RFP_75P00121R00013.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

PSC/FMP/AMS/SLC

SALT LAKE CITY UT 84111

4TH FLOOR

299 SOUTH MAIN STREET

PSC/FMP/AMS/SLC

CODE 16. ADMINISTERED BYCODE

X

X

541690

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORPSC/FMP/AMS/SLC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

12/23/2020 1400 ET

12/18/2020

385-285-7380DEBBIE HOPE

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

75P00121R00013

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 51 OS270128OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

SALT LAKE CITY UT 84111

4TH FLOOR

299 SOUTH MAIN STREET

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$16.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

PSC/FMP/AMS/SLC

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

TITLE: OASH Technical and Regulatory Reviews of Laboratory Developed Tests for

COVID-19

This is an urgent requirement for commercial services being procured under FAR Par 15 procedures and the flexibilities authorized under FAR Part 18 to support urgent COVID-19 pandemic public health activities and is authorized under the CARES Act.

This acquisition is sole source requirement to vendor:

NDA Partners LLC 40 Commerce Lane Suite D

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

DEBBIE L. HOPE

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Rochelle, VA 22738-4009

Technical and Regulatory Reviews of Laboratory

Developed Tests for COVID-19

Technical and Regulatory Reviews of Laboratory

Developed Tests for COVID-19

(Option Line Item)

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

51 2 of

75P00121R00013 TITLE: OASH Technical and Regulatory Reviews of Laboratory Developed Tests for COVID-19

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

This requirement is for the acquisition of contractor support staff to conduct reviews of laboratory developed test (LDT) protocols and provide technical expertise in support of expanding availability of diagnostic testing for COVID-19 in support of The Department of Health and Human Services (HHS), Office of the Assistant Secretary for Health (OASH).

B.2 TYPE OF CONTRACT

The contract type awarded: Time and Materials (T&M) / Labor Hour (LH)

B.3 SEVERABLE SERVICES

The services acquired under this contract are severable services. Funds are only available for use for the contract line item (CLIN) to which they are obligated. Unused funds from one CLIN may not rollover for use in other CLINs.

B.4 CONSIDERATION AND PAYMENT (T&M/LH – Severable Services)

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid in accordance with the fixed loaded hourly rates as shown herein for the specified categories of labor based on the number of actual hours incurred in the performance of the work specified. Fully loaded rates shall be all inclusive of direct labor, fringe benefits, applicable indirect costs, and any profit for each labor category. Additionally, the contractor shall be paid for materials and travel directly chargeable to this contract. If the options are exercised funding will be obligated by modification to the contract. The base period and option periods are priced as follows:

CLIN 1 - Base Period (6-months):

Labor Categories No. of

Positions Loaded Rates Estimated

Hours Estimated Total

Supervisory Regulatory Reviewer (Diagnostics)

1 1040

Senior Regulatory Reviewer (Diagnostics)

1 1040

Regulatory Reviewer (Diagnostics)

3 3120

Labor Subtotal $

CLIN Ceiling (Not to Exceed) $

CLIN 2 – Option Period 1 (3-months):

Labor Categories No. of

Positions Loaded Rates Estimated

Hours Estimated Total

Supervisory Regulatory Reviewer

1 520

Senior Regulatory Reviewer (Diagnostics)

1 520

Regulatory Reviewer

3 1560

Labor Subtotal $

CLIN Ceiling (Not to Exceed) $

TOTAL Potential Value inclusive of all CLINS: ________________________

B.5 CEILING PRICE

The hours and total price per labor category are for budgeting purposes only. The number of hours actually used for each category may exceed or be less than the estimate by category as long as the ceiling price for the CLIN is not exceeded. The ceiling for each CLIN is identified in Section B. The Government shall not be obligated to pay any amount in excess of this ceiling price nor is the Contractor obligated to continue performance if to do so would exceed this ceiling price. In the event that the Government chooses to exercise optional CLINS, unused funds from a previous CLIN may not be used to fund any services taking place in a subsequent CLIN. The ceiling price may be modified by the Government if it is determined that the estimated hours or estimated materials are insufficient for the work required.

B.6 ADDITIONS AND CHANGES TO LABOR CATEGORIES

It may be necessary to add or change labor categories during performance of this contract in order to carry out the services described in Section C. If new labor categories are added, or existing labor categories revised, the parties will negotiate the labor category(ies) prior to the incorporation into the contract. Any new labor rate proposed will be evaluated for reasonableness in accordance with FAR 15.4.

SECTION C - Description/Specifications/Statement of Work

TITLE: Technical and Regulatory Reviews of Laboratory Developed Tests for COVID-19

C.1 PROGRAM DESCRIPTION AND BACKGROUND

The novel coronavirus, C0VID-19, is a highly contagious pathogen that is responsible for the current pandemic which requires immediate deployment of critical public health assets to decrease transmission of the virus and to provide medical care for impacted communities. To address testing needs, C0VID-19 Community Based Testing sites (CBTS) were immediately stood up to provide drive thru testing capabilities with the goal of expanding testing capabilities.

CBTS are testing sites run and managed by states and private partners, including private laboratories, with support from the Federal government.

C.2 STATEMENT OF WORK - Severable Services

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified herein), and otherwise do all the things necessary for or incident to the performance of the work as set forth below:

HHS requires the use of experienced scientific/regulatory reviewers to facilitate a unified response to the C0VID-19 pandemic in terms of increasing efficacious testing capability in the U.S. The Contractor shall conduct technical reviews of laboratory developed tests (LDTs) for COVID-19, including tests that combine detection of COVID-19 with other respiratory pathogens, as instructed by the Assistant Secretary for Health, and provide a written assessment of those applications relative to a detailed set of metrics to meet the needs of HHS.

1.0 SCOPE

Rapid detection of COVID-19 cases requires wide availability of testing to control the emergence of this pandemic. While the uses of a laboratory developed test (LDT) are often the same as the uses of United States Food & Drug Administration (FDA)-cleared or approved in vitro diagnostic tests, some labs may choose to offer their own test. LDTs are important to the continued development of personalized medicine. It is critical that in vitro diagnostics are accurate so that patients and health care providers do not seek unnecessary treatments, delay needed treatments, or become exposed to inappropriate therapies. The Contractor shall conduct reviews of LDT protocols providing technical expertise in support of expanding availability of diagnostic testing for COVID-19.

2.0 APPLICABLE DOCUMENTS

2.1 The following documents form a part of this document to the extent specified herein:

• A review template will be generated and provided to contractor for use by contractor in conducting review of LTDs

3.0 REQUIREMENTS

3.1 General. The work required by this contract shall be performed in accordance with this Statement of Work (SOW).

3.1.1 Technical

3.1.1.1 The Contractor shall provide specialized technical and regulatory expertise in the development or evaluation of laboratory assays, specifically molecular assays and assays to detect antigens; Contractor shall assess assays using newly developed technologies.

3.1.1.2 The Contractor shall have regulatory experience, preferably with the FDA. Regulatory experience should include proficiency in assessing technologies, biologics, or drugs for emergency authorization, clearance, and approval.

3.1.1.3 The Contractor shall conduct technical and regulatory reviews of LTDs for COVID-19, including tests that combine detection of COVID-19 with other respiratory pathogens, as instructed by the Assistant Secretary for Health.

3.1.1.4 The Contractor shall provide technical and regulatory based written assessments of the LDT submissions based on a detailed set of metrics. The review will generally include assessment of the following, as indicated for each LDT:

• Type of diagnostic

• Intended use

• Instruments used, including platforms, extractions, and software

• Test steps and procedures

• Controls

• Limits of detection

• Cross reactivity

• Clinical as well as public health (e.g., for contagiousness) performance

3.1.1.5 The Contractor shall contribute suggestions on mechanisms to improve or modify LDT(s) to meet stated goals.

3.1.2 Program Management

3.1.2.1 The Contractor shall generate and deliver an initial, detailed schedule and plan of action displaying dates of and process for projected technical and regulatory reviews.

3.1.2.2 The Contractor shall conduct regularly scheduled meetings to provide updates to OASH, deliver program status, and adjudicate evaluation reviews.

3.1.2.3 The Contractor shall generate and deliver on a weekly basis a top-level status report with an incorporated tracker which provides percentage of completed technical and regulatory reviews.

3.1.2.4 The Contractor shall generate and deliver on a monthly basis a progress status report, including budget expenditures by task.

C.3 Information Security Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the

Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [X] Low [ ] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HHS non-disclosure agreement, as applicable. A copy of each signed and witnessed shall be submitted to the Contracting Officer (CO) and/or CO

Representative (COR) prior to performing any work under this acquisition, reference Attachment J.1.

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with FIPS 140-2.

The Contractor shall provide a written copy of the validation documentation to the COR and ISSO within 30 days of contract award.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the

CDC SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M- 03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC specific Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and any CDC-specific rules, as applicable.

2) All Contractor employees performing on the contract must read and adhere to the Rules of

Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Information Security

Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/CDC CSIRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies... The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send CDC approved notifications to affected individuals following CDC’s designated process.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the CDC’s Computer Security Incident Response Team (CSIRT) [CSIRT@CDC.gov], COR, CO, CDC SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one

(1) hour, and consistent with the applicable CDC and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail;

and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information HHS incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

F. Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. For additional information, see HSPD-12 policy at:

https://www.dhs.gov/homeland-security-presidential-directive-12)

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within the CDC Specified timeline of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

G. Contract Initiation and Expiration https://www.dhs.gov/homeland-security-presidential-directive-12

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the CDC EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012). CDC EPLC requirements may be located here:

https://www2a.CDC.gov/CDCup/library/other/eplc.htm.

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 7 days before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR.

Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or CDC policies.

6) The Contractor (and/or any subcontractor) shall perform and document the actions identified in the CDC Contractor Employee Separation Checklist when an employee terminates work under this contract within 7 days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

H. Records Management and Retention

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/CDC policies and shall not dispose of any records unless authorized by HHS/CDC.

https://www2a.cdc.gov/cdcup/library/other/eplc.htm

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/CDC policies.

The contractor shall follow all HHS security requirements as defined by HHS/OASH to perform the work specified herein, contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems.

The Government anticipates the position sensitivity under this effort to be Level 5 – Public Trust; but sensitivity levels cannot be ascertained definitively until after contract award.

To gain the required access and successful award, the contractor shall comply with Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, and with the personal identity verification and investigation procedures contained in:

• HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P) – copy can be obtained by emailing fisma@hhs.gov

• HHS Continued Implementation for the HSPD-12 Program, dated January 13, 2017

• OPM Final Credentialing Standard, dated June 2008

• OMB M-05-24, dated August 5, 2005, Implementation of Homeland Security

Presidential Directive (HSPD) 12 --Policy for a Common Identification Standard for Federal Employees and Contractors

• Executive Order 13467

• 5 CFR Part 1400.201

The minimum Government investigation to receive an HSPD-12 PIV Credential is a Tier 1 (NACI), which consists of searches of records covering specific areas of a person’s background during the past five years. The minimum Government investigation to receive Elevated Privilege (any access beyond normal email or data entry) is a Tier 4 (BI High Risk Public Trust).

The contractor must comply with the instructions and timeframes provided by the Contracting Officer’s Representative (COR) regarding the handling of the security requirements specified in this section. Typically, each employee must submit at a minimum: a completed OF-306; a current resume; and a completed HHS 828 form. Additional requirements may apply to Foreign National Applicants who will follow a slightly different level of initial checks. No contractor may begin any work or obtain any access to HHS facilities, information or information systems unless and until codified credentialing standards are met, and the Office of Security and Strategic Information informs the COR initial security requirements are complete or HSPD12 badges have been issued, whichever occurs first. Contractors should ensure that the employees whose names they submit have a reasonable chance for access approval. In some cases, employees with existing background investigations commensurate with sensitivity designations will expedite performance. Delays associated with rejections and consequent reinvestigations may not be excusable. Investigations may delay performance, regardless of the outcome of the investigation. The facts surrounding individual cases will determine whether a delay is excusable.

SECTION D - Packaging and Marking

D.1 PACKAGING AND MARKING

All deliverables shall be delivered to the Contracting Officer’s Representative (COR) identified in Section G and shall be marked as follows:

1. Name and address of the Contractor;

2. Contract Number;

3. Description of item contained therein; and

4. Consignee's name and address.

D.2 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information including forms, reports, etc. to the Contracting Officer or COR shall be paid by the Contractor.

SECTION E - Inspection and Acceptance

E.1 INSPECTION AND ACCEPTANCE

Pursuant to FAR clause 52.246-6, all work described in Section C to be delivered under this contract is subject to final inspection and acceptance by an authorized representative of the Government. The authorized representative of the Government is the Contracting Officer’s Representative (COR), who is responsible for inspection and acceptance of all services, materials, or supplies to be provided by the Contractor.

E.1.1 Inspection and Acceptance Criteria Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the place of delivery by the COR.

E.1.2 General Acceptance Criteria General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Statement of Work.

• Accuracy - Work Products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity - Work Products shall be clear and concise. Any/all diagrams shall be easy to understand and be relevant to the supporting narrative.

• Consistency to Requirements - All work products must satisfy the requirements of this

Statement of Work.

• File Editing - All text and diagrammatic files shall be editable by the Government.

• Format - Work Products shall be submitted in hard copy and electronic copy. The electronic copy must be in a format as indicated in the Deliverables Table.

SECTION F - Deliveries or Performance

F.1 PERIOD OF PERFORMANCE – Severable Services

The period of performance shall be for a base period of 6-months with one (1) 3-month option period, as follows:

Base Period: TBD based on date of award Option Period 1: TBD based on date of award

Option periods may be exercised in accordance with FAR Clause 52.217-9 entitled "Option to Extend the Term of the Contract."

F.2 PLACE OF PERFORMANCE

Work will be performed at the Contractor’s primary place of performance at: 330 C Street SW, Suite 2200, Washington DC 20024, but the contractor is not prohibited from allowing its employees to telework in accordance with the contractor’s policies if the work and required level of performance can be completed successfully in accordance with the contract requirements. The Contractor shall coordinate employee telework in advance with the Contracting Officer’s Representative.

F.3 DELIVERABLES AND DELIVERY SCHEDULE

The contractor shall submit all required report(s)/deliverables in accordance with the following schedule: All reports shall reference and cite the contract number.

All documents will be in contractor format. The following are the Contractor list of contract deliverables for this effort:

Contract Deliverable PWS Section Date(s) of Submission Method of Delivery

Detailed schedule displaying dates of projected technical reviews.

3.1.2.1 10 days post kickoff meeting

Format agreed upon by OASH

Plan of action/process for conducting technical

3.1.2.1 10 days post kickoff Format agreed evaluations. meeting upon by OASH

Written assessment of LTD technical evaluation.

3.1.1.4 To be submitted upon

completion of each LDT technical review

Format agreed upon by OASH

Status and tracking reports of completed LTD technical reviews.

3.1.2.3 Weekly; submit at a pre-

determined regularly scheduled date

Format agreed upon by OASH

Progress report including budget expenditures by task.

3.1.2.4 15th of each month Format agreed upon by OASH

Identification of LTD improvements/modifications.

3.1.1.5 As soon as identified Format agreed

upon by OASH

F.4 DELIVERY REQUIREMENTS

Pickup and delivery of items under this contract shall be accomplished between the hours of 8:00 a.m. and 4:00 p.m. eastern time (ET), Monday through Friday or as otherwise designated by the COR. No deliveries shall be made on Saturdays, Sundays, and days of government closure or Federal legal holidays found at: http://www.opm.gov/operating_status_schedules.

SECTION G - Contract Administration Data

G.1 AUTHORITIES OF GOVERNMENT PERSONNEL

Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of this contract will require maximum coordination between the Government and the Contractor. The following individuals will be the Government's points of contact during the performance of this contract:

Contracting Officer Name: Debbie Hope Address: 299 South Main Street, 4th Floor Salt Lake City, UT 84111 Phone: (202) 934-4178 Email: Debbie.Hope@psc.hhs.gov

All communications pertaining to contractual and/or administrative matters under this contract shall be sent to:

Contract Specialist mailto:Debbie.Hope@psc.hhs.gov

Name: Debbie Hope Address: 299 South Main Street, 4th Floor Salt Lake City, UT 84111 Phone: (202) 934-4178 Email: Debbie.Hope@psc.hhs.gov

Contracting Officer's Representative Name: TBD Address: TBD Phone: TBD Email: TBD

Note: The Contracting Officer is the only individual authorized to modify the contract.

G.2 CONTRACTING OFFICER'S REPRESENTATIVE (COR) AUTHORITY

(a) Performance of work under this contract must be subject to the technical direction of the Contracting Officer's Representative identified above, or a representative designated in writing.

The term "technical direction" includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(b) Technical direction must be within the scope of the specification(s)/work statement.

The Contracting Officer's Representative does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

(2) Constitutes a change as defined in the clause entitled "Changes";

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The Contracting Officer's Representative shall confirm oral direction in writing within five work days, with a copy to the Contracting Officer.

(d) The contractor shall proceed promptly with performance resulting from the technical direction issued by the Contracting Officers, Representative. If, in the opinion of the contractor, any direction of the Contracting Officers, Representative, or his/her designee, falls within the limitations in (b), above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled "Disputes."

G.3 INVOICES - NONCOMMERCIAL (MAR 2020)

(1) Invoice Submission

The contractor shall submit invoices under this contract once per month. Invoices shall be submitted in accordance with the contract terms.

A proper invoice, with all required back-up documentation shall be sent electronically, via email, to:

1) Contracting Officer's Representative (COR): insert COR email address

2) Contracting Officer: Debbie.Hope@psc.hhs.gov

3) Contract Specialist: Debbie.Hope@psc.hhs.gov

4) Financial Management Services: psc_invoices@psc.hhs.gov

5) Acquisition Management Services: pscsas.invoices@psc.hhs.gov

The subject line of the invoice submission email shall contain the contract number, order number (if applicable), and the number of invoices contained within. Each invoice shall be submitted as a single file, limited in size to 25MB, which includes all required back-up documentation based on the contract type. In the event an invoice file exceeds the size limitation, the contractor shall contact the Contracting Officer to provide the supporting documentation. The email may have multiple invoices for the contract. Invoices must be in the following formats: PDF, TIFF, or Word. No Excel formats will be accepted. The electronic file cannot contain multiple invoices; example, 10 invoices requires 10 separate files.

(2) Invoice Elements

Invoices must include the items specified in FAR 52.232-25(a)(3), even if the Alternate I of the clause and FAR 52.216-7 applies. Additionally, the Program Support Center (PSC) requires:

(i) Invoices must break-out price/cost by contract line item number (CLIN) as specified in the pricing section of the contract.

mailto:psc_invoices@psc.hhs.gov mailto:pscsas.invoices@psc.hhs.gov

(ii) Invoices must include the Dun & Bradstreet Number (DUNS) of the Contractor.

(iii) Invoices that include time and materials or labor hours CLINS must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred.

(iv) Invoices that include cost-reimbursement CLINs must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

• Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

• Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

• Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

• Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

• Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

• Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

• Fee – amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

(3) Prompt Payment Act

Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR Part 1315.

SECTION H - Special Contract Requirements

H.1 PRIORITIES AND ALLOCATIONS

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A—Health Resources Priorities and Allocations System.

H.2 PROHIBITION AGAINST PERSONAL SERVICES

The Contractor shall not perform personal services under this contract. Contractor personnel are employees of the Contractor or its subcontractors and are under the administrative control and supervision of the Contractor. A Contractor supervisor must give all individual Contractor employee assignments and daily work direction. The Government will not supervise or direct Contractor employees in the performance of their assignments. If at any time the Contractor believes that any Government action or communication has been given that would create a personal service relationship between the Government and any Contractor employee, the contractor shall promptly notify the Contracting Officer of this communication or action.