RFQ 75D-301-21-Q-73059- Documentum Software Subscription.pdf

REQUEST FOR QUOTATIONS

(THIS IS NOT AN ORDER)

THIS RFQ X IS IS NOT A SMALL BUSINESS SET-ASIDE.

PAGE OF PAGES

1 30

1. REQUEST NO.

75D301-21-Q-73059

2. DATE ISSUED

03/30/2021

3. REQUISITION/PURCHASE REQUEST NO.

000HCPPB-2021-52118

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY

Centers for Disease Control and Prevention (CDC)

Office of Acquisition Services (OAS)

2900 Woodcock Blvd, MS TCU-4

Atlanta GA 303414004

6. DELIVERY BY (Date)

5b. FOR INFORMATION CALL (No collect calls)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

Jaren Turner (770) 488-2053 x

8. TO: 9. DESTINATION

a. NAME b. COMPANY a. NAME OF CONSIGNEE

c. STREET ADDRESS b. STREET ADDRESS

c. CITY

d. CITY e. STATE f. ZIP CODE d. STATE e. ZIP CODE

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

The Centers for Disease Control and

Prevention (CDC), Office of Science

(OS) has a requirement for Documentum licensing software and maintenance.

Questions are due by April 2, 2021 at

5:00pm EST

Quotes are due by April 12, 2021 at

3:00pm EST

Please submit questions and quotes to jturner6@cdc.gov

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS

b. 20 CALENDAR DAYS

c. 30 CALENDAR DAYS

d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER 14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF

QUOTATION

a. NAME OF QUOTER

b. STREET ADDRESS 16. SIGNER

a. NAME (Type or print) b. TELEPHONE

c. COUNTY AREA CODE

d. CITY e. STATE f. ZIP CODE c. TITLE (Type or print) NUMBER

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (REV. 6-95)

Previous edition not usable Prescribed by GSA FAR (48 CFR) 53.215-1(a)

7. DELIVERY

FOB

DESTINATION

OTHER

(See Schedule)

SUBJECT: CDC Documentum License Subscription

SOLICITATION NUMBER: 75D301-21-Q-73059

RESPONSE DUE DATE/TIME: April 12, 2021/ Before 3:00 pm EASTERN TIME

SECTION A – DESCRIPTION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This solicitation is issued as a Request for Quote (RFQ) number 75D301-21-Q-73059 using the

Simplified Acquisitions Procedures of FAR 13 and FAR Part 12.

The solicitation document and incorporated provisions and clauses are those in effect through

Federal Acquisition Circular.

The associated North American Industrial Classification System (NAICS) code for this procurement is 541511 – Computer Software Support Services

This is an RFQ for the CDC Documentum License Subscription. The Government intends to award a Firm Fixed-Price contract as a result of this solicitation that will include the terms and conditions that are set forth herein.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

Base Year

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Certified Records Manager

Part # 1000006391 CERTIFIED

RECORDS MANAGER 1 - 50=UA

Maintenance

This is a Severable line item.

This is a Firm Fixed Price line item.

Period of Performance: 4/19/2021 –

4/18/2022

15 Each $__________ $__________

0002 Certified Records Manager

Part # 1000006391 CERTIFIED

5 Each $__________ $__________

0003 Documentum Custom Client

Part # 1000042474 Documentum Custom

Client = UA Maintenance

5975 Each $__________ $__________

0004 Documentum D2=UA

Part # 1000005675 DOCUMENTUM

D2=UA Maintenance

25 Each $__________ $__________

0005 Documentum Platform

Part # 1000042473 DOCUMENTUM

6000 Each $__________ $__________

0006 Documentum Prime Protect

Part # 1000047395 Documentum Prime

Protect

1 Each $__________ $__________

0007 Documentum Trusted Content

Part # 1000042482 Documentum Trusted

Content Services Maintenance

Option Period 1 Year 2 Items:

1001 CERTIFIED RECORDS MANAGER 1 -

50=UA

Part# 1000006391 CERTIFIED

Period of Performance: 4/19/2022 –

4/18/2023

1002 CERTIFIED RECORDS MANAGER 1 -

50=UA

Part # 1000006391 CERTIFIED

1003 Documentum Custom Client = UA

Maintenanc

1004 DOCUMENTUM D2=UA Maintenance

1005 Documentum Platform = UA

Part # 1000042473 Documentum

Platform = UA Maintenance

1006 Documentum Prime Protect

Part # 1000047395 Documentum Prime

1007 Documentum Trusted Content Services

Main

Period of Performance: 4/19/2022 –

Option Period 2 Year 3 Items:

2001 CERTIFIED RECORDS MANAGER 1 -

50=UA

Period of Performance: 4/19/2023 –

4/18/2024

2002 CERTIFIED RECORDS MANAGER 1 -

50=UA

2003 Documentum Custom Client = UA

Maintenanc

2004 DOCUMENTUM D2=UA Maintenance

2005 Documentum Platform = UA

Maintenance

2006 Documentum Prime Protect

2007 Documentum Trusted Content Services

Main

Option Period 3 Year 4 Items:

3001 CERTIFIED RECORDS MANAGER 1 -

50=UA

Period of Performance: 4/19/2024 –

4/18/2025

3002 CERTIFIED RECORDS MANAGER 1 -

50=UA

3003 Documentum Custom Client = UA

Maintenanc

3004 DOCUMENTUM D2=UA Maintenance

3005 Documentum Platform = UA

Maintenance

3006 Documentum Prime Protect

Part # 1000047395 Documentum Prime

3007 Documentum Trusted Content Services

Main

Option Period 4 Year 5 Items:

4001 CERTIFIED RECORDS MANAGER 1 -

50=UA

Period of Performance: 4/19/2025 –

4/18/2026

4002 CERTIFIED RECORDS MANAGER 1 -

50=UA

4003 Documentum Custom Client = UA

Maintenanc

4004 DOCUMENTUM D2=UA Maintenance

4005 Documentum Platform = UA

4006 Documentum Prime Protect

4007 Documentum Trusted Content Services

Main

SECTION C – DESCRIPTION/SPECIFICATIONS/ WORK STATEMENT

Statement of Work

Title: Documentum Software

SECTION 1 – BACKGROUND

The CDC Office of Science Quality Knowledge Management team provides guidance on a suite of systems that ensure:

proper clearance of information products across CDC, access to those products through an institutional repository, reports on the timeliness of clearance on the products and impact of the products once released to the public. These systems include eClearance/STARS, Publishing Reporting, Stacks, and Vault. These systems along with multiple systems across CDC platforms use Documentum as a repository in which the content is stored securely under compliance rules and a unified environment, although content may reside on multiple servers and physical storage devices within a networked environment. Documentum provides services such as document management, collaboration, search, content classification, input management, Business Process Management (BPM), customer communication management, and Web content management

SECTION 2 – PURPOSE

Documentumn is a software used to manage documents across the CDC network.

SECTION 3 – SCOPE OF WORK

Software used to manage documents across the CDC network.

SECTION 4 – TASKS TO BE PERFORMED

Task 1 - Software maintenance and support to manage documents across the CDC network.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

None

SECTION 6 – PERIOD OF PERFORMANCE

Base: 04/19/2021-04/18/2022

Option 1: 04/19/2022-04/18/2023

Option 2: 04/19/2023-04/18/2024

Option 3: 04/19/2024-04/18/2025

Option 4: 04/19/2025-04/18/2026 https://en.wikipedia.org/wiki/Distributed_database https://en.wikipedia.org/wiki/Document_management https://en.wikipedia.org/wiki/Enterprise_search https://en.wikipedia.org/wiki/Statistical_classification https://en.wikipedia.org/w/index.php?title=Input_management&action=edit&redlink=1 https://en.wikipedia.org/wiki/Business_Process_Management https://en.wikipedia.org/wiki/Communication_management https://en.wikipedia.org/wiki/Web_content_management

Section D - Packaging And Marking

There are no clauses/provisions included in this section.

Section E – Inspection and Acceptance

There are no clauses/provisions included in this section

Section F – Deliveries or Performance

1 - PLACE OF PERFORMANCE

Offsite at vendor’s location.

2 - DELIVERABLES/REPORTING SCHEDULE

Software Keys within 10 days of award

Items Description Quantity Deliver by Date Deliver To

Task 1 – Access to Documentum Software

Certified Records Manager

Part # 1000006391 CERTIFIED

15 Each April 19, 2021 CDC

Task 1 – Access to Documentum Software

Certified Records Manager

Part # 1000006391 CERTIFIED

5 Each April 19, 2021 CDC

Documentum Software

Documentum Custom Client

Each April 19, 2021 CDC

Task 1 – Access to Documentum Software

Documentum D2=UA

25 Each April 19, 2021 CDC

Documentum Software

Documentum Platform

Part # 1000042473 DOCUMENTUM

April 19, 2021 CDC

Task 1 – Access to Documentum Software

Documentum Prime Protect

Part # 1000047395 Documentum Prime

Protect

1 Each April 19, 2021 CDC

Task 1 – Access to Documentum Software

Documentum Trusted Content

April 19, 2021 CDC

3 - TRAVEL

4 - REFERENCE MATERIALS

SECTION G – Contract Administration Data

CDCA_G001 – Invoice Submission (Jul 2017)

(a) The Contractor shall submit the original contract invoice/voucher to the address shown below:

The Centers for Disease Control and Prevention

Office of Financial Resources (OFR)

P.O. Box 15580

Atlanta, GA 30333

Or – The Contractor may submit the original invoice via facsimile or email:

Fax: 404-638-5324

Email: FMOAPINV@CDC.GOV

NOTE: Submit to only one (1) of the above locations.

(b) The contractor shall submit 2 copies of the invoice to the cognizant contracting office previously identified in this contract. These invoice copies shall be addressed to the attention of the Contracting

Officer.

(c) The Contractor is , is not required to submit a copy of each invoice directly to the Contracting

Officer’s Representative (COR) concurrently with submission to the Contracting Officer.

(d) In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Office of Financial Resources is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(e) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Task Order Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice mailto:FMOAPINV@CDC.GOV

(11) Name, title and telephone number of person to be notified in the event of a defective invoice

(12) Payment Address, if different from the information in (c)(1).

(13) DUNS + 4 Number

(14) Electronic funds transfer (EFT) banking information

CDC0_G008 Contracting Officer’s Representative (COR) (Jul 2017)

Performance of the work hereunder shall be subject to the technical directions of the designated COR for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work, and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof.

In the event that the Contractor believes full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting

Officer, immediately or as soon as possible, in a letter or e-mail separate of any required report(s). No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government COR is not authorized to change any of the terms and conditions of this contract. Contract changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the COR delegation memorandum upon request.

CDCP_G009 Contracting Officer (Jul 1999)

(a) The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds. No person other than the Contracting Officer can make any changes to the terms, conditions, general provisions, or other stipulations of this contract.

(b) No information, other than that which may be contained in an authorized modification to this contract, duly issued by the Contracting Officer, which may be received from any person employed by the

United States Government, or otherwise, shall be considered grounds for deviation from any stipulation of this contract.

CDC0_G018 Payment by Electronic Funds Transfer (Feb 2018)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer –System for

Award Management, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In the case that EFT information is not within the System of Award Management, FAR 52.232-34 requires mandatory submission of Contractor’s EFT information directly to the office designated in this contract to receive that information (hereafter: “designated office”); see below. The contractor shall submit the EFT information within the form titled “ACH Vendor/Miscellaneous Payment Enrollment

Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Office of

Financial Resources at 678-475-4510.

(c) In cases where the contractor has previously provided such information, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention

Office of Financial Resources (OFR)

P.O. Box 15580

Atlanta, GA 30333

Or – Fax copy to: 404-638-5342

Section H - Special Contract Requirements

CDCA_H004 Identification of Data (May 1998)

The Contractor shall identify the technical data delivered to the Government as required by this contract with the number of the contract and the name and address of the Contractor or subcontractor that generated the data.

(End of Clause)

CDC0_H053 Health Information Technology (Jun 2020)

Executive Order 13410: Promoting Quality and Efficient Health Care in Federal Government

Administered or Sponsored Health Care Programs promotes efficient delivery of quality health care through the use of health information technology, transparency regarding health care quality and price, and incentives to promote the widespread adoption of health information technology and quality of care.

To support this objective the awardee shall adhere to the following interoperability standards and requirements. For purposes of the information described herein, interoperability is defined as the ability of two or more systems or components to exchange information and to use the information that has been exchanged.

Interoperability of Health Information Technology

This section applies to contracts that involve the exchange of public health data between public health entities, CDC, and other federal agencies. This supports the development and use of interoperable information systems for public health functions such as biosurveillance, situational awareness, laboratory science, or environmental health.

• In addition to complying with HHS Standards for Security Configurations, HHS Standards for Encryption Language, and Federal Laws, Regulations and Standards related to IT

Security, the awardee is required to meet recognized interoperability standards as follows:

• The awardee shall use nationally adopted Public Health Information Network (PHIN) standards at the time of the system implementation, acquisition, or upgrade, in all relevant information technology systems supported, in whole or in part, through this contract. Where no PHIN standards exist, the awardee shall utilize recognized standards established by the Office of the

National Coordinator for Health Information Technology (ONC) as described in their Nationwide

Health Information Network (NwHIN) standards.

• The awardee shall use PHIN policies, standards, practices, and services in the research and implementation of efficient and effective public health information systems, to facilitate interoperability (the ability of two or more systems or components to exchange information and to use the information that has been exchanged) with public health organizations and networks, including NwHIN.

• Where the awardee supports or participates in health information or data exchange with disparate entities, the awardee must have an architecture that is compatible with the architecture of PHIN, where appropriate. If PHIN standards do not exist, the awardee shall refer to NwHIN standards.

Public Health Data within Clinical Healthcare

This section applies to contracts that involve the exchange of public health data within the clinical setting, such as hospitals and providers. This supports the exchange of public health information, including laboratory exchange data, between public health entities and healthcare systems.

• The awardee shall use health IT investments, such as electronic health records (EHRs), personalized health records, and network components through which they operate and share https://www.cdc.gov/phin/ https://www.healthit.gov/policy-researchers-implementers/nationwide-health-information-network-nwhin information, that are certified by a recognized certification board and/or validated and tested with

PHIN or NwHIN certification to ensure a minimum level of interoperability or compatibility of health IT products.

• The awardee may use services available from the Agency for Healthcare Research and Quality

(AHRQ) at www.healthit.ahrq.gov. This link provides technical assistance, identifies challenges to health IT adoption and use, and identifies solutions and best practices that have the potential to transform clinical practice through the best and most effective use of IT.

• Where feasible, the awardee shall collaborate with other healthcare entities, local quality improvement organizations, and/or local medical societies to promote the adoption of certified

EHRs in clinical provider settings.

• Where feasible, the awardee shall collaborate with other healthcare entities and/or local hospital associations to promote the adoption of certified EHRs in hospital settings.

• The awardee shall identify public health entities that have a stake in the award and demonstrate interactions with them to implement and promote the adoption of PHIN and/or

NwHIN data exchange standards in support of federal health initiatives (e.g., situational awareness, EHR Meaningful Use).

• The awardee shall report on public health information exchange activities that include partnerships with health information exchanges, other public health partners, or any other stakeholders within program reports, progress reports, or as requested by CDC.

(End of Clause) http://www.healthit.ahrq.gov/

IT Security

Information Technology Security

The Contractor’s performance and resulting deliverables must adhere to all federal, HHS, and/or CDC IT security policies and procedures. Based upon the scope of this contract, adherence to the following IT Security guidance is required whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term “information technology (IT)”, as used in this contract, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), cloud environments, and related resources. This clause does not apply to national security systems as defined in FISMA.

The Contractor is responsible for the following: (1) Protecting Federal information and Federal information systems in order to ensure their—(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; (ii)

Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (iii) Availability, which means ensuring timely and reliable access to and use of information.(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS. (3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of

Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the

Chief Information Officer's (OCIO) Web site.

All development or implementation of an electronic information system or any electronic data collection effort conducted in the performance of this contract will be required to complete Security Assessment and

Authorization (SA&A) prior to operation resulting in an Authority of Operate (ATO) from CDC. The contractor shall be required to complete all security documentation and materials necessary to obtain an ATO.

The contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other federal policies and regulations in the performance of the security requirements.

All information systems developed, implemented, or maintained in support of this contract must adhere to the security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication

800-53, Recommended Security Controls for Federal Information Systems and Organizations

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) and NIST 800-53A, Guide for

Assessing the Security Controls in Federal Information Systems and Organizations.

The Contractor must follow the latest guidance available from NIST and other recognized sources, including but not limited to:

• FIPS Publication 199, Standards for Security Categorization of Federal Information and Information

Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199- final.pdf),

• FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final- march.pdf),

• NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18- Rev1-final.pdf),

• NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

• NIST publication SP 800-44 Guidelines on Securing Public Web Servers, (http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf)

• NIST Special Publication 800-53, Security and Privacy Controls for Federal Information

Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53r4.pdf),

• NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60- rev1/SP800-60_Vol1-http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf) http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf) http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) http://csrc.nist.gov/publications/nistpubs/800-60-

Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800- 60-rev1/SP800-60_Vol2-Rev1.pdf),

• NIST Special Publication 800-63, Electronic Authentication Guideline

(http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

• NIST publication SP 800-95 Guide to Secure Web Services, (http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf) when applicable.

• Web Application Security Consortium (http://www.webappsec.org)

• Open Web Application Security Project (OWASP) (http://www.owasp.org).

The contractor must follow CDC development standards and use the CDC web template package. All CDC websites, campaign sites, and applications must use the standard CDC web template to ensure a consistent look and feel for CDC websites. The template will be provided as needed. The CDC Secure Web Application Coding

Guidelines and CDC Template Package (http://intranet.cdc.gov/ocio/docs/information-systems-security/CDC_Secure_Web_App_Coding_Guidelines.pdf) can be provided by the CDC Project Officer or the

Center’s ISSO.

All web content must reside on a CDC.gov domain and must be hosted at CDC or in a CDC-authorized environment. The contractor may not establish a .com, .org, or other type of site to host CDC funded content or web applications.

During any application development or enhancement, the Contractor shall work closely with NCCDPHP offices/divisions and NCCDPHP Information System Security Officer (ISSO) to ensure all CDC-related technical and security standards, processes and procedures are followed. This working relationship shall continue through full production.

If use of a cloud environment is needed, the provider must be FedRAMP certified. The contractor shall comply with

FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The cloud environment must also have an

Authority to Operate from HHS.

All publicly accessible Federal websites and web services must provide service over a secure connection. The strongest privacy protection currently available for public web connections is Hypertext Transfer Protocol Secure

(HTTPS).

Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

Standard for Encryption Language

• The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS information during storage and transmission.

• The Contractor shall verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2 (as amended). If requested, the Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

• The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

http://csrc.nist.gov/publications/nistpubs/800-http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf) http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf) http://intranet.cdc.gov/ocio/docs/information-systems-http://csrc.nist.gov/cryptval/) http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf)

• The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

• The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process HHS information.

• The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with these requirements.

HSPD-12 Compliance

As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all vendors providing hardware and software to the federal government are required to ensure that these PIV cards will integrate with their software and hardware at the application level. Contractor must be able to implement and support PIV card integration.

Standard for Security Configurations

The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of CDC. The following security configuration requirements apply.

• The Contractor shall configure its computers that contain CDC data with the applicable United States Government Configuration Baseline (USGCB) (see http://usgcb.nist.gov/) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. Note: USGCB is applicable to all computing systems, including desktops and laptops— regardless of function—but not including servers.

• The Contractor shall ensure IT applications operated on behalf of CDC are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

• The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with USGCB

Scanner capability to ensure its products operate correctly with USGCB configurations and do not alter

USGCB settings—see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest USGCB major version and subsequent major versions.

• The Contractor shall ensure IT applications designed for end users run in the standard user context without requiring elevated administrative privileges.

• The Contractor shall ensure hardware and software installation, operation, maintenance, update, and patching will not alter the configuration settings or requirements specified above.

• The Contractor shall (1) include Federal Information Processing Standard (FIPS) 201-compliant (see http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf), Homeland Security Presidential Directive 12

(HSPD-12) card readers with the purchase of servers, desktops, and laptops; and (2) comply with FAR

Subpart 4.13, Personal Identity Verification.

• The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with these requirements.

http://usgcb.nist.gov/) http://scap.nist.gov/validation/ http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf)

HHSAR Provision, 352.239-73: Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of

1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT)

Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the

Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

504 Authoring Tools

602 Support Documentation

603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues.

Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the

HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the

EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the

Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

http://www.hhs.gov/web/508 http://www.access-board.gov/sec508/standards.htm http://hhs.gov/web/508 http://508.hhs.gov/ https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html

Section I – CLAUSES

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive

Orders-Commercial Items

As prescribed in 12.301(b)(4), insert the following clause:

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017)

(section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L.

113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2019) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015). (5)

52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78

(19 U.S.C. 3805note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sep 2006), with Alternate I (Oct

1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

(2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509)).

(3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009

(Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment

Act of 2009.)

X (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L.

109-282) (31 U.S.C. 6101 note).

(5) [Reserved].

(6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of

Div. C).

(7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016)

(Pub. L. 111-117, section 743 of Div. C).

X (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101note).

(9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018)

(41 U.S.C. 2313).

(10) [Reserved].

https://www.acquisition.gov/content/part-12-acquisition-commercial-items#i1113145 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_203-19 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#id189A70O0P1N https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#unique_2058868924 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062680 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048661 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1048698 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063319 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063504 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1063607 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064087 http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064214 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1064243 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062590 http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1062651 http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title41-section2313&num=0&edition=prelim

(11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Mar 2020) (15

U.S.C.657a).

(ii) Alternate I (Mar 2020) of 52.219-3.

(12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Mar

2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

(13) [Reserved]

(14)

(i) 52.219-6, Notice of Total Small Business Set-Aside (Mar 2020) (15 U.S.C.644).

(ii) Alternate I (Mar 2020).

(15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (Mar 2020) (15 U.S.C. 644).

(ii) Alternate I (Mar 2020) of 52.219-7.

(16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

(17)

(i) 52.219-9, Small Business Subcontracting Plan (Mar 2020) (15 U.S.C. 637(d)(4)).

(ii) Alternate I (Nov 2016) of 52.219-9.

(iii) Alternate II (Nov 2016) of 52.219-9.

(iv) Alternate III (Mar 2020) of 52.219-9.

(v) Alternate IV (Aug 2018) of 52.219-9

(18) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

(19) 52.219-14, Limitations on Subcontracting (Mar 2020) (15 U.S.C.637(a)(14)).

(20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

(21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Mar 2020)

(15 U.S.C. 657f).

_X_ (22) (i) 52.219-28, Post Award Small Business Program Rerepresentation (Mar 2020) (15

U.S.C. 632(a)(2)).

(ii) Alternate I (MAR 2020) of 52.219-28.

(23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-

Owned Small Business Concerns (Mar 2020) (15 U.S.C. 637(m)).

(24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns

Eligible Under the Women-Owned Small Business Program (Mar 2020) (15 U.S.C. 637(m)).

https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057314 http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title15-section637a&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057314 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057352 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057393 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057419 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057419 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-8 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i52_219-9 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057715 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057730 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057758 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057823 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057874 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057874 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057902 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1057947 http://uscode.house.gov/browse.xhtml%3Bjsessionid%3D114A3287C7B3359E597506A31FC855B3

(25) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

(26) 52.219-33, Nonmanufacturer Rule (Mar 2020) (15 U.S.C. 637(a)(17)).

_X_ (27) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

__ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan 2020)

(E.O.13126).

_X_ (29) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (30) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

(ii) Alternate I (Feb 1999) of 52.222-26.

(31) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(ii) Alternate I (Jul 2014) of 52.222-35.

_X_ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.793).

(ii) Alternate I (Jul 2014) of 52.222-36.

(33) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010)

(E.O. 13496).

_X_ (35) (i) 52.222-50, Combating Trafficking in Persons (Jan 2019) (22 U.S.C. chapter 78 and E.O.

13627).

(ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter78 and E.O. 13627).

(36) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

(37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008)

(42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off- the-shelf items.)

(ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

(38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential

Hydrofluorocarbons (Jun 2016) (E.O. 13693).

(39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air

Conditioners (Jun 2016) (E.O. 13693).

(40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Oct 2015) of 52.223-13.

(41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

(ii) Alternate I (Jun 2014) of 52.223-14.

https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec637.htm https://www.acquisition.gov/content/part-52-solicitation-provisions-and-contract-clauses#i1055332…