, provisions, and evaluation factors for the submission and review of proposals. Attachment 03 is a "Proposal Intent Response Sheet." Please complete this form and return it to scott.duernberger@nih.gov by November 17, 2022. The balance of Parts I, II, and III contain provisions, clauses, and special requirements which will be made a part of any resultant award. Please review these sections and consider their impact on performance, capability, technical, and cost factors as you develop your proposal. Do not fill in blanks or otherwise complete portions of Parts I, II, and III which appear to require additional information. The Government will complete these items prior to contract award and, if negotiations are conducted, will tailor those items through final negotiations.

Furnish in writing (e-mail) to the Contracting Officer any areas of uncertainty, which, in your opinion, require clarification or correction. You must submit your questions in sufficient time for receipt by the Contracting Officer on or before November 17, 2022. Mark the e-mail, "RFI - RFP 75N95023R00002."

The Business Proposal

The Business Proposal must contain a detailed breakdown of costs by task, for each cost category/element, an explanation of the basis for all costs, and provide documentation to support these costs. Please utilize the Breakdown of Proposed Estimated Costs and Excel spreadsheet contained in Attachment 12.

A completed Form NIH-2043, “Proposal Summary and Data Record” must be included with the Business Proposal. Include the e-mail addresses of both the Principal Investigator and the responsible business representative on the form.

The Offeror must submit its Travel Policy, Total Compensation Plan and Annual Report with the initial Business Proposal.

See Section L.2.c. for additional detail.

The Technical Proposal

Offerors shall complete and attach the “Technical Proposal Cover Sheet” to their technical proposal. Be sure to list all professional personnel and organizations named in the proposal who have any role in the proposed work including staff, subcontractors, collaborating organizations, and consultants. Organizational affiliation(s) must be shown for each person named. If needed, additional sheets may be included using the same format. This information is vital to ensure that no conflicts of interest exist with the review committee members.

Format and content requirements for the Technical Proposal are detailed in Section L.2.b.

Submitting a Proposal

Proposals must be submitted via e-mail or the electronic Contract Proposal Submission (eCPS) website (https://ecps.nih.gov) no later than Thursday, December 15, 2022, 3:00 P.M. Eastern Time. Proposals submitted by facsimile or hard copy will not be accepted. An official authorized to bind your organization must sign the proposal.

Offerors are solely responsible for submitting proposals in a timely manner. Please note that creating an account to submit may take up to three (3) business days. Please plan accordingly. Additional instructions on how to submit a proposal via eCPS can be found at https://ecps.nih.gov/home/howto and in Attachment 01.

All notices related to this solicitation will be posted on Sam.gov (SAM.gov) as well as the NIDA Contracts Home Page (https://www.drugabuse.gov/funding/funding-opportunities/nida-requests-contract-proposals-rfps). If you would like to receive e-mail notifications of updates to this solicitation, please register with SAM.gov.

In accordance with FAR 15.306(a)(3) and FAR 52.215-1, the Government intends to evaluate proposals and award a contract without discussions. Therefore, your initial proposal should contain the best terms from cost or price and technical standpoints. The Government does, however, reserve the right to conduct discussions if the Contracting Officer determines them to be necessary.

Disclaimers

This RFP does not commit the Government to pay the costs for the preparation and submission of a proposal. The Contracting Officer is the only individual who legally can commit the Government to the expenditure of public funds in connection with this acquisition.

Any contract award for this requirement is contingent on the availability of funds (see FAR 52.232-18, Availability of Funds – April 1984).

The National Institute on Drug Abuse appreciates your interest in this RFP and looks forward to receipt of your proposal. Requests for any information concerning this RFP should be directed to Scott Duernberger, at the NIDA Section, Contracts Management Branch, who may be reached at (301) 594-0670 or by email at scott.duernberger@nih.gov; collect calls will not be accepted. Discussions with any other individual outside the NIDA Section, Contracts Management Branch should not occur.

Sincerely, Josh Lazarus, Contracting Officer NIDA Section, Contracts Management Branch Red Office of Acquisitions, NIDA/NIH

- 1 -

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: P.L. 102-321 as amended

2. Request for Proposal (RFP) Number: 75N95023R00002

3. Issue Date:

11/3/2022

4. Set Aside:[ ] No

[ ] Yes See Part IV Section L

Title : Pharmacokinetic and Pharmacodynamic Trials for Medication Development in SUD

6. ISSUED BY:

Office of Acquisitions National Institutes of Health NIDA Section, Contracts Management Branch Red Office of Acquisitions, National Institute on Drug Abuse, NIH c/o 3WFN MSC 6012, Bethesda, MD 20892

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposal," ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposal," until 3:00 PM local time on 12/15/2022. Offers will be valid for 180 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitation requires delivery of proposals to be submitted via the electronic Contract Proposal (eCPS) website at https://ecps.nih.gov as stated in ATTACHMENT 1, "Packaging and Delivery of Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website." Proposals submitted by any other means such as facsimile, hard copy or e-mail will not be accepted. IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE

OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH

subparagraph (c)(3) of FAR Clause 52.21 -1, Instructions to Offerors--Competitive Acquisition," LOCATED IN

SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) when submitting a proposal and continue to be registered until time of award, during performance, and through final payment of any contract, basic agreement, basic ordering agreement, or blanket purchasing agreement resulting from a solicitation.

Offerors who are not registered in SAM should consider applying for registration immediately upon receipt of this solicitation. See FAR 52.204-7 System for Award Management (Oct 2018) and https://www.sam.gov for information on registration.

11. FOR INFORMATION CALL: Scott Duernberger

PHONE: 301-594-0670

e-MAIL: scott.duernberger@nih.gov

COLLECT CALLS WILL NOT BE ACCEPTED.

Requests for clarification, additional information, or correction must be submitted via email to scott.duernberger@nih.gov on or before 3:00 P.M. ET on 11/17/2022. All such emails must contain the subject line:

"RFI - RFP 75N95023R00002".

Josh Lazarus Contracting Officer Office of Acquisitions

NIDA Ref. No.: N01DA-23-8935 RFP Number : 75N95023R00002 https://ecps.nih.gov/ https://www.sam.gov/

RFP Number : 75N95023R00002

- 2 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.14. HIV ANTIRETROVIRAL TREATMENT TRIALS

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. TYPE OF CONTRACT AND NUMBER OF AWARDS

d. ESTIMATE OF EFFORT

e. COMMITMENT OF PUBLIC FUNDS

f. PROMOTING EFFICIENT SPENDING

g. COMMUNICATIONS PRIOR TO CONTRACT AWARD

h. RELEASE OF INFORMATION

i. PREPARATION COSTS

j. SERVICE OF PROTEST

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

6. Alternate Proposals

7. Evaluation of Proposals

8. Potential Award Without Discussions

9. Use of the Metric System of Measurement

NIDA Ref. No.: N01DA-23-8935

- 3 -

10. Standards for Privacy of Individually Identifiable Health Information

11. Privacy Act - Treatment of Proposal Information

12. Selection of Offerors

13. Institutional Responsibility Regarding Investigator Conflicts of Interest

14. ROTC Access and Federal Military Recruiting on Campus

15. CERTIFICATION REGARDING TAX MATTERS (OCT 2020)

16. Past Performance Information

17. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

4. Human Subjects

5. Obtaining and Disseminating Biomedical Research Resources

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Information Other than Cost or Pricing Data

4. Requirements for Cost or Pricing Data or Information Other than Cost and Pricing Data

5. Salary Rate Limitation

6. Small Business Subcontracting Plan

7. Mentor Protege Program, HHSAR 352.219-70

8. HUBZone Small Business Concerns

9. Total Compensation Plan

10. Other Administrative Data

11. Qualifications of the Offeror

12. Subcontractors

13. Proposer's Annual Financial Report

14. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. HUMAN SUBJECT EVALUATION

4. MANDATORY QUALIFICATION CRITERIA

5. EVALUATION OF DATA SHARING PLAN

6. TECHNICAL EVALUATION FACTORS

7. PAST PERFORMANCE FACTOR

8. SUBCONTRACTING PROGRAM EVALUATION CRITERIA

- 4 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS, IF NECESSARY, AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION

TO UNDERSTAND THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

NIDA requires a contractor to carry out clinical pharmacology trials to determine the Pharmacokinetic (PK) and Pharmacodynamic (PD) of novel pharmacotherapies in humans. Data obtained will be used by NIDA and NIDA sponsored investigators for submissions to the U.S. Food and Drug Administration (FDA) in support of Investigational New Drug applications (INDs) and New Drug Applications (NDAs) submissions.

ARTICLE B.2. PRICES/COSTS

a. This is an Indefinite Quantity contract as contemplated by FAR 16.504. The Contractor shall be reimbursed by the Government in an amount not less than a total of $20,000 (minimum) nor more than a total of $21,000,000 (maximum) for successful performance of this contract.

b. For cost reimbursement Task Orders, the fixed fee for individual task orders will be negotiated by task order. The fixed fee shall be paid in installments as negotiated (based on percentage of completion of work or the percent of total effort expended), as determined by the Contracting Officer, and shall be subject to the withholding provision of the clauses ALLOWABLE COST AND PAYMENT and FIXED FEE referenced in the General Clause Listing in Part II, ARTICLE I.1. of this contract. Payment of fixed fee shall not be made in less than monthly increments.

c. The prices/costs set forth in this ARTICLE will cover the five-year contract ordering period.

d. The Government will issue Task Orders based on the work described in SECTION C of this contract.

e. Ordering procedures are described in the TASK ORDER PROCEDURE Article in SECTION G of this contract.

ARTICLE B.3. PROVISIONS APPLICABLE TO DIRECT COSTS

This article will prohibit or restrict the use of contract funds, unless otherwise approved by the Contracting Officer. The following is a list of items that may be included in the resultant contract as applicable. 1) Conferences & Meetings, 2) Food for Meals, Light Refreshments & Beverages, 3) Promotional Items, 4) Acquisition, by purchase or lease, of any interest in real property; 5) Special rearrangement or alteration of facilities; 6) Purchase or lease of any item of general purpose office furniture or office equipment regardless of dollar value; 7) Travel Costs including Foreign Travel; 8) Consultant Costs; 9) Subcontract Costs; 10) Patient Care Costs; 11) Accountable Government Property; 12) Printing costs; and 13) Research Funding.

- 5 -

ARTICLE B.4. ADVANCE UNDERSTANDINGS

a. Site Visits: NIDA anticipates making visits to the Contractor facility, as needed. Contractor shall be responsible for making the facility available for a visit and arranging meetings with appropriate personnel.

b. Informed Consents: All informed consents related to human research shall be approved in writing and in advance by the COR.

[REMAINDER OF PAGE LEFT BLANK INTENTIONALLY]

- 6 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

b. The applicable Privacy Act System of Records Number will be specified and shall be used in any design, development, or operation work to be performed under the resultant contract. Disposition of records shall be in accordance with SECTION C of the contract, and by direction of the Contracting Officer Representative (COR).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format as specified in Section F of the RFP.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html and at: https://www.section508.gov/create/ documents, "Create Accessible Documents."

a. Technical Progress Reports

In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award.

The Contractor shall prepare and submit the following reports using the format below:

Front cover to contain date, title, study report name, task order number; agency (NIDA), division (DTMC) and NIDA COR name/address/phone number, contract number, contractor name and investigator names.

Main body to contain: Narrative summaries of the work accomplished and interpreted results and conclusion.

The Contractor shall ensure that all reports are free from spelling, typographical, or grammatical errors. Study Reports containing such errors shall be deemed unacceptable by NIDA and returned to the Contractor for correction.

Reports will be required in electronic format and the Contractor shall distribute reports as set forth below in Part II. The COR provides specific requirements for submission of electronic reports and datasets.

1. Individual Task Report: Within 15 business days after completion of a study or a task, the Contractor shall submit a comprehensive report to the COR and CO detailing work completed, summary of the results and important finding.

2. Study Protocols: Within 10 business days after receiving a task order award, the Contractor shall submit a draft study protocol to the COR for review and comments. Within 3 business days after receiving comments from the COR, the Contractor shall submit a revised final study protocol. The protocol must be in a format suitable for submission to the FDA.

3. Clinical Study Reports: Within 20 business days after receiving a task order award, the Contractor shall submit a draft study report to the COR for review and comments. Within 5 business days after receiving comments from

NIDA Ref. No.: N01DA-23-8935 http://www.hhs.gov/web/508/index.html https://www.section508.gov/create/documents https://www.section508.gov/create/documents

- 7 -the COR, the Contractor shall submit a revised final clinical study report. The study report must be in a format suitable for submission to the FDA.

4. Monthly Progress Reports: Within the first 5 business days after each calendar month, the Contractor shall a report on activities during the preceding month. In the monthly report, the Contractor shall briefly (in one or two paragraphs) describe the work accomplished, including the number of subjects screened, enrolled, and completed, any changes in staff, and actual or projected problems and proposed solutions.

5. Annual Progress Reports: Within fifteen business days after the end of each year of contract work, the Contractor shall provide a comprehensive report on activities during the year. The Contractor shall incorporate the annual report for the last year of the contact into the Final Report.

6. Final Report: On or before the expiration date of the contract, the Contractor shall provide a comprehensive summary of work conducted during the entire contract period including a summary of the clinical studies completed for each study medication. This report shall also incorporate the final annual report.

7. Task Order Reports & Protocol Developments As specified in the Statement of Work and at the individual Task Order level.

8. Summary of Salient Results

The Contractor will be required to prepare and submit, with the final report, a summary (not to exceed 200 words) of salient results achieved during the performance of the contract. This report will be required on or before the expiration date of the contract.

9. Annual Technical Progress Report for Clinical Research Study Populations

The Contractor shall submit information about the inclusion of women and members of minority groups and their subpopulations (when appropriate) for each study being performed under this contract. The Contractor shall submit this information in the format indicated in the attachment entitled, "" PHS Human Subjects and Clinical Trials Information Form/ Cumulative Inclusion Enrollment Report," which is set forth in SECTION J of this contract. The Contractor also shall use this format, modified to indicate that it is a final report, for reporting purposes in the final report. If the clinical study(s) involves US and non-US sites, the US sites and non-US sites should be reported on separate Cumulative Inclusion Enrollment Reports.

For a completion task order: The Contractor shall submit the report in accordance with the DELIVERIES Article in SECTION F of this contract.

For a Level of Effort task order: The first report shall be due on the date specified in the Task Order.

Thereafter, the report shall be due on or before the day following each reporting period. The final report shall be due on the date specified in the Task Order.

In addition, the NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research, Amended, October, 2001 applies. If this contract is for Phase III clinical trials, see II.B of these guidelines. The Guidelines may be found at the following website: http://grants.nih.gov/grants/funding/ women_min/women_min.htm.

For NIH-defined Phase III Clinical Trials: Include a description of the plans for valid analysis in the study design and outcomes. This includes designing the study in a manner that potential differences, as appropriate, by sex/gender and/or racial/ethnic groups in the clinical trial protocol could be conducted. Also, provide a description of any analyses by sex/gender, race, and/or ethnicity, as appropriate, in the annual progress report and the final report. If the analysis reveals no subgroup differences, a brief statement to that effect, indicating the subgroups analyzed, will suffice. The Government strongly encourages inclusion of the results of subgroup analysis in all publication submissions. In the final report, the Contractor shall include all final analyses of the data on sex/gender, race and/or ethnicity.

b. Other Reports/Deliverables

NIDA Ref. No.: N01DA-23-8935 http://grants.nih.gov/grants/funding/women_min/women_min.htm http://grants.nih.gov/grants/funding/women_min/women_min.htm

- 8 -

1. Reporting of Financial Conflict of Interest (FCOI)

All reports and documentation required by 45 CFR Part 94, Responsible Prospective Contractors including, but not limited to, the New FCOI Report, Annual FCOI Report, Revised FCOI Report, and the Mitigation Report, shall be submitted to the Contracting Officer in Electronic format. Thereafter, reports shall be due in accordance with the regulatory compliance requirements in 45 CFR Part 94.

45 CFR Part 94 is available at: https://www.ecfr.gov/current/title-45/part-94. See Part 94.5, Responsibilities of Institutions regarding Investigator financial conflicts of interest for complete information on reporting requirements.

(Reference the INSTITUTIONAL RESPONSIBILITY REGARDING INVESTIGATOR FINANCIAL CONFLICTS OF INTEREST Article in SECTION H of this contract.)

2. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

A. INFORMATION AND/OR PHYSICAL SECURITY

1. Assessment and Authorization (A&A)- A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) must work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s) within three (3) months after contract award. The Contractor must conduct the A&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

For an existing ATO, Contracting Officer Representative must make a determination if the existing ATO provides appropriate safeguards or if an additional ATO is required for the performance of the contract and state as such.

NIH acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

2. A&A Package Deliverables - The Contractor (and/or any subcontractor) must provide an A&A package within 90 calendar days of contract award to the CO and/or COR. The following A&A deliverables are required to complete the A&A package.

3. System Security Plan (SSP) - due within 90 calendar days after contract award.

The SSP must comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and NIH policies and other guidance. The SSP must be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP must provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor must update the SSP at least annually thereafter.

https://www.ecfr.gov/current/title-45/part-94

- 9 -

4. Security Assessment Plan/Report (SAP/SAR) - due 90 calendar days after the contract award. The security assessment must be conducted by the assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and NIH policies. The assessor will document the assessment results in the SAR.

The NIH should determine which security control baseline applies and then make a determination on the appropriateness/necessity of obtaining an independent assessment. Assessments of controls can be performed by Contractor, government, or third parties, with third party verification considered the strongest.

If independent assessment is required, include statement below.

Thereafter, the Contractor, in coordination with the NIH shall conduct/assist in the assessment of the security controls and update the SAR at least annually.

5. Independent Assessment - due 90 calendar days after the contract award. The Contractor (and/or subcontractor) must have an independent third-party validate the security and privacy controls in place for the system(s). The independent third party must review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The Contractor must address all "high" deficiencies before submitting the package to the Government for acceptance. All remaining deficiencies must be documented in a system Plan of Actions and Milestones (POA&M).

6. E-Authentication Questionnaire - The contractor (and/or any subcontractor) must collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E- Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods must follow OMB 04-04 and NIST SP 800-63, Rev. 2, Electronic Authentication Guidelines.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or subcontractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

7. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

● Confidentiality , which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

● Integrity , which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

● Availability , which means ensuring timely and reliable access to and use of information.

- 10 -

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less , bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements.

8. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

9. Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

10. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance mailto:fisma@hhs.gov

- 11 -with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

11. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at: https://ocio.nih.gov/aboutus/publicinfosecurity/ acquisition/Documents/Nondisclosure.pdf . A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

12. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)- The Contractor shall assist the NIH Office of the Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/ or information handled under this contract to determine whether or not a full PIA needs to be completed. The NIH PIA guide is located at https:// oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA %20Guide.pdf .

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within 60 calendar days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the NIH Office of the SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the

- 12 -system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. RULES OF BEHAVIOR

i. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and comply with the NIH Information Technology General Rules of Behavior https://www.hhs.gov/about/agencies/asa/ocio/ cybersecurity/security-awareness-training/index.html , which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov

ii. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed Rules of Behavior must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

C. INCIDENT RESPONSE

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative. FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies..

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cyber security and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as "a suspected or confirmed incident involving PII" .

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2. DO NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send NIH approved notifications to affected individuals individuals in accordance with https://wiki.ocio.nih.gov/wiki/index.php/ US-CERT_Federal_Incident_Notification_Guidelines .

3. Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT) via email at

NIDA Ref. No.: N01DA-23-8935 https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html http://irtsectraining.nih.gov/ https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines mailto:IRT@mail.nih.gov

- 13 -

IRT@mail.nih.gov , COR, CO, the NIH Office of the SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information HHS and NIH incident response policies when handling PII breaches.

5. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation within an hour of discovery.

D. POSITION SENSITIVITY DESIGNATIONSAll Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). To determine the designation, the Position Designation Tool (PDT) discussion is found at: https://www.ors.od.nih.gov/ser/dpsac/resources/ Pages/investigation-requirements-for-your-position.aspx and the link to access the tool is found at: https://pdt.nbis.mil/

The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Tier 5: Critical Sensitive and Special Sensitive National Security, including Top Secret, SCI, and "Q" access eligibility.

[ ] Tier 5SR: Reinvestigation.

[ ] Tier 4: High Risk Public Trust (HRPT).

[ ] Tier 4SR: Reinvestigation.

[ ] Tier 3: Non-Critical Sensitive, National Security, including Secret and "L" access eligibility.

[ ] Tier 3SR: Reinvestigation.

[ ] Tier 2S with Subject Interview: Moderate Risk Public Trust (MRPT).

[ ] Tier 2SR: Reinvestigation.

NIDA Ref. No.: N01DA-23-8935 mailto:IRT@mail.nih.gov https://www.ors.od.nih.gov/ser/dpsac/resources/Pages/investigation-requirements-for-your-position.aspx https://www.ors.od.nih.gov/ser/dpsac/resources/Pages/investigation-requirements-for-your-position.aspx https://pdt.nbis.mil/

- 14 -

[X] Tier 1: Low Risk, Non-Sensitive, including HSPD-12 Credentialing.

3. Multiple Principal Investigators Leadership Plan The Contractor must submit a revised/updated Leadership Plan in the event of a change in any of the Principal Investigators named in the Key Personnel Article in SECTION G of this contract. The revised plan is subject to review and approval by the Contracting Officer.

ARTICLE C.3. INVENTION REPORTING REQUIREMENT

All reports and documentation required by FAR Clause 52.227-11, Patent Rights-Ownership by the Contractor including, but not limited to, the invention disclosure report, the confirmatory license, and the Government support certification, shall be directed to the Division of Extramural Inventions and Technology Resources (DEITR), OPERA, OER, NIH, 6705 Rockledge Drive, Suite 310, MSC 7980, Bethesda, Maryland 20892-7980 (Telephone: 301-435-1986). In addition, one copy of an annual utilization report, and a copy of the final invention statement, shall be submitted to the Contracting Officer. The final invention statement (see FAR 27.303(b)(2)(ii)) shall be submitted to the Contracting Officer on the expiration date of the contract.

The annual utilization report shall be submitted in accordance with the DELIVERIES Article in SECTION F of this contract. The final invention statement (see FAR 27.303(b)(2)(ii)) shall be submitted on the expiration date of the contract. All reports shall be sent to the following address:

Contracting Officer National Institutes of Health Office of Acquisition

If no invention is disclosed or no activity has occurred on a previously disclosed invention during the applicable reporting period, a negative report shall be submitted to the Contracting Officer at the address listed above.

To assist contractors in complying with invention reporting requirements of the clause, the NIH has developed "Interagency Edison," an electronic invention reporting system. Use of Interagency Edison is required as it streamlines the reporting process and greatly reduces paperwork. Access to the system is through a secure interactive Web site to ensure that all information submitted is protected. Interagency Edison and information relating to the capabilities of the system can be obtained from the Web ( http://www.iedison.gov), or by contacting the Extramural Inventions and Technology Resources Branch, OPERA, NIH.

[REMAINDER OF PAGE LEFT BLANK INTENTIONALLY]

http://www.iedison.gov

- 15 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

[Remainder of Page Intentionally Left Blank]

- 16 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, Contracting Officer's Representative (COR) is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

National Institute on Drug Abuse National Institutes of Health c/o 3WFN MSC 6012 301 N Stonestreet Ave Bethesda, MD 20892

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 calendar days of receipt.

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-9, Inspection of Research and Development (Short Form) (April 1984).

- 17 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. ORDERING PERIOD

The ordering period of this contract shall be from 03/14/2023 through 03/13/2028.The period of performance shall be specified for any individual resultant task orders issued.

ARTICLE F.2. DELIVERIES

Satisfactory performance of the final contract shall be deemed to occur upon performance of the work described in the Statement of Work Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the following items in accordance with the stated delivery schedule:

a. The items specified below as described in the REPORTING REQUIREMENTS Article in SECTION C of this contract will be required to be delivered F.o.b. Destination as set forth in FAR 52.247-35, F.o.b. DESTINATION, WITHIN CONSIGNEES PREMISES (APRIL 1984), and in accordance with and by the date(s) specified below:

Item Description Quantity Delivery Sche Place of Delivery

(1) Individual Task Reports* 2 electronic reports per reporting period Within 15 business days of study completion

CO & COR (1

report ea)

(2) Draft Study Pro* 2 electronic reports per reporting period

Within 10 business days after a task order award

CO & COR (1

report each)

(3) Final Study Protocols* 2 electronic reports per reporting period

Within 3 business days after the comments by COR

CO & COR (1

report each)

(4) Draft Clinical Study Reports*

2 electronic reports per reporting period

Within 20 business days after a task order award

CO & COR (1

report each)

(5) Final Clinical Study Reports*

2…