RFP No. 75N98023R00009 - Captioning Services - 021723.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 3/2005)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS

UNRESTRICTED OR

NAICS:

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

EMERGING SMALL

BUSINESS

8 (A)

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

RFP Number: 75N98023R00009

- 2 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS

IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/

CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL

INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE

CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT

COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS

AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

NOTICE TO OFFEROR

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The Contractor must be capable of providing broadcast quality multimedia that include live real-time captioning, post-production captioning, transcription, translation, and audio description services. Services shall be provided both onsite (Bethesda main campus and surrounding area) and remotely on a variety of commercial webinar platforms, including Zoom and WebEx, Adobe Connect, Microsoft Teams, and others.

The Contractor must be able to provide rapid response transition to 100% a virtual environment and captioners must have top secret facility clearance.

This requirement is being procured as an Indefinite Delivery Indefinite Quantity type contract under FAR Part

12 (Commercial Items), FAR Part 15 (Contracting by Negotiations), and FAR Part 37.6 (Performance Based

Acquisition).

ARTICLE B.2. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE H.

SPECIAL CONTRACT REQUIREMENTS, this contract consists only of the Base Period specified in the Performance Work Statement as defined in SECTIONS C and F, for the price set forth in ARTICLE

B.3 PRICING SCHEDULE, Base Year of this contract.

b. Pursuant to FAR Clause 52.217-9 set forth in ARTICLE H. SPECIAL CONTRACT REQUIREMENTS of this contract, the Government may, by unilateral contract modification, require the Contractor to perform the Option Period(s) specified in the Performance Work Statement as defined in SECTIONS

C and F of this contract. If the Government exercises these option(s), notice must be given before the expiration date of the contract. Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The price of this contract will be increased as set forth in Option Years 1 through 2 in ARTICLE B.3. PRICING SCHEDULE.

- 3 -

ARTICLE B.3. PRICING SCHEDULE

The final contract will contain the price/cost provisions agreed upon by the Government and the Offeror.

The Contractor shall furnish captioning/transcription services for the NIH for a twelve (12) month base period with two (2) twelve-month option periods.

The Contract Line Items (CLINs) are mostly fixed hourly/minutes rates. It is anticipated this solicitation will be awarded as a Performance Based contract.

a. The total estimated amount of this contract is To be determined at time of award.

b. Incentive Payments:

1. The Contractor's performance hereunder will be observed and evaluated continuously by the

Government. At the end of each evaluation period (performed quarterly) the Contracting Officer will review performance based on the standards and criteria established in the Quality Assurance

Surveillance Plan (QASP) listed as Attachment #2 hereto and made a part of this contract.

2. The findings of the evaluation will determine the amount of the available incentive payment earned by the Contractor for the identified evaluation period. In no event, however, will any unearned incentive payments become available in subsequent evaluation periods.

3. The Contracting Officer/Contracting Officer's Representative will notify the Contractor, in writing, of the available incentive payment actually earned for a given evaluation period. Upon receipt of this notification, the Contractor may submit an invoice for payment of the total incentive payment earned.

4. The evaluation/determination of incentive payment shall be binding on both parties and not subject to the Disputes Clause.

c. Upon delivery and acceptance of the services described in the Performance Work Statement of this contract and identified in the schedule of charges below, the Government shall pay to the contractor the unit price(s) set forth below:

Base Year: April 1, 2023 through March 31, 2024

Line Item No.

Description QTY Unit Unit Price Estimated Total

1 Remote Real-time Captioning 2,900 Hour

2 Remote Real-time Captioning (Spanish) 100 Hour

3 Remote On-Site Captioning (Includes Setup Fee)

10 Hour

4 Post-Production (Caption files) 50 File

5 Post-Production (Video files) 250 File

6 Post-Production Captioning with transcription

- Standard 5-7 day turnaround

1,500 Minute

7 Post-Production Captioning with transcription

- Expedited 3-day turnaround

150 Minute

8 Post-Production Captioning with transcription

- Expedited Next-day turnaround

100 Minute

9 Post-Production Captioning with transcription

- Expedited Same-day turnaround

100 Minute

- 4 -

No.

Description QTY Unit Unit Price Estimated Total

10 Verbatim Transcription: Standard 5-7-day turnaround

500 Hour

11 Verbatim Transcription: Rush 3-day turnaround

10 Hour

12 Verbatim Transcription: Rush next day turnaround

10 Hour

13 Verbatim Transcription: Rush same-day turnaround

10 Hour

14 Transcription Onsite 10 Hour

15 Timecoded Transcription 10 File

16 Captioning & Transcription from English to Spanish, French and Chinese n/a n/a Not to Exceed

$1,250

17 Audio Description (for the blind) n/a n/a Not to Exceed

$6,000

18 NTE Quarterly Performance Incentive 4 Quarter $4,000 $16,000

Base Year Total

Option Year 1: April 1, 2024 through March 31, 2025

No.

Description QTY Unit Unit Price Estimated Total

1 Remote Real-time Captioning 3,000 Hour

2 Remote Real-time Captioning (Spanish) 100 Hour

3 Remote On-Site Captioning (Includes Setup Fee)

10 Hour

4 Post-Production (Caption files) 50 File

5 Post-Production (Video files) 250 File

6 Post-Production Captioning with transcription

- Standard 5-7 day turnaround

1,750 Minute

7 Post-Production Captioning with transcription

- Expedited 3-day turnaround

150 Minute

8 Post-Production Captioning with transcription

- Expedited Next-day turnaround

100 Minute

9 Post-Production Captioning with transcription

- Expedited Same-day turnaround

100 Minute

10 Verbatim Transcription: Standard 5-7-day turnaround

500 Hour

11 Verbatim Transcription: Rush 3-day turnaround

10 Hour

12 Verbatim Transcription: Rush next day turnaround

10 Hour

13 Verbatim Transcription: Rush same-day turnaround

10 Hour

14 Transcription Onsite 10 Hour

15 Timecoded Transcription 10 File

- 5 -

No.

Description QTY Unit Unit Price Estimated Total

16 Captioning & Transcription from English to Spanish, French and Chinese n/a n/a Not to Exceed

$1,250

17 Audio Description (for the blind) n/a n/a Not to Exceed

Option Year 1

Option Year 2: April 1, 2025 through March 31, 2026

Item No.

Description QTY Unit Unit Price Estimated Total

1 Remote Real-time Captioning 3,100 Hour

2 Remote Real-time Captioning (Spanish) 100 Hour

3 Remote On-Site Captioning (Includes Setup Fee)

10 Hour

4 Post-Production (Caption files) 50 File

5 Post-Production (Video files) 250 File

6 Post-Production Captioning with transcription

- Standard 5-7 day turnaround

2,000 Minute

7 Post-Production Captioning with transcription

- Expedited 3-day turnaround

150 Minute

8 Post-Production Captioning with transcription

- Expedited Next-day turnaround

100 Minute

9 Post-Production Captioning with transcription

- Expedited Same-day turnaround

100 Minute

10 Verbatim Transcription: Standard 5-7-day turnaround

500 Hour

11 Verbatim Transcription: Rush 3-day turnaround

10 Hour

12 Verbatim Transcription: Rush next day turnaround

10 Hour

13 Verbatim Transcription: Rush same-day turnaround

10 Hour

14 Transcription Onsite 10 Hour

15 Timecoded Transcription 10 File

16 Captioning & Transcription from English to Spanish, French and Chinese n/a n/a Not to Exceed

$1,250

17 Audio Description (for the blind) n/a n/a Not to Exceed

Option Year 2

- 6 -

ESTIMATED TOTAL BASE + ALL OPTION YEARS $

d. The estimated contract amount and quantity for items set forth in paragraphs a. & c. above are not a guarantee and are estimated quantities due to the number of workdays and holidays per month and unexpected government closures.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. PERFORMANCE WORK STATEMENT

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Performance Work Statement, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with

Government specifications. At a minimum, all deliverables shall be marked with the contract number and

Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, To be completed at time of award is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at: To be completed at time of award

d. Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

a. The period of performance of this contract shall be from April 1, 2023 through March 31, 2024 with options to extend for two (2) successive 12 month periods.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION Article in

Section H of this contract, the period of performance will be increased as listed below:

Period Year

Option Year 1 April 1, 2024 – March 31, 2025

Option Year 2 April 1, 2025 – March 31, 2026

- 7 -

ARTICLE F.2. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEBRUARY

1998)

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is not applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

To be determined at time of award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements;

(2) interpreting the Performance Work Statement and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the

Performance Work Statement; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement https://www.acquisition.gov/?q=browsefar

- 8 -and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

Project Manager

Programmer

Business Analyst

ARTICLE G.3. METHOD OF ORDERING AND INDEFINITE DELIVERYCONTRACT PAYMENT

METHOD

a. Orders issued under this contract may be placed as follows:

[X] in writing

[ ] via telephone

[ ] via facsimile (fax)

[ ] via electronic mail (e-mail)

[ ] Oral [Oral Orders will be confirmed in writing within days of issuance. [ ] Other Specify:

b. The Contracting Officer is authorized to issue orders and provide written confirmation of oral orders, if applicable, under the contract.

INDEFINITE DELIVERY CONTRACT PAYMENT METHOD

To initiate and receive prompt payment, the Contractor shall comply with the following procedure:

a. A Task/Delivery Order Number shall be given to you at the time the order is placed. The

Contractor is cautioned not to accept an order unless one of these numbers is issued.

b. Invoices shall be submitted monthly to the address indicated in Article G.4., Invoice

Submission, of this contract. Invoices shall cite the Contract Number and the Task/Delivery

Order Number for each order for which payment is being requested. See Article G.4., Invoice

Submission, for more information about submission of a proper invoice.

- 9 -

ARTICLE G.4. INVOICE SUBMISSION

a. Invoice Instructions for NIH Fixed-Price Type Contracts, NIH(RC)-2, are attached and made part of this contract. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt

Payment and shall invoice monthly (within 14 days following the end of each month).

1. The Contractor shall submit invoices to the Department of Treasury's Invoice Processing Platform (IPP) at https://www.ipp.gov with a copy to the approving official, as directed below. The Contractor shall submit a copy of the electronic invoice to the following Approving Official (Contracting Officer) and Contracting Officer Representative:

Approving Official: Contracting Officer [To be specified at time of award]

Name- Email Address-

Contracting Officer’s Representative [To be specified at time of award]

Name- Email Address-

For inquiries regarding the status of invoices, contact OFM Customer Service via email at ofm_customer_service@incontactemail.com or via phone at 301-496-6088. To send your inquiries via other available communication methods refer to the OFM Customer Service website at https://ofm.od.nih.gov/Pages/Customer-Service.aspx.

Note: The OFM Customer Service is open Eastern Standard Time Monday - Friday from 8:30 a.m. to 5:00 p.m. and is closed between 12:00 p.m. to 1:00 p.m.

2. In addition to the requirements specified in FAR 32.905 for a proper invoice, the Contractor shall include the following information on the face page of all payment requests:

a. Name of the Office of Acquisitions. The Office of Acquisitions for this BPA is Office of Logistics and Acquisition Operations, Branch 1.

b. Federal Taxpayer Identification Number (TIN). If the Contractor does not have a valid TIN, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, Unique Entity Identifier (UEI), or VIN, contact the Contracting Officer. Note: The Contractor shall not include TIN if it is a Social Security Number.

c. Unique Entity Identifier (UEI). The UEI is located in the System for Award Management (SAM) and replaces the Dun & Bradstreet Data Universal Numbering System (DUNS) number. The UEI number must identify the Contractor's name and address exactly as stated in the contract and as registered in the Central Contractor Registration (CCR) database. If the Contractor does not have a valid UEI number, it shall identify the Vendor Identification Number (VIN) on the payment request. The VIN is the number that appears after the Contractor's name on https://www.ipp.gov/ mailto:OFM%20Customer%20Service mailto:ofm_customer_service@incontactemail.com https://ofm.od.nih.gov/Pages/Customer-Service.aspx

- 10 -the face page of the contract. [Note: A VIN is assigned to new contracts awarded on or after June 4, 2007, and any existing contract modified to include the VIN number.] If the Contractor has neither a TIN, UEI, or VIN, contact the Contracting Officer.

d. Invoice Matching Option. This contract requires a three-way match.

e. Unique Invoice Number. Each payment request must be identified by a unique invoice number, which can only be used one time regardless of the number of contracts or orders held by an organization.

f. Contract Title: Captioning Services

ARTICLE G.5. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared to coincide with the anniversary dates of the contract.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting

Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

http://www.cpars.gov

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

ARTICLE H.2. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Performance Work Statement as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-9, Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the

Contractor to perform additional options set forth in the Performance Work Statement and also defined in http://www.cpars.gov/

- 11 -

Sections C and F of the contract. If the Government exercises this option, notice must be given at least 30 days prior to the expiration date of this contract, and the price of the contract will be increased as set forth in the PRICING SCHEDULE Article in SECTION B of this contract.

ARTICLE H.3. ACCESS TO NATIONAL INSTITUTES OF HEALTH (NIH) ELECTRONIC MAIL

All Contractor staff that have access to and use of NIH electronic mail (e-mail) must identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the Contractor staff shall set up an e-mail signature

("AutoSignature") or an electronic business card ("V-card") on each Contractor employee's computer system and/or Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent.

ARTICLE H.4. REPORTING MATTERS INVOLVING FRAUD, WASTE AND ABUSE

Anyone who becomes aware of the existence or apparent existence of fraud, waste and abuse in NIH funded programs is encouraged to report such matters to the HHS Inspector General's Office in writing or on the Inspector General's Hotline. The toll free number is 1-800-HHS-TIPS (1-800-447-8477). All telephone calls will be handled confidentially. The website to file a complaint on-line is:

http://oig.hhs.gov/fraud/hotline/ and the mailing address is:

US Department of Health and Human

Services Office of Inspector General

ATTN: OIG HOTLINE OPERATIONS

P.O. Box 23489

Washington, D.C. 20026

ARTICLE H.5. HOLD HARMLESS AND INDEMNIFICATION AGREEMENT

The Contractor shall save and hold harmless and indemnify the Government against any and all claims, liabilities and costs of whatsoever kind and nature for injury to or death of any person or persons and for loss of damage to any property (Government or otherwise) occurring in connection with or in any incident to or arising out of the occupancy, use, service, operations or performance of work under the terms of the contract, resulting in whole, or in part from the negligent acts or omissions of the Contractor, any subcontractor or any employee, agent, or representative of the Contractor or subcontractor.

ARTICLE H.6. OMB CLEARANCE

In accordance with HHSAR 352.211-3, Paperwork Reduction Act, the Contractor shall not proceed with surveys or interviews until such time as Office of Management and Budget (OMB) Clearance for conducting interviews has been obtained by the Contracting Officer’s Representative (COR) and the

Contracting Officer has issued written approval to proceed.

ARTICLE H.7. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

http://oig.hhs.gov/fraud/hotline/

- 12 -

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

▪ Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

▪ Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

▪ Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories . Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

▪ Confidentiality: [X] Low [ ] Moderate [ ] High

▪ Integrity: [X] Low [ ] Moderate [ ] High

▪ Availability: [X] Low [ ] Moderate [ ] High

▪ Overall Risk Level: [X] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

- 13 -

ii. Based on information provided by the ISSO, system/ data owner, or other security or privacy representative, it has been determined that this solicitation/ contract involves:

[X] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis ( PTA) for the information system and/ or information handled under this contract to determine whether or not a full Privacy Impact Assessment ( PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term " handling " refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system;

and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization .

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction

- 14 -policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents. NIH will specify which documents/forms will be provided to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 days of the validation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/ .

Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement, https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements http://csrc.nist.gov/publications/ https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

- 15 -

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role- based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role- Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-based Training at: https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html .

c. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the Contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. In accordance with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII) , an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

http://irtsectraining.nih.gov/ http://irtsectraining.nih.gov/ https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html

- 16 -

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send NIH approved notifications to affected individuals in accordance with https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT) via email at IRT@mail.nih.gov , COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum:

company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

▪ Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

▪ Not include any sensitive information in the subject or body of any reporting e-mail; and

▪ Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/NIH and NIH privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation within an hour of discovery.

5. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Tier 5: Critical Sensitive and Special Sensitive National Security, including Top Secret, SCI, and "Q" access eligibility.

[ ] Tier 5SR: Reinvestigation.

[ ] Tier 4: High Risk Public Trust (HRPT).

[ ] Tier 4SR: Reinvestigation.

[ ] Tier 3: Non-Critical Sensitive, National Security, including Secret and "L" access eligibility.

[ ] Tier 3SR: Reinvestigation.

[ ] Tier 2S with Subject Interview: Moderate Risk Public Trust (MRPT).

[ ] Tier 2SR: Reinvestigation.

[X] Tier 1: Low Risk, Non-Sensitive, including HSPD-12 Credentialing.

6. Homeland Security Presidential Directive (HSPD)-12 https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines mailto:IRT@mail.nih.gov

- 17 -

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12 .

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within fourteen (14) calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for Contractor use at: https://oamp.od.nih.gov/nih-document-generation-system/dgs-workform-information/attachment-files-section-j If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract.