RFP_ATTACHMENTS_75N94022R00011.pdf

RFP 75N94022R00011

NIAAA Alcohol Policy Information System

PACKAGING AND DELIVERY OF PROPOSAL ATTACHMENT 1

March 12, 2018 Page 1 of 2

Attachment 1 - Packaging and Delivery of Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website

I. PROPOSAL SUBMISSION

A. eCPS

1. Proposals must be submitted via the electronic Contract Proposal Submission (eCPS) website at https://ecps.nih.gov.

2. Proposals submitted by facsimile or e-mail will not be accepted.

3. Follow the “How to Submit an Electronic Proposal” instructions provided on the eCPS website at: https://ecps.nih.gov/home/howto. Please note that creating an account to submit may take up to three (3) business days. Please apply for a new account early to allow enough time for the registration process.

4. Offerors are solely responsible for submitting proposals and any modifications or revisions so as to reach the Government office designated above by the date and time specified in the solicitation. If your proposal is not received by the date and time specified in the solicitation, it will be considered a “late proposal,” in accordance with FAR Clause 52.215-1 Instructions to Offerors – Competitive Acquisition.

B. Creating and Naming Files:

1. Create one PDF file of your Technical Proposal, including all attachments. The

Technical Proposal should be created in a PDF format that enables word searches to the maximum extent practicable. Forms and/or documents requiring signature(s) may be scanned, but must be merged into the Technical Proposal PDF file.

2. Create one PDF file of your Business Proposal, including all attachments:

The Business Proposal should be created in a PDF format that enables word searches to the maximum extent practicable. Forms and/or documents requiring signature(s) may be scanned, but must be merged into the Business Proposal PDF file.

Additionally, the “Breakdown of Proposed Estimated Costs (plus Fee) with Excel Spreadsheet” (http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx) must be included in the Business Proposal.

3. Create your Business Document Excel. The Excel file should be the “Breakdown of Proposed Estimated Costs (plus Fee) with Excel Spreadsheet” (http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx) included in the Business Proposal in its original Excel format, not PDF. Multiple Excel files may be included, as necessary.

https://ecps.nih.gov/ https://ecps.nih.gov/home/howto http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx http://oamp.od.nih.gov/sites/default/files/DGS/contracting-forms/spshexcl_dec2012.xlsx

PACKAGING AND DELIVERY OF PROPOSAL ATTACHMENT 1

March 12, 2018 Page 2 of 2

4. Each of the proposals, Technical and Business, must be separate and complete in itself.

Do not reference one proposal in another.

5. File naming convention: It is requested that the filenames for your Technical Proposal, Business Proposal, and Excel Workbook include the name of the offeror, the solicitation number and the type of proposal (i.e., Technical, Business, or Excel Workbook).

Examples:

Technical Proposal: XYZ Company_NIHAI2012001_Technical.pdf Business Proposal: XYZ Company_NIHAI2012001_Business.pdf Excel Workbook: XYZ Company_NIHAI2012001_Business.xlsx

II. FORMATTING:

Formatting for proposals

Proposal page layout shall be letter size 8.5” x 11" for all pages.

1. Proposals shall not include links to internet web site addresses (URLs) or otherwise direct readers to alternate sources of information.

2. Proposals shall not include audio or video files of any type.

3. Font size must be 10 to 12 points.

4. Spacing should be no more than 15 characters per inch. Within a vertical inch, there must be no more than six lines of text.

5. Margins must be at least one-inch on all sides.

6. Failure to adhere to the formatting requirements above may impact whether your proposal is reviewed in its entirety.

PROPOSAL INTENT RESPONSE FORM

RFP No:

RFP Title:

Please review the Request for Proposal (RFP). Furnish the information requested below and return this page to the Contracting Officer/Contract Specialist identified on Section A-Solicitation/Contract Form by

Your expression of intent is not binding but will greatly assist us in planning for proposal evaluation.

Choose one of the following Options:

Do intend to submit a proposal Do Not intend to submit a proposal

If you are not responding to this RFP, please provide your reason(s):

Please provide the following contact information:

Name (First, Middle Initial, Last):

Title:

Organization:

E-mail:

ATTACHMENT 3

March 22, 2022

STATEMENT OF WORK

ALCOHOL POLICY INFORMATION SYSTEM (APIS)

I. BACKGROUND AND INTRODUCTION

Public policies can affect alcohol consumption, cannabis consumption, and related behaviors, which can influence a range of health and social outcomes. Advancing scientific research on the effects and effectiveness of various alcohol and cannabis policies depends on well-measured indicators of these policies. Research in this important area has been constrained by limitations on the availability and quality of policy information. Reliable information on public policies relating to alcohol and cannabis must reflect the nuances and complexity of these policies. Laws, regulations, and jurisprudence address myriad aspects of alcoholic beverage and cannabis production, packaging, transportation, marketing, taxation, sales, and consumption, as well as the financing and delivery of substance abuse treatment and preventive services. In the United States, policies addressing these issues are established at all levels of government (Federal, State, county, and municipal).

The National Institute on Alcohol Abuse and Alcoholism (NIAAA) awarded the original contract to The CDM Group, under contract number HHSN275201300002C, in September 2001 to provide authoritative, detailed, and comparable information on alcohol-related public policies in the United States at both the State and Federal levels.

The Alcohol Policy Information System (APIS) web site (http://alcoholpolicy.niaaa.nih.gov) is an online resource that provides public access to detailed information on a variety of alcohol and cannabis public policies. Intended primarily as a tool for researchers, APIS features compilations and analyses of alcohol and cannabis statutes and regulations. APIS is designed to simplify the process of ascertaining the state of the law for studies of the effects and effectiveness of alcohol and cannabis policies.

APIS currently provides annually updated information on 41 specific policy topics in a standardized format, including summary descriptions, detailed comparison tables, and maps and charts. For each policy change, APIS documents the exact date(s) on which provisions became or ceased to be effective. For most policy topics, APIS coverage begins January 1, 1998 and extends through the endpoint established at the latest update.

Detailed information is available through the APIS web site.

APIS inaugurated its public web site in June 2003. Since that time, it has been updated numerous times to add new policy topics, update information on policy topics previously covered, add new features and capabilities, and clarify or correct previously published http://alcoholpolicy.niaaa.nih.gov/ information. A recent major addition to the site is coverage of state alcohol-related policies adopted in response to the COVID-19 pandemic, documented through a Digest and accompanying dataset and available at https://alcoholpolicy.niaaa.nih.gov/resource/covid-19/98. A complete list of changes to the site is available through the Change Log link on the APIS web site home page.

II. SCOPE

The purpose of this contract is to provide for operation, maintenance, and further development of the Alcohol Policy Information System.

III. TECHNICAL REQUIREMENTS

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities not otherwise provided by the Government, as needed to perform the work set forth below.

The Contractor shall operate, maintain, and, as requested by the Contracting Officer’s Technical Representative (COR) and approved by the Contracting Officer (CO), modify the Alcohol Policy Information System (APIS) to deliver detailed, reliable, and timely information on alcohol and cannabis policies1 adopted by the Government of the United States and by the governments of the various States and the District of Columbia.

The Contractor shall provide a full range of services necessary to operate, maintain, and update the system. These services include but are not limited to:

a) Provide accurate and detailed information on alcohol and cannabis policies suitable for use in public health-related research through the APIS web site.

b) Identify and acquire accurate and detailed information on alcohol and cannabis policies adopted at the Federal and State levels through appropriate electronic resources;

c) Describe alcohol and cannabis policies at several levels of detail, including descriptive overviews and detailed characterizations of specific policy provisions (including the specific dates on which such provisions became or ceased to be effective);

1 Here and throughout this document, “policies” refers to legal definitions, authorities, requirements, and restrictions, primarily those adopted through legislation and regulation, but also including in some limited instances, executive orders, court decisions, administrative rules, etc.

https://alcoholpolicy.niaaa.nih.gov/resource/covid-19/98

d) Store the policy information, including all related descriptions, keywords, indicators, and variables, in an electronic system that permits search and retrieval of policy information by a variety of flexible criteria;

e) Operate and maintain the APIS web site, ensuring that it: (1) conforms to all relevant

Federal, DHHS, and NIH regulations and requirements, including those pertaining to accessibility, privacy, application security, and the 21st Century Integrated Digital Experience Act (IDEA); (2) provides introductory information about alcohol and cannabis policy and about APIS; (3) provides user-friendly access to summary policy information; (4) permits users to search APIS for detailed policy information according to various criteria; (5) generates search results in suitable display formats (e.g., tables, graphs, maps, etc.); (6) provides users with the ability to download policy information in formats conducive to use in quantitative and statistical analysis;

and (7) provides access to other policy-related information generated or maintained by APIS.

f) Assess potential policy topics for development as APIS information; develop, test, and evaluate prototype features for use on the APIS web site; document procedures for performing the various activities of this project; and provide technical assistance to scientists and other users of APIS information.

g) Implement and employ quality assurance procedures to ensure the utility, reliability, and integrity of the system and its various components.

h) Participate in monthly meetings between the Project Director and the Contracting

Officer's Representative (COR) to monitor progress, address issues and concerns as may arise, and plan upcoming work to be accomplished. These meetings will be held by telephone (or in person or by video conference at the discretion of the COR).

Other government or contract staff members or consultants may be asked to participate as appropriate. Provide a written agenda at least two business days in advance of each monthly meeting, and provide a written summary of the discussion, decisions, and action items from the meeting within three business days following each meeting.

i) Decisions affecting the design, structure, or operation of APIS or the performance of the various contract activities shall be recommended to the COR and approved by the CO in writing prior to implementation. For any such decision, the Project Director shall submit a decision memorandum addressed to the CO and COR that, at a minimum: (1) summarizes the issue under consideration; (2) identifies one or more feasible alternatives and summarizes their advantages and disadvantages, including associated costs; (3) recommends a specific decision; (4) justifies the recommendation in light of the alternatives; and (5) requests approval by the CO and concurrence by the COR.

j) Develop, implement, and execute a quality assurance plan that shall be incorporated as an integral part of the performance of this contract and as a component of each activity performed under the contract.

The Contractor shall perform the activities described below.

Activity 1– Maintain, operate, and further develop the APIS web site. Under the direction of the NIAAA COR, the contractor shall actively manage the APIS web site and associated information repositories. This activity will encompass:

a) Maintain the APIS web site:

(1) Respond to and resolve any technical issues with the APIS web site code.

(2) Maintain all required site certifications, including renewal of SSL Certificates for sites hosted on FedRAMP Amazon Web Services (“AWS”).

(3) Provide software development (Dev) and IT operations (Ops) services for the NIAAA

APIS web site.

(4) Under the guidance of NIAAA for change management, perform regularly scheduled code deployments to dev, stage, and production environments monthly. Perform ad-hoc code deployments with permission from the NIAAA COR.

(5) Monitor for core and module Drupal updates, as well as related PHP and database components that need to be deployed for NIAAA web sites.

(6) Implement secure login for administrators of the AWS infrastructure and all web sites in the supporting infrastructure to include 2-factor authentication and IP restrictions.

(7) Create tickets and work with AWS to resolve infrastructure and environment issues.

(8) Anticipate and communicate potential complications before they happen, particularly with respect to quality assurance, troubleshooting, and security.

b) Ensure and document that all electronic information system components conform to all applicable Federal, DHHS, and NIH regulations and requirements regarding operation of public web sites, including but not limited to Section 508 of the Rehabilitation Act, the Privacy Act, and National Institutes of Health Information Security Program Policy.

c) Procure and maintain FedRAMP authorized cloud infrastructure for hosting the system on which the APIS web site and underlying information systems and repositories reside. The current web site IaaS hosting provider may not be changed without NIAAA COR permission and not before a new Federal Information Security

Management Act (“FISMA”) Authority to Operate is issued by NIAAA (as described elsewhere in appended contract clauses).

d) Monitor the extent, intensity, and characteristics of use of the APIS web site and its main components. Report on usage in regular quarterly written reports.

e) Develop an IT security plan to ensure that: (1) the information in APIS shall be stored securely; (2) access to the information will be available with only limited, short-term interruptions for maintenance and updating; (3) access to any preliminary, confidential, or proprietary information stored on the system will be restricted to authorized individuals; and (4) the content and functionality of the system can be completely restored in the event of an unforeseen or catastrophic failure of system operation, maintenance, or security. Maintain complete and continuous system documentation and communications with the NIAAA Information Systems Security Officer (ISSO) and other NIAAA and NIH staff to ensure complete and timely compliance with all requirements. Take additional preventive or remedial measures as necessary to ensure the security and integrity of the system.

f) Prevent, minimize, manage, communicate, and remediate software vulnerability

(1) Maintain continuous awareness through the use of newsfeeds, subscriptions to vendor mailing lists, and other research for all software security vulnerabilities for all components of the web sites for which the contractor is responsible.

(2) Notify the NIAAA COR and any other NIAAA designated personnel of new security vulnerabilities, whether they are applicable to all NIAAA’s web sites maintained by the contractor under this contract and make recommendations regarding risk and timing of updates. From the point of design inception and throughout the application lifecycle, utilize best practices for web site and database security, as recommended by leading subject matter experts, including CIS Baselines, the Open Web Application Security Project (OWASP), Drupal.org, SSLLAbs, and applicable Binding Operational Directives found at https://cyber.dhs.gov/bod.

(3) Promptly respond to requests for remediation of any web site vulnerabilities identified by NIH vulnerability scanning tools, within requested deadlines.

g) Provide maintenance, testing, and, as necessary, web site design, revision, and repair for the APIS web site. Ensure that existing functionality incorporated in the design of the APIS web site operates as intended, and that links (both internal and external) are operational and connect to the intended web pages. As directed, recommend methods and approaches to resolve problems, revise features and functionality, and incorporate new features or functionality to advance the general objectives of APIS in providing timely and reliable information to facilitate research on alcohol and cannabis public policies.

https://cyber.dhs.gov/bod

h) Once during the contract period, a comprehensive web site re-design plan shall be developed, submitted for COR review and CO approval, and implemented to improve the features, usability, and functionality of the web site. The re-design plan should include, but not be limited to o Greater consistency in the display and presentation between cannabis policy information and alcohol policy information;

o Maps and charts that provide users with the ability to select specific policy attributes and time periods to display;

o Profiles of individual state policy environments, such that users can choose all or selected policy topics and policy variables (not including policies adopted specifically in response to the COVID-19 pandemic and covered in the COVID- 19 section of the APIS web site); and o Various usability enhancements, including issues identified in the Stakeholder interviews conducted in 2021.

Planning for the re-design should begin in the first year of the contract, and the full re-design should be fully implemented by the end of the second year of the contract.

i) Provide and perform quality assurance procedures to ensure and document that: (1) hardware and software are functioning properly in storing policy information; (2) search capabilities are effective in identifying and retrieving appropriate information;

(3) backup and security procedures are adequate to ensure the integrity of the information stored and near-continuous availability of the information; (4) facilities provided on the web site function as intended; (5) information and links provided on the web site remain up-to-date; and (6) other needs served by this Activity are met.

Activity 2 – Perform legal research and all related documentation to maintain and update policy and related information provided through the APIS web site.

a) Maintain, renew, or establish, as appropriate, all subscription, contractual, and/or other arrangements necessary to obtain accurate and timely information on alcohol and cannabis public policies to facilitate the legal work specified in this Activity.

b) Perform the full range of activities needed to update all APIS policy topics.

Updating must encompass all research, coding, documentation, excerpting, quality assurance, and other steps culminating with posting updated information on the APIS web site. Updating shall be done annually. The updating shall produce information that: (1) is complete, detailed, and absolutely accurate; (2) correctly reflects the policy content of relevant statutes and regulations; (3) supports valid policy comparisons, both across jurisdictions and over time; (4) is presented in a manner understandable to the intended audience of researchers; (5) uses consistent categories across jurisdictions and across time; (6) is reliable across coders; (7) can be replicated by independent observers; and (8) is clearly and completely documented.

c) As recommended by the COR and approved by the CO, propose, develop, and publish new indicators, measures, and variables to characterize policy status and/or policy change across jurisdictions and/or over time. Indicators, measures, and variables shall meet scientific standards for reliability and validity and be designed to support further advances in research on the effects and effectiveness of policies relating to alcohol and/or recreational use of cannabis

d) Implement quality assurance procedures and document in a report on a quarterly basis that: (1) policy status assessment is accurate and complete; (2) identification of policy changes is accurate and complete; (3) summary descriptions and related information materials fully and accurately reflect relevant policy content; (4) indicators, measures, and variables are constructed to standards of accuracy and reliability that meet scientific standards for reliability and validity, that permit valid policy comparisons, both across jurisdictions and over time, and that support valid inferences drawn from scientific and statistical analyses that rely on them; (5) methods used to construct indicators, measures, and variables are appropriate to the data used in their construction; (6) information and methods used to construct indicators, measures, and variables are documented in sufficient detail to permit someone not involved in their construction to replicate them; (7) documentation of indicators, measures, and variables provided through the web site is clear, complete, and understandable to the intended audience of researchers; and (8) other needs served by this activity are met.

Activity 3 – Expand policy coverage in at least two new areas. This may include new policy topics or topic areas or other expansions of APIS’s coverage. (The most recent such expansions were (1) addition of the Pregnancy and Drugs section and concomitant expansion of the Pregnancy and Alcohol topics to encompass policies in effect beginning January 1, 1968; and (2) creation of the COVID-19 section of the APIS web site, including the Digest, the Dataset, and the Codebook.) Decisions on actual areas for expanded coverage have not been made, and alternate topics, including topics proposed by the contractor, will be considered. To support well-considered decisions on coverage expansions, the contractor shall

a) Provide written assessments, as directed, of potential new policy topics or areas for expansion of APIS coverage for possible development and inclusion in the APIS web site. Assessments must address, but need not be limited to, the following criteria that will serve as primary considerations in decisions of whether to pursue specific expansions of the policy information provided through APIS.

Criterion 1. The public health significance of the expanded policy information i.e., whether the candidate policy has the potential to affect health and/or well-being at the population or relevant sub-population level.

Criterion 2. The relevance of the expanded policy information to researchers. This criterion assesses whether the expanded policy information is likely to be used and useful in public health-related research. Other considerations may apply, including the availability of funding and the existence of recent or ongoing research in the area.

Criterion 3. The expanded policy information involves an area of current, recent, or expected policy change in the U.S.

Criterion 4. Legal research on the policy across the jurisdictions covered by APIS is feasible within budgetary constraints. In general, feasibility of legal research means that precise, operational definitions of key terms used in statutes and regulations exist or can be developed; statutory and regulatory provisions are located within a limited number of sections of State codes and covered by a limited number of statutes/regulations; valid comparisons across states and over time are supported, i.e., factors outside the scope of the documented legal provisions play a small role in understanding the actual variation in policy across jurisdictions and over time; and case law is of limited importance in interpreting statutory/regulatory provisions.

Criterion 5. Inclusion of the expanded policy information adds value to the overall

APIS portfolio. The policy information contributes to APIS’s overall coverage in a manner that reflects the major topics of interest to the investigators engaged in alcohol policy research.

In addition to the above criteria, written assessments shall also: (1) assess the need and scope for expert consultation that may be required in development; (2) identify extant sources of information on the proposed policy topic, and provide summary evaluation of the utility of information available through these sources for researchers and for APIS quality assurance procedures; (3) identify any factors that limit historical coverage of the topic for the period beginning January 1, 1998 through the latest available information; (4) describe a preliminary proposed set of policy elements (“indicators, measures, and variables”) to be coded for presentation through the APIS web site; (5) estimate the labor (by category) required to carry development of the new policy topic to completion, up to and including publication on the APIS web site; and (6) include a recommendation as to whether the proposed policy topic is suitable for inclusion and, if so, whether it should be considered a high-, medium-, or low-priority candidate for development and inclusion as an APIS policy topic, and a summary of the rationale for the recommendation.

b) With approval of the CO, develop the expanded policy information and post it to the

APIS web site. Development shall encompass the full range of tasks necessary to prepare the new information for posting on the APIS web site, including but not limited to: (1) background research to identify key policy attributes and principal alternatives in research and documentation; (2) identification and documentation of relevant Federal law; (3) consultation with subject matter experts as appropriate; (4) initial specification of variables; (5) primary research to document all variable values and associated effective dates for every State for the entire period of coverage; (6) adjustment of preliminary variable specifications to accommodate findings of primary research; (7) initial specification of data display characteristics; (8) drafting of descriptive “surround” materials for the web presentation; (9) identification and documentation of special circumstances requiring treatment through notes in the tables; (10) initial specification of maps and charts characteristics; subsequent revision (possibly repeated) of all materials in response to results of review and quality assurance procedures; (11) posting to the staging server for testing; and (12) final posting to the public APIS web site. Provide updates regarding progress on development to the COR during monthly meetings and in regular quarterly written progress reports.

Activity 4 – Document all procedures employed in operating APIS to: (1) ensure that the process by which each information item was identified, acquired, processed, and incorporated into APIS can be completely understood; (2) maintain a historical record of procedures and changes in procedures used in operating APIS; and (3) provide an up-to-date and transparent description of procedures that can facilitate training and serve as a reference for the COR, CO, and project staff members in resolving detailed questions. Maintain the documentation in a web-based archive accessible by project staff, the COR, the CO, and others as requested by NIAAA. This archive shall:

a) Document procedures used in all aspects of policy information identification, acquisition, classification, summarization, updating synthesis, analysis, new policy topic development, and other aspects of information processing. This includes documentation that describes changes in procedures, including the dates on which changes were implemented and a summary of the rationale for each change.

b) Document procedures used in all aspects of information security, handling, storage, retrieval, delivery, display, and web site operation and procedures pertaining to selection of changes in computer hardware and software and in web site design and functionality. This includes documentation that describes changes in procedures, including the dates on which changes were implemented, a summary of the rationale for each change, and documentation of the approvals requested and received for each change.

Activity 5 – Conduct an independent assessment to identify potential improvements that would enhance the value and usefulness of APIS, including but not limited to content, organization, functionality, ease of use, and ease of navigation of the APIS web site. The contractor shall provide independent experts with experience in web site design and familiar with health-related policy research to perform the review and engage input from users and potential users of the site. The primary goal shall be to improve the value and usefulness of APIS to researchers, although the needs of other APIS user audiences should also be considered to the extent that these do not compromise the needs of researcher users. Provide a written report summarizing the findings of the assessment. The assessment should be conducted and completed during the fourth year of the contract.

Activity 6 – Develop and prepare information and research products to increase use of and interest in the policy information provided through APIS.

a) As directed, generate analyses of current issues in alcohol policy affecting public health.

Propose specific research topics for review and recommendation by COR and approval by CO. Over the course of the contract, prepare and submit two manuscripts for publication.

Analyses and manuscripts may address, but are not necessarily limited to, legal analysis of policy-related factors affecting alcohol-related behaviors and outcomes, novel measures of policy status, or analysis of effects or effectiveness of under-studied policies covered in

APIS.

b) Prepare posters and/or oral presentations for scientific and/or policy-related conferences where audiences would value the information presented through APIS, and deliver the oral or poster presentations at those conferences. Propose specific poster/presentation topics or issues for review and recommendation by COR and approval by CO. Over the course of the contract, prepare and submit three conference presentations.

c) Create and maintain a bibliographic listing of publications citing or making use of information provided by APIS. Distinguish between sources that simply refer to APIS as an information source and those that make use of policy information provided by APIS.

Activity 7 – Within the final 60-90 days of the Contractor’s period of performance, the Contractor shall submit a plan for a transition from the existing contract to the Government or to a successor contractor (Successor). The transition plan will be designed to facilitate and ensure the smooth continuation of APIS operations and performance of the various contract activities by a successor organization. The plan shall provide for delivery of appropriate contract materials, data, databases, files, documentation, graphics, working papers, and for the continuation of on-going work assignments. The Contractor shall develop this plan in collaboration with the COR.

Two (2) months prior to the expiration date of the awarded contract, in coordination with the COR and/or CO and in cooperation with the Successor, the Contractor shall begin to perform the transition activities of the APIS. During the transition period the contractor shall provide consultation and other services as described below and further services as may be necessary to ensure the smooth continuation of APIS operations and performance of the various contract activities by the successor. During the transition period, the Contractor shall:

a) Participate in the formal transfer of contract responsibilities to the Government and/or to a

Successor, including transfer of all contract-developed or Government-acquired software, codebases, databases, data, documents, and necessary files and supporting materials.

b) Carry on operations at appropriate staffing levels until the designated transition period has ended. At the request of the COR, specific tasks will be relinquished by the Contractor during the transition period.

c) Provide a detailed training seminar to staff members of the successor organization to familiarize them with the operation of the APIS and the procedures for conducting its various activities. The seminar shall address both legal research and web site maintenance and operation issues. Provide briefing materials for the seminar ten (10) business days prior to the seminar. The Government and its representatives will act as a third party in all meetings and communications between the Contractor and Successor pertaining to knowledge exchange.

d) Provide additional knowledge exchange activities, including informal briefings for staff of the successor organization and others as designated by the COR. Be available to answer questions, providing access to all documentation, and briefing the Government and Successor on the status of work not completed. The Government and its representatives will act as a third party in all meetings and communications between the Contractor and Successor pertaining to knowledge exchange.

e) Ensure all source code contains detailed documentation that can be followed by a succeeding contractor to gain the requisite understanding needed to continue maintenance, operation, and development of the APIS web site.

f) Transfer all procured cloud and any supporting provider or applications services that were procured using funds under this contract to the Government or the Successor and impart the knowledge of its functions. This includes all Government purchased cloud services, certificate services, software, code repositories, data, documentation, and reports.

g) After receiving acknowledgement from the contracting officer that all transition activities have been completed to the satisfaction of the government, the Contractor will certify in writing that all code and content has been purged from the contractor’s systems, as well as from any other service providers that the Contractor was approved to use during the course of servicing this contract, except those required for continued smooth operation of APIS under a Successor, as approved by the CO.

h) Ten (10) business days prior to the contract expiration date, the Contractor shall submit to the CO and the COR or designee all documentation (paper and/or electronic), reference materials, data files, computer programs, presentation materials, and other information and materials necessary for the continued operation of the APIS and its activities that are not already included in previous submissions. This requirement includes any and all equipment that may have been purchased, leased, or otherwise obtained using contract funds.

Activity 8 – Prepare and submit reports to the CO and the COR.

a) The Contractor shall submit Quarterly Progress Reports to the CO and COR that identify task activities completed, progress of ongoing activities, any problems or risks identified or anticipated along with suggested solutions, staffing changes, a summary of staff effort and costs devoted to specific contract activities, a summary of subcontract and subscription costs, with recommendations for areas where costs could be reduced, and plans and recommendations for work to be conducted during the next quarter.

b) At least two (2) business days in advance of each monthly teleconference meeting between the Project Director and the COR, the Contractor shall provide to the COR by email a written agenda for the upcoming meeting. The agenda shall identify all significant elements of work in progress and issues to be addressed during the meeting, as well as plans for work to be completed in future months. The agenda shall also include appendices providing (a) a concise summary of the major activities of each staff member and subcontractor since the previous meeting; (b) a summary of the funds expended relative to the overall funds awarded for the current contract segment compared to the fraction of the time elapsed in the current contract segment, as of the end of the most recent calendar month; and (c) significant changes (25% or greater) in costs incurred overall and by budget category.

c) Within three (3) business days following each meeting, the Contractor shall provide to the COR by email a written summary of discussions at the last meeting, including documentation of decisions made at the meeting and a summary of outstanding action items.

d) As requested by the COR, the Contractor shall provide ad-hoc reports on specific aspects of contract Activities as needed.

ATTACHMENT 4: Reporting Requirements and Deliverables RFP 75N94022R00011, “NIAAA Alcohol Policy Information System”

REPORTING REQUIREMENTS AND DELIVERABLES

The items specified below as will be required to be delivered F.O.B. Destination as set forth in FAR Clause 52.247-35, F.O.B. Destination, Within Consignees Premises (April 1984), and in accordance with and by the date(s) specified below and any specifications stated in the contract.

Description Quantity Due Date

TECHNICAL DELIVERABLES

(see Article C.1. “Statement of Work” and Article C.2.

”Reporting Requirements”)

Quarterly Progress Reports 1 e-copy to NICHD Contracts Portal https://contracts.nichd.nih.gov

January 15, April 15, July 15, October 15 of each year

(For first year, only due April 15, July 15 and October 15)

(An Annual Report [or Final Report, as applicable] will be due in lieu of a Quarterly Report for the last Quarter of the contract performance period)

New Policy Topic Assessment #1

1 e-copy to NICHD Contracts Portal https://contracts.nichd.nih.gov

To be determined, as requested by COR

New Policy Topic Assessment #2

1 e-copy to NICHD Contracts https://contracts.nichd.nih.gov

To be determined, as requested by COR

Transition Plan Materials as described in Statement of Work

1 e-copy to NICHD Contracts Portal https://contracts.nichd.nih.gov

10 days prior to contract expiration date

Final Contract Materials as described in Statement of Work

Uploadable materials shall be delivered to the NICHD Contracts Portal at https://contracts.nichd.nih.gov

Other materials to be delivered as directed by COR

10 days prior to contract expiration date

Summary of Salient Results 1 e-copy to NICHD Contracts

On or before expiration date of contract as requested by

COR

Final Report 1 e-copy to NICHD Contracts

On or before expiration date of contract as requested by

COR

Source and Object Code Deliver as directed by COR On or before the expiration date of the contract as requested by COR

Teleconference Agendas, Summaries, Written

1 e-copy to COR via e-mail Upon request by COR – Teleconference Agendas due https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/

Assessments Requesting Changes in Design/Structure/Operation of System, Quality Assurance Reporting, Operational Procedures Documentation, Usability Assessment Documentation and any other Supporting Documentation as required by the Statement of Work at least 2 business days in advance of scheduled call;

Summaries due within 3 business days following call unless otherwise requested by

COR

ADMINISTRATIVE AND

REGULATORY

DELIVERABLES

(see contract Articles as indicated below)

Section 508 Annual Report – Electronic and Information Technology Accessibility

(see Article C.2. Reporting Requirements and the related Article in Section H)

1 e-copy to NICHD Contracts

November 30 of each year

Report of Gov’t Owned, Contractor Held Property

(see related Article in Section G)

1 e-copy to NICHD Contracts

November 30 of each year (submit negative report if no Gov’t Property)

Service Contract Annual Report

(see Article I.3., FAR Clause 52.204-14, “Service Contract Reporting Requirements”)

Electronic submission to www.sam.gov and 1 e-copy to NICHD Contracts Portal

October 31st of each contract year in accordance with FAR 52.204-14

Annual Invention Utilization Report

(see related Article in Section C)

If any inventions to disclose, electronic submission to NIH Interagency Edison reporting system, http://www.iedison.gov and 1 e-copy to NICHD Contracts Portal https://contracts.nichd.nih.gov

If no inventions to disclose, send a negative report to the NICHD Contracts Portal

December 31 of each contract year

Final Invention Statement

(see related Article in Section C)

1 e-copy to NICHD Contracts

On or before the expiration date of the contract

Reporting of Financial Conflict of Interest (FCOI)

1 e-copy via e-mail to the Contracting Officer

As applicable, per “Institutional Responsibility Regarding Investigator https://contracts.nichd.nih.gov/ https://contracts.nichd.nih.gov/ http://www.sam.gov/ https://contracts.nichd.nih.gov/ http://www.iedison.gov/ https://contracts.nichd.nih.gov/

(see related Articles in Sections C and H)

[Submit FCOI report and mitigation plan if and when a FCOI is identified]

Conflicts of Interest” Article in Section H of contract; in accordance with 45 CFR Part

INFORMATION AND

PHYSICAL ACCESS

SECURITY DELIVERABLES

(see Article C.2. Reporting Requirements and the related Article in Section H, “Information and Physical Access Security” for full details)

Roster of Employees Requiring Suitability Investigations

1 e-copy via e-mail to CO, COR, and NIAAA ISSO

Initial report due 30 days after contract award and thereafter written notice of updates to CO, COR and NIAAA ISSO, within 5 working days before a new employee assumes a position that requires access to HHS information systems or data; upon departure for departing personnel with such access.

Security Assessment and Authorization (SA&A Package)

– Government Owned/Contractor Operated or Contractor Owned/Contractor Operated Resources

1 e-copy via e-mail to CO, COR, and NIAAA ISSO

Due within 90 days after contract award.

Updated thereafter in accordance with the “Government Information Processed on GOCO or COCO Systems Sub-Article in Section H, and as requested by the NIAAA ISSO and directed/approved by the CO

FedRAMP Compliant ATO (Authority to Operate)

1 e-copy via e-mail to CO, COR, and NIAAA ISSO

Prior to utilizing any Cloud- Based Environment under this contract

Security Assessment and Authorization (SA&A Package)

– Cloud Services

1 e-copy via e-mail to COR, COR and NIAAA ISSO

Due within 90 days after contract award.

Updated thereafter in accordance with the “Cloud Services” Sub-Article in Section H, and as requested by the NIAAA ISSO and requested/approved by the

CO

Evidence of Completion of Mandatory HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management Training Course

1 e-copy of completion certificates to CO, COR, and

NIAAA ISSO

Within 30 days of contract award and annually thereafter for each annual term option exercised.

(link to online course to be provided by NIH) Incident Reporting 1 e-copy via e-mail to NIAAA

ISSO, NIH Incident Response Team (IRT), COR and CO

Within 1 hour of discovery

IT SC&A* 1 e-copy via e-mail to CO, COR, and NIAAA ISSO

Due three (3) months after contract award with annual assessment and reporting of results/verification that the IT- SC&A remains valid thereafter as requested by the NIAAA

ISSO

Reporting of New and Departing Employees

1 e-copy via e-mail to CO, COR, and NIAAA ISSO

Within 5 days of staffing changes and/or departures for positions that require Information Security access/suitability determinations

Vulnerability Scanning Reports**

1 e-copy via e-mail to CO, COR and NIAAA ISSO

First report due 60 days after contract award.

Thereafter, monthly or as requested by the NIAAA ISSO and approved by the CO.

Certification of Sanitization of Government and Government Activity-Related Files, Information, and Devices

1 e-copy via e-mail to CO, COR and NIAAA ISSO

2 weeks prior to contract expiration or as specified by the NIAAA ISSO with approval by the CO.

For information stored in a Cloud Environment, data must be available to NIH within one

(1) business day from request date.

All electronic reports (designated as “e-copy” in the chart above) submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at http://www.hhs.gov/web/508/html under “Making Files Accessible.”

All reports required herein, other than those specifically designated to be submitted by e-mail or other method in the “Quantity” column in the chart above, shall be submitted in electronic format via the NICHD Contracts Portal available at the following website:

https://contracts.nichd.nih.gov. The Contractor must provide to the Contracting Officer/Contract Specialist the name of the person(s) submitting electronic reports via the NICHD Contracts Portal in order to initiate access to the Portal.

*[IT-SC&A]

At the completion of the APIS IT Security Certification and Accreditation (IT-SC&A), a Plan of Action and Milestones (POA&M) will be created to schedule and track the process of any remediation tasks identified during the assessment. Progress on those tasks will be reported within this report.

http://www.hhs.gov/web/508/html

**[Vulnerability Scanning Reports]:

The current contractor and NIAAA have made arrangements with Amazon Web Services, and the NIH Incident Response Team (NIH IRT) to enable automated vulnerability scans of the APIS application, and the underlying operating system to be performed by the NIH IRT. This arrangement will also be applicable to the successor contract resulting from this acquisition.

The scan results will be retained within the NIH IRT vulnerability management system, thus negating the need for the contractor to provide monthly or quartering scan reports.

There is an expectation, in the normal course of system maintenance, new vulnerabilities will be identified within the scan results, which will be sent by NIAAA to the contractor (via secure email) for remediation.

The status of all vulnerability remediation tasks identified during each quarterly reporting period will be required by NIAAA to be reported in the Vulnerability Scanning Report.

If no remediation tasks were identified for the quarter, the contractor should indicate this fact within their quarterly technical progress report. If the remediation results will contain sensitive vulnerability information, the contractor has 2 options to securely send the file(s):

A) reply to the NIH Secure Email that contained the original vulnerabilities scan transmission, or

B) use an encryption product, such as PKZip, to encrypt the file using the AES 256 standard, and password protect the file.

ATTACHMENT 5

RFP 75N94022R00011, “NIAAA Alcohol Policy Information System

SECTION K - REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENTS OF

OFFERORS

Update per FAC 2022-06 Last updated: 05/2022

To Be Completed by the Offeror: This document must be completed and included as part of your Business Proposal. By submission of its signed offer, the offeror makes the following Representations and Certifications:

52.204-8 Annual Representations and Certifications.

As prescribed in 4.1202(a), insert the following provision:

ANNUAL REPRESENTATIONS AND CERTIFICATIONS (JAN 2022)

(a) (1) The North American Industry Classification System (NAICS) code for this acquisition is 519130.

(2) The small business size standard is 1,000 employees.

(3) The small business size standard for a concern that submits an offer, other than on a construction or service acquisition, but proposes to furnish an end item that it did not itself manufacture, process, or produce is 500 employees if the acquisition—

(i)Is set aside for small business and has a value above the simplified acquisition threshold;

(ii)Uses the HUBZone price evaluation preference regardless of dollar value, unless the offeror waives the price evaluation preference; or

(iii)Is an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(b) (1) If the provision at 52.204-7, System for Award Management, is included in this solicitation, paragraph (d) of this provision applies.

(2) If the provision at 52.204-7, System for Award Management, is not included in this solicitation, and the Offeror has an active registration in the System for Award Management (SAM), the Offeror may choose to use paragraph (d) of this provision instead of completing the corresponding individual representations and certifications in the solicitation.

The Offeror shall indicate which option applies by checking one of the following boxes:

https://www.acquisition.gov/far/4.1202#FAR_4_1202 https://www.acquisition.gov/far/52.204-7#FAR_52_204_7 https://www.acquisition.gov/far/52.204-7#FAR_52_204_7

(i) □ Paragraph (d) applies.

(ii) □ Paragraph (d) does not apply and the…