RFQ CDER-2025-131004.pdf

Guardrail (or equal) Cloud-based management software

COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL ITEMS

General Information

Document Type: Combined Solicitation/Synopsis

Solicitation Number: CDER-2025-131004

Posted Date: 09/18/2025

Original Response Date: 09/25/2025

Product or Service Code: 7030

Set Aside: None

NAICS Code: 541519

Contracting Office- HHS/Food and Drug Administration

Description

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for

Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation;

quotations are being requested, and a written solicitation document will not be issued.

This solicitation is a request for quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-101 10-26-

2018. This solicitation is being requested as Brand Name or Equal IAW FAR 52.211-6.

The associated North American Industrial Classification System (NAICS) code for this procurement is 541519, Guardrail (or equal) License with support

All interested companies shall quotations for the following:

U.S. Food and Drug Administration Office of the Commissioner

Klick Inc. Guardrail (or equal) Cloud-based Management Software

1. Background The Food and Drug Administration (FDA) is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that emit radiation. The FDA also has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors. Additionally, the FDA is responsible for advancing the public health by helping to speed innovations that make medical products more effective, safer, and more affordable and by helping the public get the accurate, science-based information they need to use medical products and foods to maintain and improve their health.

The U.S. Food and Drug Administration’s (FDA) Office of Prescription Drug Promotion (OPDP) is tasked with ensuring that prescription drug promotional materials are truthful, fairly balanced, and not misleading. This mandate is critical to safeguarding public health by preventing the dissemination of misleading information about prescription medications.

2. Objective In recent years, the volume of promotional materials submitted by the life sciences industry has been steadily increasing, with current estimates reaching approximately 150,000 pieces annually. Despite this growth, it is infeasible to increase staff to accommodate the full volume.

With consistent staffing levels, it is perhaps unsurprising that the number of enforcements actions has remained relatively constant. The implication is that if the FDA could increase its capacity to comprehensively review all submitted materials (while holding headcount constant) it might identify additional instances where enforcement and industry guidance are needed.

To address this challenge, the FDA needs commercially available Klick Group’s Guardrail™ software. Guardrail™ or equivalent is an AI-driven platform designed to automate the screening of promotional materials. By integrating Guardrail™ into the FDA’s Electronic Submissions Gateway (ESG), each submission could be systematically analyzed for consistency with approved labeling, enabling efficient identification of materials that warrant manual review. This approach aims to expand OPDP’s capacity to monitor promotional content effectively, enhancing compliance assurance and strengthening safeguards to public health.

3. Scope The purpose of this order is to procure Klick Inc. Guardrail (or equal) License with support..

If the Offeror is not proposing the brand name solution specified above, the proposed product shall meet the following salient, functional characteristics outlined in Section 4 in order to be considered for award:

4. Requirements

4.1 Software requirements

4.1.1 Salient Characteristics

In order for an Offeror’s solution to be deemed acceptable, the solution must meet the following salient characteristics:

• Ability to process and analyze promotional materials using Decision Intelligence + LLM hybrid architecture that enables precise tuning of logical reasoning pathways to align with specific regulatory interpretations while reducing false positive alerts.

• Ability to perform labeling consistency validation through scientific evaluation of promotional claims against FDA-approved prescribing information, addressing critical compliance indicators that competitive platforms lack.

• Ability to provide structured stepwise processing that uses Decision Intelligence engine to create systematic analytical plans and delegate specific subtasks to LLMs, avoiding inconsistency risks of single monolithic prompts.

• Ability to deliver comprehensive regulatory coverage by integrating both rules-based and guidance-based methodologies enhanced with Decision Intelligence logic for nuanced interpretation of FDA requirements.

• Ability to handle high-volume scalability for processing tens of thousands of promotional material submissions to address approximately 150,000 annual advertisement reviews through intelligent triage and prioritization.

• Ability to provide explainable decision-making with transparent, auditable rationales for all regulatory assessments rather than generating "black box" alerts, supporting defensible regulatory decisions.

• Ability to perform intelligent risk prioritization by flagging only high-relevance compliance risks with clear supporting rationales, contrasting with tools that rely on static pre-approved claim libraries.

• Ability to reduce reviewer cognitive load through precision in identifying genuine compliance concerns, minimizing false alerts and allowing regulatory reviewers to focus on substantive issues.

• Ability to operate with enhanced security and compliance architecture specifically designed to meet stringent public-sector and pharmaceutical-grade IT governance requirements for handling sensitive pre-approval content.

• Ability to support role-based security access control for different user types.

• Ability to operate via web-based user interface for accessibility across FDA network infrastructure.

• Ability to provide comprehensive audit trails for all analytical actions and regulatory assessments performed by the system.

• Ability to provide standard Application Programming Interfaces (APIs) that enable integration with FDA standard software systems and legacy applications.

• Ability to handle smart regulatory analysis generation for approximately 150,000 promotional material reviews annually with the ability to accommodate multiple concurrent users.

• Ability to provide version control for promotional materials under review and maintain historical analysis records.

• Ability to deliver on-premise deployment version of the software to meet FDA's security and data governance requirements.

• Ability to provide read-only integration access to the system's analytical database for real-time regulatory intelligence extraction and reporting.

4.1.2 Licensing and Support

The Offeror shall provide a licensing solution and software support and maintenance to meet OPDP’s needs.

License should be provided for six months.

5. Deliverables Deliverable Quantity/Frequency Due Date

Guardrail or equal pilot license One (1) six-month subscription

Within 30 days of contract award

Implementation Support 1 Within 30 days of option award

Note: Deliverable due date refers to the timeframe for the software to be accessible to users.

6. Inspection and Acceptance The Government shall review all reporting requirement deliverables in accordance with specifications and standards identified in the Call or any directives issued by the FDA COR. Reporting Requirements/Deliverables shall be submitted to the FDA COR or government designee in accordance to the delivery schedule. The acceptance of deliverables and satisfactory work performance, required herein, shall be based upon the timeliness and accuracy of the deliverables.

Contractor shall share information and provide full access to code, constructs, databases, and documentation while delivering integrated, cohesive business and technology services and products.

The level of required cooperation in the system or software development and testing processes is unprecedented in FDA’s experience and is central to the success of the endeavor. Products developed under this contract shall be considered to be owned by the Government and shall not be labeled ‘copyright’ or ‘proprietary’ or anything similar that might preempt the desired environment of fluid sharing and partnership.

Acceptance may be presumed unless, otherwise indicated in writing by the Contracting Officer, Contracting Officer’s Technical Representative (COR) or the duly authorized representative within 10 business days of receipt.

The Contractor shall implement necessary changes within 10 business days, or a mutually agreed upon period of time, from the day of change notification.

The FDA COR or the duly authorized representative shall perform inspection and acceptance of materials and services.

Any and all work products under this Call including, but are not limited to, source code, executable code, scripts, batch jobs, documentation, notes and meeting materials are the sole property of the US government.

Inspection and acceptance shall be performed at: 10903 New Hampshire Avenue, Silver Spring, Maryland 20993 or any other elated FDA facility.

7. Contract Administrative Information The Contractor shall ensure that all support personnel are adequately trained, possess the credentials specified in the appropriate labor categories, and are otherwise fully qualified to provide the high level of support required by this SOW prior to being assigned to Task Orders awarded.

8. Place of Performance The place of performance will be at the contractor location.

9. Period of Performance

The period of performance will be six (6) months.

10 Contract Type This is a Firm Fixed Price Contract.

11. Hours of Operations and Closing For the purposes of this contract, normal business hours will be Monday through Friday, between the hours of 8:30 AM and 5:00 PM Eastern Time (ET).

The following are exceptions to normal business hours:

• Emergency responses to system outages and system releases after hours will be determined on a case-by-case basis.

• Friday night, weekend, and holiday release implementations shall not be considered overtime.

• The Contractor shall make every effort to modify their work week to incorporate any evening, weekend, or holiday work into their normal 40-hour week.

• The Contractor shall have the option to work during Government holidays and shall not be considered overtime

• The Contractor shall typically not work more than 10 hours in one day.

For any other unscheduled closings, the Contractor shall seek guidance from the COR.

The Contractor is not required to provide on-site services on Federal holidays. The Government is closed on the holidays listed below. Specific dates for these holidays can be found at the Office of Personnel Management (OPM) website located at:

https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal- holidays/#url=Overview https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url%3DOverview https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/#url%3DOverview

• New Year’s Day

• Birthday of Martin Luther King, Jr.

• Washington’s Birthday

• Memorial Day

• Juneteenth

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

For specific task orders, the Contractor shall take into consideration the above holidays when developing project plans/schedules. In addition, the Contractor shall obtain additional blackout dates from the COR.

12. Government Point of Contact Contracting Officer- Steven D Gagnon, Steven.Gagnon@fda.hhs.gov

Contracting Officer’s Representative

TBD

12.1 Contracting Officer’s Authority

a) The Contracting Officer (CO) has responsibility for ensuring the performance of all necessary actions for effective contracting, ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this BPA and is the only person authorized to approve changes to any of the requirements under this BPA and resulting orders, and notwithstanding any provision contained elsewhere in this BPA, this authority remains solely with the CO.

b) No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this BPA. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the BPA. The Government will not reimburse the Contractor for any work not authorized by the Contracting Officer, including work outside the scope of the BPA.

13. Security and Privacy Requirements

13.1 Information Security and/or Physical Access Security Requirements

13.1.1 Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information; Integrity, which means guarding against improper information modification or destruction, and ensuring information non- repudiation and authenticity; and

b. Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X] Low [] Moderate [ ] High

Integrity: [ X] Low [] Moderate [ ] High http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Availability: [X ] Low [] Moderate [ ] High

Overall Risk Level: [X ] Low [] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes, PII Personally Identifiable Information (PII).

Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. Marked appropriately;

b. Disclosed to authorized personnel on a Need-To-Know basis.

c. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information

[PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA- provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that the COR is able to access and read any encrypted data.

• Company and point of contact name;

• Contract information;

• Impact classifications/threat vector;

• Type of information compromised;

• A summary of lessons learned; and

• Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future.

13.1.2 Media Transport

1) The Contractor and its employees shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital and non-digital media (e.g., CD- ROM, tapes, etc.), mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards).

2) All information, devices and media must be encrypted with HHS/FDA- approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities. Storage devices must be approved on the FDA Master Approved Technologies (MAT) list.

13.1.3 Boundary Protection: Trusted Internet Connections (TIC)

1) The contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities using cloud services is inspected by Trusted Internet Connection (TIC) processes.

2) The contractor shall route all external connections through a TIC.

3) Non-Repudiation. The contractor shall provide a system that implements FIPS 140-2 validated encryption that provides for origin authentication, data integrity, and, for high impact systems, signer non-repudiation.

http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

14. Section 508 Compliance Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs.

Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access- board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS- funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Sections apply to this procurement:

• E101.2 - Equivalent Facilitation

• E203 - Access to Functionality

• E204 - Functional Performance Criteria

• E205 - Electronic Content

• 302 - Functional Performance Criteria

• E208 Support Documentation and Services

• Chapter 6 - Support Documentation and Services http://www.access-board.gov/ http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/

Provision- HHSAR 352.239-73: Electronic and Information Technology Accessibility Notice (Dec 2015)

a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

b) Accordingly, any Quoter responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and- it/about-the-section-508-standards.

c) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239- 74, Electronic and Information Technology Accessibility.

15. Travel None

Contracting Officer and approval must be obtained by the Contracting Officer prior to reserving a rental vehicle.

15.1 Local Travel

Travel performed for personal convenience or daily travel to and from work at the Contractor’s facility or local Government facility (i.e., designated work site) within the Washington DC metro region shall not be reimbursed hereunder. “Local” is defined under this term as the travel destination located within the Washington, D.C., its surrounding metropolitan area, the Contractor’s facility and its surrounding area.

16. Invoicing Instructions HHSAR 352.232-71 Electronic Submission of Payment Requests (FEB 2022)

a. Definitions. As used in this clause—Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must https://www.hhs.gov/web/508 http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-352-solicitation-provisions-contract-clauses/index.html#352.239-74 https://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/part-352-solicitation-provisions-contract-clauses/index.html#352.239-74 comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

b. Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system.

Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

c. The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

d. If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of clause)

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

1. All Invoice submissions for goods and or services must be made electronically through the U.S.

Department of Treasury’s Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.htm

2. Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

3.

(1) The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3

– 5 business days of the contract award for new contracts or date of modification for existing contracts.

(2) Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

(3) The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

(4) If your company is already registered to use IPP, you will not be required to re-register.

(5) If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

4. Invoices that include Firm Fixed Price or labor hours Line Items must include supporting documentation to

(1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

5. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

(1) At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

http://www.ipp.gov/vendors/index.htm https://www.ipp.gov/

- Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

- Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

- Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

- Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

- Fee – amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

6. Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(1) list of all invoices submitted to date under the subject award, including the following:

- invoice number, amount, & date submitted

- corresponding payment amount & date received

- total amount of all payments received to date under the subject contract or order

- and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

7. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

8. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

9. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

10. The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

11. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

508 Standards

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, requires that all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the “Electronic and Information Technology Accessibility Provisions” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 1194. Information about Section 508 and new revision are available at http://www.section508.gov/.

All deliverables must meet HHS 508 compliance formatting based on the criteria available on HHS’s Making Files Accessible web page: http://www.hhs.gov/web/508/accessiblefiles/index.html

The following Section 508 provisions apply to the content or communications material identified in this SOW:

• Must meet WCAG 2.0 A and AA

• E101.2 - Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

• E203 - Access to Functionality (Appendix A, Application and Scoping Requirements)

• E204 - Functional Performance Criteria (Appendix A, Application and Scoping Requirements)

• E205 - Electronic Content (Appendix A, Application and Scoping Requirements)

• 302 - Functional Performance Criteria (Appendix C, Application and Scoping Requirements)

• Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section- 508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

• E207 - Software (Appendix A, Application and Scoping Requirements)

• E208 - Support Documentation and Services (Appendix A, Application and Scoping Requirements)

• Chapter 5 - Software (Appendix C, Functional Performance Criteria and Technical Requirements)

• Chapter 6 - Support Documentation and Services (Appendix C, Functional Performance Criteria and Technical Requirements)

17. Contract Clauses

HHSAR CLAUSES INCORPORATED BY REFERENCE

This contract incorporates one or more clauses by reference, noted in Title 48, Federal Acquisition Regulations System, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at:

http://farsite.hill.af.mil/VFHHSARA.HTM.

352.203-70 Anti Lobbying (December 18, 2015)

352.208-70 Printing and Duplication (December 18, 2015) http://farsite.hill.af.mil/VFHHSARA.HTM

352.222-70 Contractor Cooperation in Equal Employment Opportunity Investigations (December 18, 2015)

352.224-71 Confidential Information (December 18, 2015)

352.231-70 Salary Rate Limitation (December 18, 2015)

352.239-73 Electronic Information & Technology Accessibility Notice (December 15, 2015)

FAR CLAUSES

52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023)

(a) Definitions. As used in this clause—

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Information technology, as defined in 40 U.S.C. 11101(6)—

1. Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use—

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product.

2. Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

3. Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

(b) Prohibition. Section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328), the No TikTok on Government Devices Act, and its implementing guidance under Office of Management and Budget

(OMB) Memorandum M-23-13, dated February 27, 2023, “No TikTok on Government Devices” Implementation Guidance, collectively prohibit the presence or use of a covered application on executive agency information technology, including certain equipment used by Federal contractors. The Contractor is prohibited from having or using a covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor’s employees; however, this prohibition does not apply if the Contracting Officer provides written notification to the Contractor that an exception has been granted in accordance with OMB Memorandum M-23- 13.

(c) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts, including subcontracts for the acquisition of commercial products or commercial services.

52.203-17 Contractor Employee Whistleblower Rights (Nov 2023)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 41 U.S.C. 4712 and Federal Acquisition Regulation (FAR) 3.900 through 3.905.

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in FAR 3.900 through 3.905.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts.

52.232-40 Providing Accelerated Payments to Small Business Subcontractors. (Mar 2023)

(a) (1) In accordance with 31 U.S.C. 3903 and 10 U.S.C. 3801, within 15 days after receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

(2) The Contractor agrees to make such payments to its small business subcontractors without any further consideration from or fees charged to the subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the Prompt Payment Act.

(c) Include the substance of this clause, including this paragraph (c), in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial products or commercial services.

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://acquisition.gov/far/

52.204-13 – System for Award Management Maintenance (Oct 2018)

52.204-18 – Commercial and Government Entity Code Maintenance (Jul 2016)

52.212-4 – Contract Terms and Conditions – Commercial Items (Oct 2018)

52.232-39 – Unenforceability of Unauthorized Obligations (Jun 2013)

52.232-40 – Providing Accelerated Payments to Small Business Subcontractors (Dec 2013)

FAR 52.212-5 – Contract Terms and Conditions Required to Implement Statutes or Executive Orders- Commercial Items (Jan 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

https://acquisition.gov/far/ https://www.acquisition.gov/content/52203-19-prohibition-requiring-certain-internal-confidentiality-agreements-or-statements#i52_203-19 https://www.acquisition.gov/content/52204-23-prohibition-contracting-hardware-software-and-services-developed-or-provided-kaspersky-lab-and-other-covered-entities#id189A70O0P1N

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2019) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108- 78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

_X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.