RFQ- 75FCMC26Q0041.pdf

31b. NAME OF CONTRACTING OFFICER (Type or print) 30c. DATE SIGNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30. 1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NUMBER 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

11. DELIVERY FOR FREE ON 12. DISCOUNT TERMS

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

13a. THIS CONTRACT IS A

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY

DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

8(A)

13b. RATING

NORTH AMERICAN

INDUSTRY CLASSIFICATION

STANDARD (NAICS):

SIZE STANDARD:

BOARD (FOB) DESTINATION RATED ORDER UNDER 14. METHOD OF SOLICITATION

REQUEST

SAL

17a. CONTRACTOR/

OFFEROR

CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NUMBER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

OFFER BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Government Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH

AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND

ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS

SPECIFIED

29. AWARD OF CONTRACT: REFERENCE OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print)

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

UNLESS BLOCK IS MARKED

SEE SCHEDULE

THE DEFENSE PRIORITIES

AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

REQUEST

FOR QUOTE

(RFQ)

INVITATION FOR

FOR BID PROPO

(IFB) (RFP)

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

Solicitation/Contract Form

009290: Media Relations - Politico Pro Service Subscription

(End Of Section)

Supplies or Services and Prices/Cost

Item Supplies/Service Dates Quantity Unit

Subscription for Pro Politico

Base Period: March 11, 2026- March 10, 2027

Product Service Code: R699 Severability: Yes

Period of Performance From

11 MAR 2026

To

10 MAR 2027

Additional Information/Notes

Pursuant to the terms and conditions of Contract No. TBD, the contractor shall perform the work required in accordance with the attached Statement of Work (SOW) entitled, "POLITICO Pro Subscription."

Signature of the contractor represents acceptance of this contract.

Firm Fixed Price Payment Schedule

Payment will be made upon completion of deliverable(s) or services.

(End of Section)

Description/Specifications/Statement of Work

Requirements

The Centers for Medicare and Medicaid Services (CMS) needs to monitor top and breaking news in near real-time that covers the country's news and politico environment in easy-to-read and understandable information snippets. Politico Pro, an online news subscription service, allows licensed users within components to stay abreast of healthcare news to determine whether to redirect, amplify, or expand upon messaging from the agency. The contractor shall provide a subscription-based information service for twenty-five (25) licensed CMS users.

See the Statement of Work for additional information

Additional Information/Notes

The Contractor shall furnish the necessary personnel, materials, services, equipment, and facilities (except as otherwise specified herein), and otherwise do all the things necessary for or incident to the performance of the work as set forth in the Statement of Work.

The Statement of Work (SOW) is provided as Attachment 1 and made part of this Purchase Order.

(End of Section)

Packaging and Marking

(End of Section)

Inspection and Acceptance

(End of Section)

Deliveries or Performance

Line Item 0001

Performance

Period of Performance

Period of Performance From

11 MAR 2026

To

10 MAR 2027

(End of Section)

Contract Administration Data

Additional Regulation or Supplement Clauses Incorporated by Full Text

G. Contractor Work Performed Outside the United States and its Territories (January 2021)1

To comply with requirements of Homeland Security Presidential Directive -12 (HSPD-12) and Personal Identity Verification (PIV) of Federal Employees and Contractors, CMS must achieve appropriate security assurance for multiple CMS information systems by efficiently verifying the claimed identity of individuals working on the contract. The Contractor and its subcontractor

(s) shall not perform any activities under this contract, including the transmission of data or other information, outside of the United States (U.S.) and its Territories without the prior written approval of the Contracting Officer. If work must be performed outside the U.S., the Contractor shall submit a request to the Contracting Officer, in writing, at least 45 calendar days prior to the work beginning.

The Contracting Officer will consider the following factors in making a decision whether to authorize the performance of work outside the U.S. and its Territories:

1. The necessity of the work to be performed outside the United States and its territories;

2. The Statement of Work under contract that will be performed outside the U.S. and its Territories;

3. Total projected dollar value of the work to be performed outside the U.S.;

4. Total projected number of labor hours and length of time to be performed for each individual employee working outside the U.S.;

5. The desired country/location where the work will be performed;

6. FAR Part 25, Foreign Acquisitions, and all other laws and regulations applicable to the performance of work outside the U.S.;

7. The contractor and/or its subcontractor(s) plans to adequately protect and secure CMS data, as well as abide by all applicable laws and regulations when work is performed outside of the U.S. and its Territories. Plans shall include -

a. Adequate contract terms regarding system security;

b. Adequate contract terms regarding the confidentiality and privacy requirements for information and data protection;

c. Adequate contract terms that are otherwise relevant, including the requirements of the Statement of Work;

d. The Contractor's corporate compliance plan and internal policies and procedures designed to prevent and detect violations of applicable law, regulations, rules and ethical standards by employees, agents and others; and,

8. The necessity of Government Furnished Equipment (GFE) or Contractor Owned/Contractor Operated (COCO) devices to be used outside the U.S. and verification of a secure VPN access.

9. Compliance with Executive Order 13940 Aligning Federal Contracting and Hiring Practices With the Interests of American Workers. Determine if approval will reduce opportunities for the United States contractor workers performing in the United States and if this would cause any potential effects to national security.

10. Conformance with Section 889 "Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment", of Public Law115-232.

11. Determination that approval is in best interest of the Government.

The Contractor's request for authorization to perform work outside the U.S. shall include supplemental information to demonstrate that the performance of the work outside the U.S. satisfies all of the above factors. Contracting Officer approval to perform work outside the U.S. may require additional Statement of Work requirements, additional contract terms and conditions and/or Federal Acquisition Regulation (FAR) clauses to be incorporated into the contract.

G. GOVERNMENT REPRESENTATIVES AND RESPONSIBILITIES (NOV 2024)2

Following are the Government Representatives and their respective roles and responsibilities on this contract:

a. Contracting Officer

As defined in Federal Acquisition Regulation (FAR)2.101, Definitions, and in accordance with FAR 1.602-1, Authority, "Contracting officers have authority to enter into, administer, and/or terminate contracts and make related determinations and findings." There is no other authorized representative or any other Administrative Contracting Officer assigned to this contract to carry out a Contracting Officer's duties, except for technical direction assigned to the Contracting Officer's Representative, if applicable.

The Contracting Officer is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Acquisition Services Group

Division of of Quality Contracts

ATTN: Heather Stewart Parr-Lang

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-3286

Email Address: Heather.Parr-StewartLang@cms.hhs.gov

b. Contract Specialist

Notwithstanding any of the other provisions of this Contract, the Contract Specialist will assist the Contracting Officer with his/her responsibilities as defined in the FAR.

The Contract Specialist is:

Centers for Medicare & Medicaid Services

Office of Acquisition & Grants Management

Division of of Quality Contracts

ATTN: Domonique Sparks

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: 410-786-1896

Email Address: Domonique.Sparks@cms.hhs.gov

c. Contracting Officer's Representative

The Contracting Officer's Representative (COR), as defined in FAR 2.101, Definitions, is:

Centers for Medicare & Medicaid Services

Office of Administrator

Media Relations Group

Division of of Communications

ATTN: TBD

7500 Security Blvd.

Baltimore, MD 21244-1850

Phone: TBD

Email Address: TBD

In accordance with FAR 1.602-2(d), Responsibilities, the COR's delegated responsibilities are identified in the Contracting Officer's appointment memorandum, a copy of which will be furnished to the contractor.

The COR will serve as the primary liaison between the Contractor and the Contracting Officer and perform duties within the limitations of the COR's responsibilities in accordance with FAR 1.602-2(d).

Technical direction must be within the general scope of the work stated in the contract. The term "technical direction" is defined to include, without limitation, the following:

(1) Directions to the Contractor which direct the contract effort, shift work emphasis between work areas or tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish the contractual technical requirements as identified in the Statement of Work or Performance Work Statement; or

(2) Provision of information to the Contractor, which assists in the interpretation of drawings, specifications, or technical portions of the work description.

Technical direction within the scope of the contract, shall be "in writing" whenever possible and routed through the CO prior to release to the Contractor. If technical direction is verbally communicated, the COR must immediately confirm its direction in writing. Where doubt exists as to whether proposed technical direction is within or outside the scope of the contract, the CO shall be contacted.

If, in the opinion of the Contractor, any instruction or direction issued by a Government representative constitutes a change to the contract or constitutes a "Change Order" as defined in FAR 2.101, Definitions, the Contractor shall follow the instructions identified in FAR 52.243-7 Notification of Changes.

The COR "has no authority to make any commitments or changes that affect price, quality, quantity, delivery, or other terms and conditions of the contract nor in any way direct the contractor or its subcontractors to operate in conflict with the contract terms and conditions." See FAR1.602-2(d)(5). The COR's authority is not re-delegable and the COR may be personally liable for unauthorized acts in accordance with FAR 1.602-(d)(7)(iv) and (v). For example, the COR does not have the authority to:

1. Make changes to contract terms and conditions;

2. Direct the contractor to perform work or make deliveries not specifically required under the contract;

3. Waive or relax the Government's rights with regard to the Contractor's compliance with the specifications, price, delivery or any other terms or conditions of the contract;

4. Make any commitments or approve any actions that would create any financial obligation on the part of the Government; or

5. Issue direction that constitutes a "change" as defined in:

FAR 52.243-1, Changes - Fixed Price;

FAR 52.243-2, Changes - Cost-Reimbursement;

FAR 52.243-3, Changes - Time-and-Materials or Labor-Hours;

FAR 52.243-4, Changes; or, FAR 52.243-5, Changes and Changed Conditions.

In addition to the above responsibilities, the COR and/or Contractor shall immediately notify the Contracting Officer of any contractual concerns related to the following:

1. Personal Services: FAR37.104(a) provides that, "[a] personal services contract is characterized by the employer-employee relationship it creates between the Government and the contractor's personnel. The Government is normally required to obtain its employees by direct hire under competitive appointment or other procedures required by the civil service laws. Obtaining personal services by contract, rather than by direct hire, circumvents those laws unless Congress has specifically authorized acquisition of the services by contract."

Under this contract, the services to be performed do not require the Contractor or the Contractor's personnel to exercise personal judgement and discretion on behalf of the Government. Rather, the Contractor's personnel will act and exercise personal judgement and discretion on behalf of the Contractor. The services to be performed under this contract are not for personal services as defined by FAR 37.104.

Both the Government and the Contractor have a responsibility to monitor contract activities. The CO must be notified immediately if at any time during contract performance the interaction between the Government representative and Contractor personnel constitutes or is perceived to constitute personal services. Both the Government and Contractor personnel must exercise caution to ensure that service contracts not personal in nature avoid even the appearance of a personal services contract.

2. Inherently Governmental Functions: The agency shall not use contractors for the performance of inherently governmental functions unless issued under statutory authority See FAR 7.5 Inherently Governmental Functions. As defined in FAR 2.101, "Inherently Governmental Function" means, as a matter of policy, a function that is so intimately related to the public interest as to mandate performance by Government employees. An inherently governmental function includes activities that require either the exercise of discretion in applying Government authority, or the making of value judgments in making decisions for the Government. Inherently governmental functions DO NOT normally include gathering information for or providing advice, opinions, recommendations, or ideas to Government officials.

FAR 7.503(c) provides a list of examples of functions considered to be inherently governmental functions or which shall be treated as such.

To this effect, during contract performance, care should be taken to ensure that any change or expansion in scope of the requirement does not include inherently governmental functions. Further, due to the nature of a given requirement, there is a potential for close working relationships to develop between Government and Contractor personnel; however, care should be taken to ensure that any familiarity established between the Government and Contractor personnel never promotes or fosters an environment that allows for the assignment of inherently governmental functions to contractor employee(s).

3. Unauthorized Commitments: In carrying out your duties, you are reminded that in accordance with FAR (d)(5), the COR "[h]as no authority to make any commitments or changes that affect price, 1.602-2 quality, quantity, delivery, or other terms and conditions of the contract, or in any way direct the Contractor, or its Subcontractors, to operate in conflict with the contract terms and conditions." Doing so constitutes an "unauthorized commitment." The Contracting Officer is the only individual with the authority to enter into an agreement on behalf of the Government. An unauthorized commitment is defined as "an agreement that is not binding solely because the Government representative who made it lacked the authority to enter into that agreement on behalf of the Government." FAR 1-602-3(a). Examples of unauthorized commitments include, but are not limited to, the following:

• Orders placed with a Contractor without a valid contractual instrument in place.

• Directing any Contractor to do additional work, in excess of the contract value, or work beyond the Period of Performance.

• Authorize new work to a contract without notifying the Contracting Officer (CO) or Contract Specialist(CS) and having a modification in place for the new work.

• Directing the Contractor, in any way that could change the terms and conditions of the contractual instrument or be deemed outside the Scope of the Statement of Work.

https://www.acquisition.gov/far/part-1

Unauthorized commitments are a serious matter and may result in personal liability on the part of the employee who committed the unauthorized commitment. Ratification, is "the act of approving an unauthorized commitment by an official who has the authority to do so." FAR 1.602-3(a).

G.3 PAYMENTS - INVOICES - ( September 2024 )

a. GENERAL: Effective August 31, 2020, the Contractor/ Vendor shall create an invoice within the Invoice Processing Platform (IPP), a secure Web-based service for federal agencies and their vendors to manage government invoicing from purchase order (PO) through payment notification. Note: All invoice terms and conditions are contract specific and may vary from contract to contract.

b. CONTENT OF INVOICE: FAR 32.905 Payment Documentation and Process, provides the required content for a proper invoice. In addition to the requirements of FAR 32.905, the following items shall also be included on the invoice to be considered proper:

• Line item number (i.e. CLIN/SLIN as applicable)

• Contractor /Vendor's Unique Entity Identifier (UEI) Number;

• Period of Performance (PoP) or delivery date of goods or services provided;

• Attachments and applicable support documentation requested by the CO ;

• The first page of the PDF invoice or PDF SF-1034 shall include :

1. Contractor /Vendor name and address;

2. Bill to: CMS, P.O. Box 7520, Baltimore, MD 21207;

3. Full CMS contract number and task order number;

4. Summary of charges by CLIN/SLIN (if applicable) with a grand total. CLIN/SLIN( S) on the PDF shall be identical to what is entered in IPP;

5. Invoice number shall be identical to what is entered in IPP. Each Contractor/Vendor invoice number must be unique across all CMS contracts awarded to the Contractor /Vendor. For example, If Contractor /Vendor A has 5 CMS contracts, Contractor /Vendor A cannot use the same invoice number on any of the 5 contracts they have with CMS. If using a dash in IPP then the dash must be used on the PDF. IPP does not allow any special characters (i.e.*, # , _ );

6. Within IPP, the " Bill Period Start " and "Bill Period End " dates should align with the " Service From " and " Service To " dates (this is not the entire POP dates);

7. Date of Delivery or Service dates shown on the PDF should: ( i ) F all within the contract POP (unless contract indicates otherwise) ( ii ) Align with the " Bill Period Start " and "Bill Period End " dates and " Service From " and " Service To " dates, and ( iii ) Note when the work was performed;

8. Date invoice was prepared;

9. The total invoice amount on the first page of the invoice or SF-1034 must be a debit. A credit may be shown on the first page of the invoice or SF-1034 if the credit falls within the Period Of Performance and is for the same CLIN as the debit. CMS does not accept credit vouchers or process refunds in IPP or the Invoice Submission Box. Credits in excess of $5.01 must be submitted via Pay.gov (For questions surrounding Pay.gov, contact pay.gov.

clev@clev.frb.org or 1-800-624-1373 (Option 2)). Credits sent to Pay.gov shall be copied to the CO, CS and COR. Credits valued at or less than $5.01 must be submitted via Credit

Gateway; however, it is preferred that the Contractor/Vendor wait until a dollar amount is accumulated in order to submit the refund through Pay.gov (For questions surrounding Credit Gateway, contact customer.care@usbank.com or 1-877-815-1206);

• When an invoice has been resubmitted, an "R" should be added after the invoice number on the PDF and in IPP; this will ensure that the original invoice number is not duplicated in IPP. If a resubmitted invoice is rejected again, each subsequent resubmission requires an additional "R" added after the invoice number (i.e. "RR" );

• The " final " designation should only be used when the contract is being closed out by OAGM. Do not use for the end of POP or Option Year;

• Contractor/ Vendor must maintain active registration in SAM .gov. If your SAM account is about to expire, wait until it is updated before submitting your invoice; and,

• Banking or address changes must be submitted via email to CCRchanges@cms.hhs.gov.

c. INVOICE SUBMISSION: The Contractor/ Vendor shall create an invoice from the Purchase Order (PO)/Contract via the IPP website http://www.ipp.gov/. For questions, call IPP Customer Support at (866) 973-3131 or email the IPP Customer Support at IPPCustomerSupport@fiscal.treasury.gov. Only one PDF invoice per submission is allowed in IPP.

d. PAYMENTS: The Government shall make payment of all proper invoices in accordance with the following clauses, as applicable and included in the respective TO/PO/contract:

• FAR 52.232-33 Payments by Electronic Funds Transfer - System for Award Management,

• FAR 52.232-1 Payments

• FAR 52.212-4 Contract Terms and Conditions - Commercial Items (If applicable)

• FAR 52.216-7 Allowable Cost and Payment

• FAR 52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts

Payment shall be made upon acceptance by the Contracting Officer's Representative (COR) in accordance with the applicable FAR Inspection and Acceptance clause and the Contracting Officer's approval, as appropriate.

Reimbursement for invoices submitted under this contract shall be made no later than 30 calendar days after receipt of a proper invoice from the Contractor requested at the paying office designated above.

Contracts with a 15- day payment term are not subject to interest payments until after day 30.

e. INTEREST ON OVERDUE PAYMENT: The Prompt Payment Act, Public Law 97-177 (96 Stat.85.31 U.S.C.

1801) is applicable to payments under this contract and requires the payment of interest on payments made more than 30 calendar days after receipt of a proper invoice in IPP. Determinations of interest due will be made in accordance with the provisions of the Prompt Payment Act and 5 CFR 1315.

(End of Section)

Special Contract Requirements

Additional Regulation or Supplement Clauses Incorporated by Full Text

H. CMS RECORDS MANAGEMENT (AUG 2025)1

a. General Requirements:

Federal records, as defined in 44 U.S.C. 3301, include “all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.” Federal records can be in any format, including communications such as email, chats/instant messages, calendars, documents, and presentations.

The Contractor shall comply with all applicable records management laws, regulations, and policies, including but not limited to the CMS policy for records management, available at https://www.cms.gov/about-cms/work-us/business-resources/contractor-

, and HHSAR clause 352.204-72, Records Management (FEB 2024) (DEVIATION). The Contractor shall information/training ensure that Federal records created or captured in a CMS system are managed electronically in accordance with either a General Records Schedule (GRS) (see ) or the CMS Records Schedule(see https://www.archives.gov/records-mgmt/grs.html https://www.

). These schedules provide instructions for how cms.gov/about-cms/work-us/business-resources/contractor-information/training long records must be kept (retention) and when they should be deleted, destroyed, or transferred to the National Archives (disposition).CMS and GRS schedules also specify whether the records are temporary or permanent. Any records that do not fall under an existing CMS Records Schedule or the GRS must be maintained as if they are permanent until an applicable schedule is written.

b. Training Requirements:

All Contractor employees assigned to this contract who handle Federal records must complete the Department of Health and Human Services (HHS) records management training before performing any work under the contract. After completing the initial training, Contractor employees must complete any annual refresher training required by HHS for the duration of the contract. A link to the records management training and additional guidance is available at: https://www.cms.gov/about-cms

./work-us/business-resources/contractor-information/training

The Contractor must retain documentation confirming all required training has been completed and provide such documentation to the Contracting Officer upon request.

c. Requirements for Information Systems:

The Contractor shall design, develop, and implement records management and archival functions to be incorporated into information systems in a manner that will allow CMS to manage its Federal Records in compliance with Federal rules, regulations, and guidance, including but not limited to the joint memoranda M-19-21:Transition to Electronic Records and M-23- 07: Update to Transition to Electronic Records, issued by the Office of Management and Budget (OMB) and the National Archives and Records Administration (NARA). The Contractor shall incorporate records management controls into the system to ensure that records provide adequate and proper documentation of agency business for as long as the information is needed (i.

e., for their NARA-approved retention periods), in accordance with 36 CFR 1236. The Contractor shall design the system so that

The system must keep a fixed and complete version adequate maintenance and disposition procedures are in place from the start.

of each defined record, in documentary form or as a collection of data. The system must capture/create, accumulate, and maintain over time the minimum required recordkeeping metadata in an electronic recordkeeping system and ensure all areas are properly configured for appropriate records management.

The Contractor shall provide a flexible, scalable, and configurable solution, including all necessary software, middleware, and technical support, to fully support records management and archival functionality to meet all NARA Universal Electronic Records Management (ERM) Requirements categorized as “System” requirements with a “Must Have” priority level. NARA’s Universal ERM Requirements identify high level business needs for managing records in information systems and are available at . They are baseline requirements derived from https://www.archives.gov/records-mgmt/policy/universalermrequirements existing statutes, standards, NARA regulations, policy, and guidance. The requirements cover six phases of the electronic records management lifecycle: Capture, Maintenance and Use, Disposal, Transfer, Metadata, and Reporting. The “System” requirements provide technical guidance for creating ERM tools, which NARA characterizes as either mandatory (“Must Have”) or preferred (“Should Have”).

Universal ERM Requirements designated as “Must Have” are the minimum requirements for CMS systems. In addition, all CMS systems must meet Universal ERM Requirement 2.02,which requires records to be managed in a manner that allows searches to be saved for the purposes of supporting sufficiency of search under the Freedom of Information Act (FOIA). If any other Universal ERM Requirements designated as “Should Have” are required for system implementation, those requirements are indicated in the Statement of Work or Performance Work Statement.

https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.archives.gov/records-mgmt/grs.html https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.cms.gov/about-cms/work-us/business-resources/contractor-information/training https://www.archives.gov/records-mgmt/policy/universalermrequirements

H. HIPAA BUSINESS ASSOCIATE CLAUSE (OCT 2014)2

All Protected Health Information (PHI), as defined in 45 C.F.R. 160.103, that is relevant to this Contract, shall be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA," 42 U.S.C. 1320d), as amended, as well as the corresponding implementing regulations and this HIPAA Business Associate Clause.

a. Definitions:

All terms used herein and not otherwise defined, shall have the same meaning as in HIPAA, as amended, and the corresponding implementing regulations. Non-HIPAA related provisions governing the Contractor's duties and obligations, such as those under the Privacy Act and any applicable data use agreements, are generally covered elsewhere in the Contract.

The following definitions apply to this Contract Clause:

"Business Associate" shall mean the Contractor (and/or the Contractor's subcontractors or agents) if/when it uses individually identifiable health information on behalf of CMS, i.e. PHI, to carry out CMS' HIPAA-covered functions.

"Covered Entity" shall mean the portions of CMS that are subject to the HIPAA Privacy Rule.

"Secretary" shall mean the Secretary of the Department of Health & Human Services or the Secretary's designee.

b. Obligations and Activities of Business Associate:

Except as otherwise provided in this Contract, Business Associate, as defined above, shall only use or disclose PHI on behalf of, or to provide services to, Covered Entity in accordance with this Contract and the HIPAA Privacy and Security Rules.

Business Associate shall document in writing the policies and procedures that will be used to meet HIPAA requirements. The policies and procedures shall include the following, at a minimum:

1. Business Associate shall not:

i. Use or disclose PHI that is created, received, maintained or transmitted by Business Associate from, or on behalf of, Covered Entity other than as permitted or required by this Contract or as required by law;

ii. Sell PHI; or,

iii. Threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual for:

A. Filing a complaint under 45 CFR 160.306;

B. Testifying, assisting or participating in an investigation, compliance review, proceeding or hearing under 45 CFR Part 160; or

C. Opposing any act or practice that is unlawful under HIPAA, provided there is a good faith belief that the practice is unlawful, the manner of opposition is reasonable, and the opposition does not involve the disclosure of PHI in violation of subpart E of Part 164.

2. Business Associate shall:

i. Have a security official who will be responsible for development and implementation of its security policies and procedures, including workforce security measures, to ensure proper security awareness and training (including security incident response and reporting), and security incident procedures, in accordance with this Contract, including this HIPAA Business Associate Clause and the Contract's clause entitled "CMS Information Security."

ii. Use administrative, physical and technical safeguards to prevent use or disclosure of PHI created, received, maintained or transmitted by Business Associate from, or on behalf of Covered Entity only as provided for by this Contract. In doing so, it shall implement policies and procedures to address the following and, where applicable, ensure that such policies and procedures are also in conformance with this Contract's clause entitled "CMS Information Security:"

A. Prevent, detect, contain and correct security violations through the use of:

a. Risk analyses (including periodic technical and nontechnical evaluations);

b. Appropriate risk management strategies, including system activity review;

c. Information access procedures for approving individual's access rights to PHI (including the implementation of workforce security measures to ensure continued appropriate role-based access to PHI), and technical policies and procedures to ensure compliance with grants of access (including unique user identification and tracking of users) and;

d. The imposition of sanctions for violations.

B. Limit physical access to its electronic information systems and the facility or facilities in which they are housed.

C. Implement policies, procedures and physical security measures that will limit access to PHI through workstations and other devices, including access through mobile devices.

D. Implement media controls covering the movement of devices containing PHI within or outside of the Business Associate's facility as well as the disposal and reuse of media containing PHI.

E. Implement appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability (including the use of contingency plans) of any electronic protected health information ("EPHI") it creates, receives, maintains or transmits from, or on behalf of the Covered Entity to prevent impermissible use, disclosure, maintenance or transmission of such EPHI. In the establishment of such safeguards, Business Associate shall consider its size, complexity and capabilities, as well as its technical infrastructure, and its hardware and software security capabilities.

iii. Assess, and implement, where appropriate, any addressable implementation specifications associated with applicable PHI security standards.

iv. Mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Contract.

v. Comply with the following Incident Reporting:

A. Report to Covered Entity any security incident/breach involving unsecured PHI, of which it becomes aware, including those of its agents and subcontractors. The Business Associate shall report any violation of the terms of this contract involving PHI and any security incidents/breaches involving unsecured PHI to CMS within one (1) hour of discovery in accordance with the CMS Risk Management Handbook (RMH), specifically "RMH Vol II Procedure 7-2 Incident Handling Procedure" and "RMH Vol III Standard 7-1 Incident Handling." These procedures can be found at http://www.cms.gov/Research- Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity /Information-Security-Library.html In addition, the Business Associate will also notify the CMS Contracting Officer and the Contracting Officer's Representative (COR) by email within one (1) hour of identifying such violation or incident.

B. Upon Covered Entity's knowledge of any material security incident/breach by Business Associate, Covered Entity will provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination clause of this Contract. See also paragraph D. Term of Clause below.

vi. Ensure that any agent or subcontractor agrees through a written contract, or other legally enforceable arrangement, to the same restrictions and conditions that apply through this HIPAA Contract Clause, when creating, receiving, maintaining or transmitting PHI from, or on behalf of, Covered Entity.

vii. Upon Covered Entity's request:

A. Provide the Covered Entity or its designee with access to the PHI created, received, maintained or transmitted by Business Associate from or on behalf of the Covered Entity in the course of contract performance in order to ensure Covered Entity's ability to meet the requirements under 45 CFR 164.524.

B. Amend PHI as Covered Entity directs or agrees to pursuant to 45 CFR 164.526.

viii. Make its facilities and any books, records, accounts, and any sources of PHI, including any policies and procedures, that are pertinent to ascertaining its own compliance with this contract or the Covered Entity's compliance with the applicable HIPAA requirements, available to Covered Entity, or, in the context of an investigation or compliance review, to the Secretary for purposes of the Secretary determining Covered Entity's compliance with the various rules implementing the HIPAA.

ix. Document disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.

x. Provide to Covered Entity, or an individual identified by the Covered Entity, information collected under this Contract, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR 164.528.

xi. Make reasonable efforts to limit the PHI it uses, discloses or requests to the minimum necessary to accomplish the intended purpose of the permitted use, disclosure or request.

c. Obligations of Covered Entity

Covered Entity shall notify Business Associate of any:

1. Limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI;

2. Changes in, or revocation of, permission by an Individual to use or disclose their PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI; and,

3. Restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of

PHI.

d. Term of Clause

1. The term of this Clause shall be effective as of date of Contract award, and shall terminate when all of the PHI provided to Business Associate by the Covered Entity or a Business Associate of the Covered Entity, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity in accordance with "CMS Information Security" procedures. Business Associate shall not retain any PHI.

2. Security Incident/Breach:

Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall take action consistent with the terms of this Contract, and, as appropriate, the following:

i. Federal Acquisition Regulation (FAR) Contracts - Covered Entity may:

A. Terminate this Contract in accordance with FAR Part 49, Termination of Contracts, if the Business Associate does not cure the security incident/breach within the time specified by Covered Entity and/or cure is not possible; or, B. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

ii. Other Agreements - Covered Entity shall either:

A. Provide an opportunity for Business Associate to cure the breach or end the violation consistent with the termination terms of this Contract. Covered Entity may terminate this Contract for default if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; or, B. Consistent with the terms of this Contract, terminate this Contract for default if Business Associate has breached a material term of this Contract and cure is not possible; or, C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

3. Returning or Destroying PHI:

Business Associate, as defined above, which includes subcontractors or agents of the Contractor, shall:

i. Upon expiration or termination of this Contract, for any reason, return or destroy all PHI received from Covered Entity or another Business Associate of the Covered Entity, as well as any PHI created, received, maintained or transmitted from or on behalf of Covered Entity, or another Business Associate of the Covered Entity, in accordance with this contract, including the "CMS Information Security" clause.

ii. In the event that Business Associate determines that returning or destroying the PHI is infeasible, provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon such notice that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

e. Miscellaneous

1. A reference in this Contract to a section in the Rules issued under HIPAA means the section as in effect or as amended.

2. The respective rights and obligations of Business Associate under paragraph D.3.b of the section entitled "Term of Clause" shall survive the termination of this Contract.

Any ambiguity in this Contract clause shall be resolved to permit Covered Entity to comply with the Rules implemented under HIPAA.

H. CMS INFORMATION SECURITY (OCT 2020)3

All CMS information shall be protected from unauthorized access, use, disclosure, duplication, modification, diversion, or destruction, whether accidental or intentional, in order to maintain the security, confidentiality, integrity, and availability of such information. Therefore, if this contract requires the contractor to provide services (both commercial and non-commercial) for Federal Information/Data, to include any of the following requirements:

Process any Information/Data; or Store any Information/Data (includes "Cloud" computing services); or Facilitate the transport of Information/Data; or Host/maintain Information/Data (including software and/or infrastructure developer/maintainers); or

Have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to, or physical removal of, such information beyond agency premises or control, The contractor shall become familiar and remain compliant with all aspects of the Statement of Work (SOW), Statement of Objectives (SOO), Performance Work Statement (PWS), which includes CMS Information Security requirements.

The contractor shall ensure that the following Federal information security standards are met for all of its CMS contracts:

Federal Information Security Management Act (FISMA) - FISMA information can be found at https://csrc.nist.gov

. FISMA requires each Federal agency to develop, document, and implement an agency-wide /projects/risk-management program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source; and, Federal Risk and Authorization Management Program (FedRAMP) - FedRAMP information can be found at . The FedRAMP is a government-wide program that https://www.gsa.gov/technology/government-it-initiatives/fedramp provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

The Contractor shall include in all awarded subcontracts the FISMA/FedRAMP compliance requirements set forth at the CMS Information Security website at https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology

./InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements

H. Mandatory Contractor Training (SEP 2024)4

All contractor employees who have access to (1) HHS Federal Information or a Federal information system or (2) personally identifiable information shall complete the CMS provided Records management training required by the Department of Health and Human Services (HHS) before performing any work under their contract. Thereafter, the employees must complete annual Records Management training throughout the life of the contract. The Contractor shall also ensure subcontractor compliance with this training requirement.

Link to the training can be found here: https://www.cms.gov/about-cms/work-us/business- resources/contractor-information /training

Contractor employees are expected to complete any new training requirements enacted by HHS, whereby access to the course material has been provided. These courses are at no additional cost to the contract and the contractor is not required to provide documentation on such training unless specifically requested. The Government does not anticipate a contractor will develop a system specifically designed to track and monitor such trainings, but will address the requirements under overall contract management and adherence to regulations as noted in the Contractor Performance Assessment Reporting System (CPARS).

(End of Section)

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

52.202-1 Definitions. Jun 2020

52.203-17 Contractor Employee Whistleblower Rights. Nov 2023

52.203-5 Covenant Against Contingent Fees. May 2014 https://csrc.nist.gov/projects/risk-management https://csrc.nist.gov/projects/risk-management https://www.gsa.gov/technology/government-it-initiatives/fedramp https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Info-Security-Library-Items/CMS-Security-and-Privacy-Language-for-Procurements

52.203-6 Restrictions on Subcontractor Sales to the Government. Jun 2020

52.203-6 Restrictions on Subcontractor Sales to the Government.- Alternate I

Nov 2021

52.203-7 Anti-Kickback Procedures. Jun 2020

52.204-19 Incorporation by Reference of Representations and Certifications.

Dec 2014

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities.

Dec 2023

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

Nov 2021

52.212-4 RFO Terms and Conditions—Commercial Products and Commercial Services.

RFO DEVIATION NOV

52.222-50 Combating Trafficking in Persons. Oct 2025

52.222-50 Combating Trafficking in Persons.-Alternate I Mar 2015

52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving.

MAY 2024

52.232-1 Payments. Apr 1984

52.232-39 Unenforceability of Unauthorized Obligations. Jun 2013

52.232-40 Providing Accelerated Payments to Small Business Subcontractors.

Mar 2023

52.233-3 Protest after Award. Aug 1996

52.233-3 Protest after Award.-Alternate I Jun 1985

52.233-4 Applicable Law for Breach of Contract Claim. Oct 2004

52.240-1 Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities.

Nov 2024

52.244-6 Subcontracts for Commercial Products and Commercial Services.

Oct 2025

FAR Clauses Incorporated by Full Text

52.212-5 Dev Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Products and Commercial Services Feb 2025 DEVIATION

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31U.S.C. 3903 and 10U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 (19 U.S.

C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders…