RFQ 75N95021Q00166 and Attachments.pdf

RFQ 75N95021Q00166

REQUEST FOR QUOTE

TABLE OF CONTENTS

Standard Form 18, Request for Quotation

Part I - INSTRUCTIONS TO OFFERORS

Article 1 - General Article 2 - Quote Submission Article 3 - Requests for Clarification Article 4 - Socioeconomic Program Evaluation Factor Article 5 - Evaluation of Quote and Award Determination Article 6 - Evaluation Criteria

Article 7 - Quote Instructions

Part II - TERMS AND CONDITIONS

General Price Contact Points Contracting Officer’s Representative / Project Officer Invoice Submission Instructions Special Contract Requirements Provisions and Clauses

Part III – Statement of Work (SOW)

PART I - INSTRUCTIONS TO OFFERORS

ARTICLE 1 - General

This request for quote is issued in accordance with the Federal Acquisition Regulation (FAR) subpart 13.106-1.

In accordance with the procedures of FAR subpart 13.106-1, the National Institute on Drug Abuse (NIDA) intends to award a single firm-fixed-price contract with an Offeror that can provide the services outlined in the SOW that represents the best value.

The North American Industry Classification System (NAICS) code 541713 is applicable to this requirement.

This request for quote does not commit the Government to pay any cost incurred in the submission of quotes or make necessary studies or designs for the preparation thereof, nor to procure or contract for the articles or services. It is also brought to your attention that the Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds in connection with this proposed procurement. Any other commitment, either explicit or implied, is invalid.

In addition to the clauses/provision of this request for quote, the resultant Purchase Order shall include any clauses/provisions required by Public Law, Executive Order, or acquisition regulations, in effect at the time of execution of the award.

Responses’ to this RFQ are not to be considered an offer that can be accepted by the Government to form a binding contract. The actual Purchase Order award, is considered the offer by the Government to the Offeror and the Offeror's written acceptance of the order, or the commencement of performance under the order, is the Offeror’s indication of their acceptance of the offer.

THE GOVERNMENT RESERVES THE RIGHT TO MAKE AN AWARD WITHOUT

FURTHER DISCUSSIONS OF THE QUOTES RECEIVED. THEREFORE, IT IS

IMPORTANT THAT YOUR QUOTE BE SUBMITTED INITIALLY ON THE MOST

FAVORABLE TERMS FROM BOTH THE TECHNICAL AND PRICE STANDPOINTS.

The Offeror shall direct all communications to the attention of the Contract Specialist / Contracting Officer.

All documents and deliverables described in this RFQ and amendments or modifications, shall be submitted in a professional manner and on the prime Offeror's letterhead. All work (hardware, software and services) will be Year 2000 Compliant.

ARTICLE 2 - Quote Submission

A searchable electronic copy of the Technical and Business quote are due on June 4th, 2021 at 3:00 p.m. Eastern Standard Time via email submitted to Shaun.Rostad@nih.gov.

Offerors shall include separate technical and business quotes. The Contractor must submit with their quote the following attachments:

• Signed 52.204-24 Representation Against Surveillance Equipment Form;

• Verification of System for Award Management (SAM) Registration www.sam.gov;

ARTICLE 3 - Requests for Clarification –

Questions may be submitted to Shaun Rostad at Shaun.Rostad@nih.gov up to May 28th, 2021 at 3:00 p.m. Eastern Standard Time.

ARTICLE 4 - Socio-Economic Program Evaluation Factor

This Purchase Order is set aside for the following socio-economic business concern:

8(a) HUBZone SDVOSB Small Business

This Purchase Order is not set-aside for a socio-economic business concern.

mailto:Shaun.Rostad@nih.gov http://www.sam.gov/ mailto:Shaun.Rostad@nih.gov

ARTICLE 5 - Evaluation of Quotes and Award Determination

The Government will evaluate all responses received using the evaluation criteria set forth in the article titled: “Evaluation Criteria.”

Evaluations will be conducted in accordance with FAR Subpart 13.106-2. The merits of each quote will be evaluated carefully. The evaluation will be based on the evaluation of the quote in relation to the scope of work, evaluation criteria, and any applicable non-price factors.

Paramount consideration shall be given to the evaluation of technical factors.

The award will be made on a competitive best value basis, using “tradeoff” among price factors.

The Government may elect to award to other than the lowest priced offeror, or other than the offeror with the highest rated non-price quote. In either case, a tradeoff will be conducted. The government reserves such right of flexibility in conducting the evaluation as necessary to assure an award with the Contractor providing the best value to the government.

Although technical factors are of paramount consideration in the award, price is also important to the overall award decision. All evaluation factors other than price, when combined, are significantly more important than price. However, price may become a critical factor in source selection in the event two or more Offerors are determined to be essentially equal following the evaluation of all factors other than price.

Price will be evaluated for reasonableness in relation to the requirements. In addition, a final best-buy analysis will be performed taking into consideration the results of the technical evaluation, price analysis, and the offeror’s ability to complete the work within the Government's required schedule.

An award will be made to the Offeror whose quote conforms to the requirement and is most advantageous to the Government with technical merit, price, and other factors considered. The Government may request clarifying information from the Offeror, as it relates to its quote.

Potential award without discussions. The Government reserves the right to award a Purchase Order without discussions if the Contracting Officer determines that the initial prices are fair and reasonable and that discussions are not necessary.

All aspects of a quote are subject to discussion, including price, technical approach and terms and conditions. At the completion of discussions, the Offeror will ensure its technical plan and price quote reflects the mutual understandings of the requirement and if requested, submit a revised technical plan and price quote to the Contracting Officer. The technical plan should consist of the Offeror’s intent and approach to this particular effort, any considerations that should be made by the government, as well as any additional information that expresses the Offeror’s position above others for this effort.

If an award will be made without conducting discussions, Offerors may be given the opportunity to clarify certain aspects of their quote (e.g., the Offeror's past performance information, and adverse past performance information to which the Offeror has not previously had an opportunity to respond) or to resolve minor or clerical errors.

The Government reserves the right to make a single award, multiple awards, or no award at all as a result of the RFQ. In addition, the RFQ may be amended or canceled as necessary to meet the Government’s requirements.

ARTICLE 6 - Evaluation Criteria

The purpose and objective of this requirement is to obtain the services as outlined in the SOW.

The quote will be evaluated against the evaluation factors identified below. The factors are listed in the order of relative importance. Technical Evaluation Criteria Sub-factors are also listed in the order of relative importance with weights assigned for evaluation purposes. Offerors must submit information sufficient to evaluate their quote based on the detailed evaluation factors.

A. Technical Evaluation

The award will be made on a competitive best value basis, using the “tradeoff’ approach among price and non-price factors. The Government may elect to award to other than the lowest priced Offeror, or other than the highest rated non-price quote. In either case, a tradeoff will be conducted. The Government reserves such right of flexibility in conducting the evaluation as necessary to assure an award with the Offeror providing the best value to the government.

1. Technical Evaluation Criteria Sub-Factors

a. Factor 1: Technical Approach: 50 Points

The Offeror’s quote shall describes its approach, process, and methodology to successfully perform each requirement and task described in the SOW with sufficient detail to demonstrate a clear understanding of the approach and compliance with requirements.

b. Factor 2: Key Personnel Qualifications: 25 Points

Offerors quote shall be evaluated on its description and ability to provide the qualified key personnel requirements identified in the SOW. Offeror quote must contain a resume/CV.

c. Factor 3: Past Performance: 25 Points

The Offeror shall provide a list of two (2) past performance references with knowledge of the Offeror’s relevant skills and experience related to the requirements outlined in this SOW. References shall include the following information:

a. Name of Organization

b. Description of Offeror’s responsibilities as they relate to this SOW

c. Contract Period of Performance

d. Contact Name and Title

e. Telephone Number

f. E-mail address

Past Performance shall be evaluated for relevance to the current requirement.

B. Business Evaluation:

Offerors price quote will be evaluated for reasonableness. For a price to be reasonable, it must represent a price to the government that a prudent person would pay when consideration is given to prices in the market. Normally, price reasonableness is established through adequate price competition, but may also be determined through price analysis techniques.

Price evaluation will not be conducted on any Offeror determined to be technically unacceptable.

Although technical factors are of paramount consideration in the award, price is also important to the overall Purchase Order award decision. All evaluation factors other than price, when combined, are significantly more important than price. The Government intends to make an award(s) to that offeror whose quote provides the best overall value to the Government.

C. Evaluation of Options

It is anticipated the award from this RFQ will contain option provision(s) and period(s). In accordance with FAR Clause 52.217-5, Evaluation of Options, (July 1990), the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement, except when it is determined in accordance with FAR 17.206(b) not to be in the Government's best interests. Evaluation of options will not obligate the Government to exercise the option(s).

ARTICLE 7 - Quote Instructions

A. Technical Quote Instructions and Format

The Technical Quote is the most important item in the evaluation of the Offeror’s capability to perform the desired services. Therefore, the quote must present sufficient information to reflect a thorough understanding of the work requirements and a detailed technical approach for achieving project objectives as set forth in the SOW.

The Technical Quote may NOT contain any references to price. However, resource information, such as data concerning proposed other direct prices, must be contained in the Technical Quote so that Offeror’s understanding of the scope of work may be evaluated.

All aspects of a quote are subject to discussion, including price, technical approach, and terms and conditions. At the completion of discussions, the Offeror must ensure its technical plan and price quote reflect the mutual understandings of the requirement and, if requested, submit a revised technical plan and price quote. The technical plan should consist of the Offeror’s intent and approach to the requirements, any considerations that should be made by the Government, as well as any additional information that expresses the Offeror’s position above competitors for this effort.

The Technical Quote must be submitted in the following format:

1. Transmittal and Quote Cover Page which includes the following information:

a. Solicitation / RFQ Number

b. Date of submission

c. Quote Due Date

d. Company Name mailing address, telephone number, and website address

e. Company Point of Contact, telephone number, and Email address (person to be contacted concerning any matter related to the quote, e.g., quote revisions, presentations, discussions, etc.).

f. Dun & Bradstreet Number (DUNS), the Taxpayer Identification Number (TIN), and the certification of business size must be included in the response. All offerors must have an active registration in the System for Award Management (SAM)

2. Technical Quote must be clearly labeled and logically structured to identify the following components:

i. Statement of Understanding – The Offeror shall provide a Statement of

Understanding that describes its approach, process, and methodology to successfully perform each requirement and task described in the SOW with sufficient detail to demonstrate a clear understanding of the approach and compliance with requirements.

ii. Key Personnel – The Offeror shall describe and demonstrate the ability to provide the qualified key personnel requirements identified in the SOW. Offeror quote must contain a resume/CV.

iii. Past Performance Information – The Offeror shall provide a list of two (2) past performance references with knowledge of the Offeror’s relevant skills and experience related to the requirements outlined in this SOW. References shall include the following information:

a. Name of Organization

b. Description of Offeror’s responsibilities as they relate to this SOW

c. Contract Period of Performance

d. Contact Name and Title

e. Telephone Number

f. E-mail address

iv. Section 508 Compliance – As applicable, the Offeror must demonstrate compliance with the "Electronic and Information Technology Accessibility Provisions" set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access Board") in 36 CFR part 1194 for all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order, including EIT deliverables such as electronic documents and reports.

v. Approach to and Compliance with HHS Security and Privacy Language for Information and Information Technology – The Offeror shall describe its approach and ability to comply with the with the Security and Information Technology requirements defined in the HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS section of this document.

vi. Option Quantities – The Offeror shall describe its approach to provide programmatic support through the Option Quantities for additional Grassroots Outreach and Community Partnership support. The NIDA IRP Principal Investigators (PIs) may require additional financial support separately from the tasks defined in the SOW. The NIDA IRP has multiple primary PIs who may require additional outreach services individually or jointly as necessary based on current protocol needs. Through these Options for Increased Quantity, the Contractor may be required to provide additional support for community outreach support as described in the SOW.

B. Business Quote Instructions and Format

A firm-fixed-price (FFP) quote is requested. The FFP quote shall be based on the level of effort required to perform the services described in the SOW. The price quote is submitted separately from the Technical Quote for each task/sub-task as specified in the PO’s SOW and for each year / partial year of the period of performance, and option periods, including a summary of the prices for the entire period of performance. The FFP quote must be submitted in the format below.

1. Base Period

2. Option Periods 1, 2, 3 and 4

The price quote shall indicate the proposed labor categories, the estimated number of labor hours, fixed hourly rates, and the total amount for the FFP.

A complete explanation detailing the rationale for each item of other direct prices must be included in the quote. In addition, the rationale should be sufficient enough to determine that the other direct prices are fair and reasonable.

The price quote should contain all information necessary to allow for a comprehensive

Contract Line Item Description Quantity Unit Unit Price Total Price

NanoSIMS 50 L analysis 2.00 Weeks -$ Option Qty: Additional NanoSIMS 50 L analysis 1.00 Weeks -$ Total Estimated Amount -$

Base Period

Contract Line Item Description Quantity Unit Unit Price Total Price Quantity Unit Unit Price Total Price Quantity Unit Unit Price Total Price Quantity Unit Unit Price Total Price

NanoSIMS 50 L analysis 2.00 Weeks -$ -$ 2.00 Weeks -$ -$ 2.00 Weeks -$ -$ 2.00 Weeks -$ -$ Option Qty: Additional NanoSIMS 50 L analysis 1.00 Weeks -$ -$ 1.00 Weeks -$ -$ 1.00 Weeks -$ -$ 1.00 Weeks -$ -$ Total Estimated Amount -$ -$ -$ -$

Option Period One (Contract Year Two) Option Period Four (Contract Year Five)Option Period Three (Contract Year Four)Option Period Two (Contract Year Three) evaluation of the prices including an accompanying narrative that fully describes all assumptions made by the Offeror.

The price quote should contain sufficient information to determine the reasonableness of services proposed and to evaluate whether the proposed prices are consistent with the Technical Quote.

No property or equipment shall be purchased under this requirement.

The provisions of FAR Clause 52.217-5 – Evaluation of Options (July 1990) are applicable to the requirement. The Government will evaluate offers, for award purposes, by adding the total price for all options to the total price for the basic requirement, except when it is determined in accordance with FAR 17.206(b) not to be in the Government's best interests.

Evaluation of options will not obligate the Government to exercise the option(s).

The price quote must be submitted in a Microsoft Excel or PDF format. There are no page limits for the price quote. The price quote must be submitted for each year / partial year of the period of performance, including a summary of the price for the entire period of performance.

The price quote must be labeled and identified as:

a. Business Quote

1. Purchase Order Pricing

PLEASE READ THE FOLLOWING INFORMATION CAREFULLY:

The response to the Request for Quote is due on June 4th, 2021 at 3:00 p.m. Eastern Standard Time. The response must be submitted in an electronic format to the Contract Specialist citing the RFQ number and the name of firm in the subject line via email to Shaun.Rostad@nih.gov.

mailto:Shaun.Rostad@nih.gov

PART II

TERMS AND CONDITIONS

a. In responding to this RFQ, it is the Offeror’s responsibility to provide current, relevant, complete, and accurate information in their quotation.

b. This RFQ does not commit the Government to pay any cost incurred in the submission of quotes or make necessary studies or designs for the preparation thereof, nor to procure or contract for the products or services.

c. The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds in connection with this RFQ. Any other commitment, either explicit or implied, is invalid.

d. A response to this RFQ is not to be considered an offer that can be accepted by the

Government to form a binding contract. The actual contract is considered the offer by the Government to the Contractor and the Contractor's written acceptance of the contract, or the commencement of performance under the order, is the Contractor's indication of their acceptance of the offer.

e. In addition to the clauses and/or provisions of this RFQ, the resultant contract may include any clauses and/or provisions required by Public Law, Executive Order, or the Health and Human Services Acquisition Regulations (HHSAR) applicable to or in effect at the time of execution of the award.

f. Potential award without discussions. The Government reserves the right to award a contract without discussions if the Contracting Officer determines that the initial prices are fair and reasonable and that discussions are not necessary.

g. If an award will be made without conducting discussions, the Offeror may be given the opportunity to clarify certain aspects of its quote (e.g., past performance information, and adverse past performance information) to which the Offeror has not previously had an opportunity to respond or to resolve minor or clerical errors.

h. The RFQ may be amended or canceled, as necessary, to meet the Government’s requirements.

i. All documents and deliverables described in this RFQ and amendments or modifications, shall be submitted in a professional manner and on the prime Offeror’s letterhead. All work (hardware, software and services) must be Year 2000 Compliant.

PRICE

The final Purchase Order will contain the price provisions agreed upon by the Government and the Offeror.

CONTACT POINTS

Contracting Officer’s Representative (COR):

TBD at time of award

Contract Specialist:

Name: Shaun Rostad E-mail: shaun.rostad@nih.gov

Contracting Officer:

Name: Joshua T. Lazarus E-mail: josh.lazarus@nih.gov

The primary contact for the Contractor will be with the COR, who will provide information, provide clarifications to the requirement, and answer questions. All correspondence, letters, reports, and other deliverables will be submitted to the COR for acceptance.

CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The following COR will represent the Government for the purpose of this contract:

TBD at time of award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the SOW and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the Purchase Description; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

The Government may unilaterally change its COR designation.

INVOICE SUBMISSION INSTRUCTIONS – REFER TO ATTACHMENT 3

HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT

PROCUREMENTS

A. BASELINE SECURITY REQUIREMENTS

1. Applicability- The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

mailto:shaun.rostad@nih.gov mailto:josh.lazarus@nih.gov

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

i. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

iii. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

mailto:fisma@hhs.gov

Confidentiality: [X] Low [ ] Moderate [ ] High Integrity: [X] Low [ ] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Risk Level: [X] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level

6 positions shall undergo a Suitability Determination and Background Investigation

(MBI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive. Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Check and Inquiry Investigation (NACI).

5. Homeland Security Presidential Directive (HSPD)-12

Roster-

i. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for Contractor use at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_ 10-15-12.xlsx.

ii. If the Contractor is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level. Upon receipt of the Government's notification of applicable Suitability Investigations required, https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx the Contractor shall complete and submit the required forms within 30 days of the notification.

iii. Upon receipt of the Government's notification of applicable Suitability Investigations required, the Contractor shall complete and submit the required forms within 30 days of the notification.

iv. The Contractor shall notify the Contracting Officer in advance when any new personnel, who are subject to a background check/investigation, will work under the contract and if they have previously been the subject of national agency checks or background investigations.

v. All Contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract. Contractors may begin work after the fingerprint check has been completed.

vi. Investigations are expensive and may delay performance, regardless of the outcome of the investigation. Delays associated with rejections and consequent re-investigations may not be excusable in accordance with the FAR clause, Excusable Delays - see FAR 52.249-14. Accordingly, the Contractor shall ensure that any additional employees whose names it submits for work under this contract have a reasonable chance for approval.

vii. Typically, the Government investigates personnel at no cost to the Contractor. However, multiple investigations for the same position may, at the Contracting Officer's discretion, justify reduction(s) in the contract price of no more that the cost of the additional investigation(s).

viii. The Contractor shall include language similar to this "HHS Controlled Facilities and Information Systems Security" language in all subcontracts that require subcontractor personnel to have the same frequency and duration of (1) physical access to an HHS-controlled facility; (2) logical access to an HHS-controlled information system; (3) access to sensitive HHS data/information, whether in an HHS-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3).

ix. The Contractor shall direct inquiries, including requests for forms and assistance, to the Contracting Officer or designee.

x. Within 7 calendar days after the Government's final acceptance of the work under this contract, or upon termination of the contract, the Contractor shall return all identification badges to the Contracting Officer or designee.

6. Contractor Non-Disclosure Agreement (NDA) Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

7. Training Records

i. Mandatory Training for All Contractor Staff- All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf course at http://irtsectraining.nih.gov/ before performing any work under this contract.

Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies

8. Rules of Behavior

i. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and comply with the NIH Information Technology General Rules of Behavior https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html , which are contained in the NIH Information Security Awareness Training Course http://irtsectraining.nih.gov

ii. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the Contractor, the signed Rules of Behavior must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

9. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cyber security and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as "a suspected or confirmed incident involving PII" .

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

http://irtsectraining.nih.gov/ https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html http://irtsectraining.nih.gov/

ii. DO NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send NIH approved notifications to affected individuals individuals in accordance with https://wiki.ocio.nih.gov/wiki/index.php/US- CERT_Federal_Incident_Notification_Guidelines .

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT) via email at IRT@mail.nih.gov , COR, CO, the NIH Office of the SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information HHS and NIH incident response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to Contractor facilities during a breach/incident investigation within an hour of discovery.

10. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

11. Contract Initiation and Expiration

i. General Security Requirements- The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the Contractor shall follow the https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines https://wiki.ocio.nih.gov/wiki/index.php/US-CERT_Federal_Incident_Notification_Guidelines mailto:IRT@mail.nih.gov

HHS EPLC framework and methodology or and in accordance with the HHS Contract Closeout Guide (2012). HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html

ii. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

iii. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

iv. Notification- The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within fifteen days before an employee stops working under this contract.

v. Contractor Responsibilities Upon Physical Completion of the Contract- The Contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

vi. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this contract within 2 days of the employee's exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

12. ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY NOTICE

HHSAR 352.239-73 (December 2015)

i. Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the

Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

https://www.hhs.gov/ocio/ea/documents/proplans.html https://www.hhs.gov/ocio/ea/documents/proplans.html https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf

ii. Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508 . The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and standards/ communications-and-it/about-the-section-508-standards.

iii. The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-74, Electronic and Information Technology Accessibility. In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self- evaluate their supplies and document--in detail--whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http:// www.hhs.gov/web/508. In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

iv. Respondents to this solicitation must identify any exception to Section 508 requirements.

If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

Federal Acquisition Regulations (FAR) Clauses and Provisions Incorporated by Reference The Federal Acquisition Regulations clauses and provisions are incorporated by reference into this award.

1. Option Provisions

a. Unless the Government exercises its option pursuant to the Option Clause set forth herein, the Purchase Order will consist only of the Base Period of the SOW as defined herein.

b. Pursuant to clauses 52.217-7 and 52.217-9 set forth below of this Purchase Order, the

Government may, by unilateral Purchase Order modification, require the Contractor to perform additional options set forth in the SOW and also defined herein. If the Government exercises this option, notice must be given at least 10 days prior to the expiration date of this order, and the price of the order will be increased as set forth in the OPTION PRICES Article in PRICE SECTION of this order.

http://www.hhs.gov/web/508

1. 52.217-5 Evaluation of Options (July 1990). Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate quotes for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s). (End of provision)

2. 52.217-7 Option for Increased Quantity—Separately Priced Line Item (Mar

1989). The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days of the expiration date of the order. Delivery of added items shall continue at the same rate that like items are called for under the Purchase Order, unless the parties otherwise agree. (End of clause)

3. 52.217-9 Option to Extend the Term of the Contract (Mar 2000).

(a) The Government may extend the term of this order by written notice to the Contractor any time prior to order expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 10 days before the order expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended Purchase Order shall be considered to include this option clause.

(c) The total duration of this Purchase Order, including the exercise of any options under this clause, shall not exceed 5 years. (End of clause)

2. Additional Clauses:

1. 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (Oct 2020)

2. 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Aug 2020)

3. 52.213-4 Terms and Conditions-Simplified Acquisitions (Other Than Commercial Items)

4. 352.239-74 Electronic and Information Technology Accessibility (Dec 2015)

NATIONAL INSTITUTES OF HEALTH (NIH) PROVISIONS AND CLAUSES

1. Promoting Efficient Spending

a. On September 21, 2011, the Office of Management and Budget issued Memorandum M- 11-35 , entitled, "Eliminating Conference Spending and Promoting Efficiency in http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-35.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/2011/m11-35.pdf

Government," emphasizing the President's priority to ensure that the Government operates with the utmost efficiency and eliminates unnecessary or wasteful spending. This was followed by the Executive Order on Delivering an Efficient, Effective, and Accountable Government ( EO 13576 ) and the Executive Order on Promoting Efficient Spending (EO 13589). On January 3, 2012, the Department of Health and Human Services (DHHS) issued the memorandum "HHS Policy on Promoting Efficient Spending: Use of Appropriated Funds for Conferences and Meetings, Food, Promotional Items, and Printing, and Publications" (See http://www.hhs.gov/asfr/ogapa/acquisition/effspendpol_memo.html ).

b. In support of these directives, the NIH issued a January 30, 2012, Memorandum, entitled, "NIH Guidance Related to the HHS Policies on Promoting Efficient Spending: Use of Appropriated Funds for Conferences, Conference Grants and Meetings, Food, Promotional Items, and Printing and Publications." (See http://oamp.od.nih.gov/ )

2. Acknowledgement of Federal Funding

The Contractor shall clearly state, when issuing statements, press releases, requests for quotes, bid solicitations and other documents…