RFQ Face App 75D301-23-Q-76498 6-2-23.pdf

11. DELIVERY FOR FOB

DESTINATION UNLESS

BLOCK IS MARKED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER

PAGE 1 OF

2. CONTRACT NO.

3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER

5. SOLICITATION NUMBER

75D301-23-Q-76498

6. SOLICITATION

ISSUE DATE

06/05/2023

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Diane J. Meeder

b. TELEPHONE NUMBER (No collect calls)

(412) 386-4412

8. OFFER DUE DATE/

LOCAL TIME

06/28/2023

2PM ET Local

9. ISSUED BY CODE 436 10. THIS ACQUISITION IS 12. DISCOUNT TERMS

Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 626 Cochrans Mill Rd Pittsburgh, PA 15236-0070

UNRESTRICTED

X SET ASIDE: 100 % FOR

X SMALL BUSINESS

SMALL DISADV. BUSINESS

8(A)

SIC: 541511

SIZE STANDARD: $34 million

X SEE SCHEDULE

13a. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

X RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE 436

Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 626 Cochrans Mill Rd Pittsburgh, PA 15236

Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 626 Cochrans Mill Rd Pittsburgh, PA 15236-0070 CODE 18a. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention (FMO) PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

“Face Measuring Mobile Application” (Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

28.

CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN COPIES

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET

FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT

TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29.

AWARD OF CONTRACT: REFERENCE OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (Signature of Contracting Officer)

30b. NAME AND TITLE OF SIGNER (Type or print)

30c. DATE SIGNED

31b. NAME OF CONTRACTING OFFICER (Type or print) Diane J Meeder

31c. DATE SIGNED

32a. QUANTITY IN COLUMN 21 HAS BEEN 33. SHIP NUMBER 34. VOUCHER NUMBER

RECEIVED INSPECTED

PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

32b. SIGNATURE OF AUTHORIZED GOV’T REPRESENTATIVE 32c. DATE COMPLETE PARTIAL FINAL

41a. I CERTIFY THIS AMOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC’D 42d. TOTAL CONTAINERS

40. PAID BY

AUTHORIZED FOR LOCAL REPRODUCTION SEE REVERSE FOR OMB CONTROL NUMBER AND PAPERWORK BURDEN STATEMENT STANDARD FORM 1449 (10-95)

ACCEPTED, AND CONFORMS TO THE

CONTRACT, EXCEPT AS NOTED

35. AMOUNT VERIFIED

CORRECT FOR

17a. CONTRACTOR/

OFFEROR

FACILITY

CODE

IS CHECKED

Page i

TABLE OF CONTENTS

Section Document/Clause/Provision Page No.

A Standard Form 1449 B Continuation of SF1449 (Block 19 – 24) 1 C Contract Clauses 31 D Contract Documents, Exhibits or Attachments 48 E Solicitation Provisions 49

Contract No.

SECTION B - CONTINUATION OF SF1449

Base Apple App:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

1001 Face Measuring Mobile Application

Base – Apple iOS App. Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance: 09/01/2023 – 08/31/2026.

Three (3) years.

1 Job

Option 1 Reporting Capabilities -Apple Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

1002 Report Capabilities

Apple iOS App. Face Measuring Mobile Application. Create the ability for the app will provide reports to NIOSH at a CDC-hosted location. In accordance with the Statement of Work.

Period of Performance: Six (6) months. Must be exercised on or before 09/01/2026 or if CLIN 1003 has been exercised on or before the expiration of that CLIN.

Option 2 Respirator Selection Pg-Apple Items:

1003 Respirator Selection Page

Page – Apple iOS App. Face Measuring Mobile Application. Respirator selection aid page for a limited number of respirators that have a high probability of fitting. In accordance with the Statement of Work.

Period of Performance: Six (6) months. Must be exercised on or before 09/01/2026 or if CLIN 1002 has been exercised on or before the expiration of the CLIN.

Option 3 Update 1 -Apple Items:

1004 Update 1- Apple

Update/Debug no. 1 – Apple iOS App. Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance: Six (6) months. Must be exercised on or before 09/01/2026.

Option 4 Update 2 -Apple Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

1005 Update 2 - Apple

Update/Debug no. 2 – Apple iOS App. Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance:

Must be exercised: 1.) on or before 09/01/2026, or 2). if CLIN 1004 has been exercised, then on or before the expiration of that CLIN, Whichever of the two is the latest.

Option 5 Android App Items:

2001 Face Measuring Mobile Application-

Android App. Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance: Must be exercised before 9/01/2025. Three (3) years.

Option 6 Reporting Capabilities- Android Items:

2002 Report Capabilities

Reporting Capabilities – Android App. Face Measuring Mobile Application. Create the ability for the app will provide reports to NIOSH at a CDC-hosted location. In accordance with the

SOW.

Period of Performance: Six (6) months. Must be exercised on or before 03/01/2028.

Option 7 Respirator Selection Page Items:

2003 Respirator Selection Page- Android

App. Face Measuring Mobile Application.

Respirator selection aid page for a limited number of respirators that have a high probability of fitting. In accordance with the SOW.

Period of Performance: Six (6) months. Must be

Option 8 Update 1- Android Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

2004 Update/Debug 1-Android

Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance: Six (6) months. Must be

1 Job $0.00 $0.00

Option 9 Update 2- Android Items:

2005 Update/Debug 2- Android

– Android App. Face Measuring Mobile Application. In accordance with the SOW.

Period of Performance: Six (6) months. Must be

1 Job $0.00 $0.00

B.1 Type of Contract This is a firm-fixed-price contract.

B.2 Payment Schedule

This contract/order is Firm-Fixed Price as defined in Federal Acquisition Regulation Section 16.202.

Contract/order payments shall be made in accordance with the schedule of deliverables. Partial payments are authorized.

Item # Deliverable Amount

Total

Statement of Work “The services contemplated under this contract are considered to be an Other Function as defined by the Office of Federal Procurement Policy in OFPP letter 11-01 and by HHS in Acquisition Policy Memorandum 2012-01”.

Title: Face Measuring Mobile Application

SECTION 1 – BACKGROUND

Respiratory protection research and panel sizing requirements currently rely on manual measurements based on the NIOSH Bivariate Panel (face length and width measurements) and the NIOSH Principal Component Analysis (PCA) Panel (10 facial measurements). Additionally, fit testing in the workplace can be time consuming, both during routine operations and emergencies. Technology is now capable of capturing the 3D geometries of faces and creating custom-fitted masks made for the user based on their digital facial measurements. The technology needed to measure facial anthropometries is ubiquitous among the general public in the form of their personal mobile device.

A mobile application (app) for cell phones and tablets is needed to measure a defined set of facial measurements and report both NIOSH Bivariate Panel cell sizing and NIOSH PCA Panel sizing and the associated face/head measurement results. This information will likely make the overall fit testing process in the workplace more efficient and may aid in developing respirator selection guidance for the general public who do not perform fit testing. This information may also assist in determining facial anthropometries that may fall outside of these panels and support the development of improved respirator/mask sizing guidance.

This contract includes a base and options for additional work. The initial award is for the development of an iOS-based app-store ready app that measures and calculates a specified set of facial measurements, determines the appropriate NIOSH Bivariate Panel and NIOSH PCA Panel cells and face/head size, and captures and stores the 3D-scanned facial images. This app will also provide the user an opportunity to share their facial measures and panel cell results to NIOSH.

The contract includes a base app for developing the iOS app and 9 optional tasks (options).

Options:

• Option 1. (Apple Version). Add app capability of proving reports to NIOSH at a CDC-hosted location.

• Option 2. (Apple Version). Add a respirator selection page for a limited number of respirators that have a high probability of fitting.

• Option 3. (Apple Version). App update no. 1 for debugging or other need to update.

• Option 4. (Apple Version). App update no. 2 for debugging or other need to update.

• Option 5. (Android Version). Develop a base Android version of the app.

• Option 6. (Android Version). Add app capability of proving reports to NIOSH at a CDC-hosted location.

• Option 7. (Android Version). Develop app to include a respirator selection page for a limited number of respirators that have a high probability of fitting.

• Option 8. (Android Version). App update no. 1 for debugging or other need to update.

• Option 9. (Android Version). App update no. 2 for debugging or other need to update.

SUBSECTION A – DEFINITIONS

N/A

SECTION 2 – PURPOSE

The awarded contractor shall design a mobile application per the outlined specifications and provide the development information and final product to NIOSH following the deliverables timeline in SECTION 7 of this Statement of Work.

SECTION 3 – SCOPE OF WORK

The goal of the project is to develop a mobile app for Apple iPhone and Apple iPads to measure a user’s face as specified in Task 1 of Section 4.

SECTION 4 – TASKS TO BE PERFORMED

Task 1. Develop Platform and Database - Base. Apple App.- Three (3) years Overview: The contracted app developer will develop an app with a user-friendly and intuitive interface that allows the user to determine their NIOSH Bivariate Panel sizing and NIOSH PCA Panel sizing using the camera of their mobile device. The app will display the resulting panel sizes and facial dimensions to the user and allow the user to export their results via email and have the option to share their results with NIOSH. NIOSH Panel sizing specifications are described in the paper Zhuang Z, Bradtmiller B, and Shaffer RE [2007]. New respirator fit test panels representing the current U.S. civilian workforce. Journal of Occupational and Environmental Hygiene 4:

647-659.

Mobile Application Requirements:

1. Capital Planning and Investment Control (CPIC) is an integral part of the Agency’s strategic planning initiative. In accordance with the CPIC process and Clinger-Cohen Act, Contractor shall follow the HHS EPLC framework and provide complete, reliable, consistent, and timely life-cycle information, to include development and cost information; and systematic measurement of performance.

2. The app shall use preferred technology stacks that are in use within NIOSH and CDC for ease of maintenance and supportability throughout the application’s lifecycle.

3. The app shall be designed to work on iPad and iPhone models which adhere to CDC's equipment standards.

Only iPad and iPhone models which adhere to CDC's equipment standards can be used for testing.

4. The app shall meet all Apple App Store Submission requirements and utilize Apple’s current iPhone and iPad front facing and rear facing camera technology. No additional cameras should be required to use this app.

5. Data collection, storage, and analysis shall be performed locally on the device.

6. The CDC shall have full copyright and ownership of the app and all coding.

7. The CDC logo and any other applicable CDC and NIOSH branding shall be displayed within the app using files provided to the developer by NIOSH.

8. The developer shall provide NIOSH with all developed algorithm coding and programming information used for app development and data capture for NIOSH to assist with future database input and updates.

9. The app shall be 508 compliant per the requirements outlined here: https://www.section508.gov/sample-procurement/mobile-application/.

10. The app shall provide conditions of use and privacy information.

11. The app shall demonstrate to the user how confidentiality will be assured and gain user approval of data capture, collection, and use.

12. The app shall include a Mobile App-Specific Privacy Policy approved by the CDC Privacy Unit.

13. The developer shall follow the HHS Policy for Software Development Secure Coding Practices and the CDC

Secure Software Development Standard for secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), which will limit system software vulnerability exploits. The policy will be provided upon award.

14. Complete and provide an adequate vulnerability scan using the CDC static code analyzer before it can be accepted. If your mobile app vulnerability scan has no valid Critical, High, or Medium issues, the vulnerability scan is adequate. Mobile app vulnerability scan results will be kept in the CDC approved centralized repository.

NIOSH will perform the scan.

15. Provide Continuous Monitoring after the mobile app is cleared and approved. Continuous Monitoring is required to maintain information security and privacy compliance.

https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf https://www.hhs.gov/sites/default/files/ocio/eplc-lifecycle-framework.pdf

a. Monitor changes to the data collected, stored, and maintained by the mobile app that no longer adhere to CDC OADC’s 3rd party site plan(s) for the mobile app store(s).

b. Monitor and address changes to the CDC Privacy Unit-approved mobile app-specific privacy policy.

c. Maintain an adequate mobile app vulnerability scan before new mobile app build releases.

Mobile Application Data Handling and Storage Requirements:

1. The developer shall create an output file structure that NIOSH approves so that user data within the app has potential to be shared for future use.

2. The created file structure shall have the ability to be expanded over time and have the space to manage additional data to include:

a. User facial scans

b. User facial dimensions (19 dimensions detailed below)

c. Respirator-specific data

d. User supplied demographics and other information

Mobile Application Functionality:

1. The app shall have features to make facial scanning and data collection easy to be performed by the user on themselves, or by the user on another person. The app should function using the front-facing and the rear-facing camera.

2. The app shall be capable of measuring facial dimensions for users of diverse facial shapes, various skin tones, various races, and for users with more, and less, prominent facial features.

3. The app shall be capable of measuring and displaying the 19 dimensions specified in Table 1 below.

Table 1: List of 19 Facial Dimensions adapted from Zhuang and Bradtmiller (2005)* 1 Bigonial breadth 11 Lip length 2 Bitragion chin arc 12 Maximum frontal breadth 3 Bitragion coronal arc 13 Menton-Sellion length 4 Bitragion frontal arc 14 Minimum frontal breadth 5 Bitragion subnasale arc 15 Nasal root breadth 6 Bizygomatic breadth 16 Neck circumference 7 Head breadth 17 Nose breadth 8 Head circumference 18 Nose protrusion 9 Head length 19 Subnasale-Sellion 10 Interpupillary distance

* Zhuang and Bradtmiller (2005). Head-and-Face Anthropometric Survey of U.S. Respirator Users, Journal of Occupational and Environmental Hygiene. 2:11, 567-576

4. The app shall create a file containing all user supplied data, images of the point cloud facial scan from various views, all 19 facial dimensions, and the NIOSH Bivariate Panel and the NIOSH PCA Panel size results.

a. The facial dimensions required for determining NIOSH Bivariate Panel size and the NIOSH PCA Panel size are specified in the paper: Zhuang Z, Bradtmiller B, Shaffer RE. New respirator fit test panels representing the current U.S. civilian work force. J Occup Environ Hyg. 2007 Sep;4(9):647-59. doi:

10.1080/15459620701497538. PMID: 17613722.

5. The app shall store user point cloud scans and allow them to be reopened, shared, or deleted. The file type will be agreed upon by NIOSH after award (e.g., .IGS, .STL, .PLY).

6. The app shall be capable of outputting and storing the facial dimensions, cell number and face/head size of both the NIOSH Bivariate Panel and the NIOSH PCA Panel.

7. The app shall have a Digital Scanning Page:

a. Provide users with initial step-by-step guidance on how to align their face for scanning, whether or not the user must present themselves in better lighting or in front of a more neutral/solid background, etc.

Provide audible instructions on actions needed to perform the scan.

b. When the proper facial alignment is achieved, have both options to press a button or say a voice command to start the scan.

c. When the scan is complete, provide the user with the option to keep/capture the scan and move on or redo the scan for improvement if needed.

d. The app developer shall comply with all CDC and NIOSH required compliance/security controls for data, including personally identifiable information (PII), as necessary.

e. Allow the user to input information to be stored with the scan. This information will include (but is not limited to):

i. Name

ii. Date

iii. Current respirator model(s) being used

iv. Date of last fit test and method of fit test

v. Race (dropdown menu)

vi. Sex (dropdown menu)

vii. Age (dropdown menu)

viii. Occupation

ix. Custom user field 1

x. Custom user field 2

8. The app shall have a Results Page:

a. Displays digital facial scan in a nonidentifiable, point-cloud /mesh format

b. Displays a table of all 19 measurements specified in Table 1 above.

c. Displays user’s NIOSH PCA Panel size (cell size and head size) and NIOSH Bivariate Panel Size (cell size and face size)

d. Displays if the user does not fit within the NIOSH PCA or NIOSH Bivariate Panels and provides instructions for next steps and describes what this means.

e. Provide an option to export information via email.

i. Send results information via an html file to email addresses supplied by the user.

ii. Send deidentified results information via an html file to NIOSH.

9. The app shall have a Learn More Page to direct the user to a different page within the app that will provide them with resources about the app:

a. About this App/Project

b. Help Guide

c. Terms and Conditions

d. Privacy and Software Disclaimer

e. More CDC/NIOSH Respirator Resources

f. Report Bug or Issue

g. Provide comments to the App Developers. This information should also be provided to NIOSH.

Testing of Pre-Alpha, Alpha, and Beta versions:

1. The developer will provide NIOSH with pre-alpha and alpha versions of the app for viewing and basic testing.

A suitable method for this includes providing NIOSH with an iPad and iPhone equipped with the app or providing access using the TestFlight software application.

2. Once all functionality has been added to the app, the developers will provide NIOSH with a Beta version of the app for testing and evaluation. A suitable method for this includes providing NIOSH with an iPad or iPhone equipped with the app or providing access using the TestFlight software application.

3. NIOSH will conduct (or oversee) human subjects’ evaluations to determine the precision and accuracy of the facial dimension measurements obtained through the app compared to measures obtained using manual caliper measures. NIOSH will determine if the app measurements are adequate or if revisions to app are needed to improve these measures. The app shall measure the following anthropometric measurements within the allowable error stated in the Table 2 below.

Table 2: Allowable error for the 19 facial dimensions of interest.

Measurement +/- Allowable error

(mm) Notes

1 Head Circumference 5 1 2 Bitragion-Coronal Arc 6 1 3 Bitragion-Frontal Arc 5 1 4 Bitragion-Subnasale Arc 6 1 5 Bitragion-Chin Arc 6 1 6 Head Breadth 2 1 7 Head Length 2 1 8 Minimum Frontal Breadth 3 1 9 Maximum Frontal Breadth 3 1 10 Bizygomatic Breadth 2 1 11 Bigonial Breadth 3 1 12 Nasal Root Breadth 3 1 13 Nose Breadth 3 1 14 Lip Length 4 1 15 Subnasale-Sellion Length 3 1 16 Neck circumference 6 2 17 Menton-Sellion Length 3 1 18 Nose Protrusion 3 1 19 Interpupillary Breadth 2 1 Notes:

1. Allowable inter-observer error criteria based on inter-observer error. The allowable error was determined based on error data in the literature and analysis of results of observer error tests conducted specifically before a 2003 NIOSH field study of U.S. worker civilians who either wear respirators or could wear respirators for occupational purposes.

2. Allowable observer error criteria based on Gorden et. 1989. 1988 Anthropometric Survey of U.S. Army Personnel: Methods and Summary Statistics. Technical Report Natick/TR- 89/044. U.S. Army Natick Research, Development and Engineering Center, Natick, Massachusetts. Table 59, P. 584. September, 1989.

4. Once an app with suitable performance is achieved, NIOSH will conduct final user experience testing of the app. Additional changes to the app may be required by NIOSH following the user experience testing.

App Store Ready Package and Project Summary Report

1. App Store Ready Package. The developer will prepare an App Store Ready Package to turn over to NIOSH. The package will contain all documentation, files, images, algorithms, training data, and code necessary to have this app added to the Apple App Store and necessary for maintenance and expansion of app capabilities.

2. Project Summary Report. The developer will prepare a Project Summary Report that includes but is not limited to:

a. Approach to app development

b. Development methods

c. Results of all testing or development trials

3. NIOSH will be responsible for having the app added to the Apple App Store and will be responsible for any costs associated with adding the app to the App Store and any routine Apple App Store costs while the app is listed there.

4. The contractor shall provide a maximum of three app version updates (Options priced separately) after the release of the app as required by Apple’s App Store and/or any identified operational problems (bugs), or NIOSH requested updates. The first app version update will part of the base period and the two additional app version updates will be under separate options.

OPTIONS

Option 1 –(Apple Version) Reporting capabilities- Six (6) Months

1. Create the ability for the app will provide reports to NIOSH at a CDC-hosted location.

a) The app will provide the user an option to send results to NIOSH.

b) The app will send deidentified results information for facial dimensions, point cloud/mesh file in an agreed upon file format with NIOSH (e.g., .IGS, .STL, .PLY), user-supplied demographics, NIOSH Panel sizes, and other data via a NIOSH-specified format to a location hosted by CDC. Suitable locations include sFTP sites and cloud servers. NIOSH will determine the location.

Option 2 – (Apple Version) Respirator Selection Page- Six (6) Months

1. The app will be expanded to include a respirator selection aid page for a limited number of respirators that have a high probability of fitting. Note: This contract is not requesting that the awardee develop the technology to predict respirator fit. The requirements below are only to establish a page on the app now in preparation for when NIOSH develops respirator fit predictions sometime in the future.

a) Respirator Selection Aid Page

a. The page will report the user’s NIOSH PCA Panel size (cell size and head size) and NIOSH

Bivariate Panel Size (cell size and face size). The app page will also report if the user does not fall into one or both of the NIOSH Panels.

b. The app page will provide the user with a list of respirators known to have a high, moderate, and low fit probability based on either or both the NIOSH PCA Panel size (cell size and head size) and NIOSH Bivariate Panel Size (cell size and face size).

i. This listing will be in a format that can be updated over time (e.g., expandable to include other types of face-worn products which may include elastomeric-type respirators, masks/barrier face coverings, etc.) through version updates or having the app pull recommendations from a CDC webpage containing this data.

c. The app page will provide the user an option to export the results information via an html file to email addresses supplied by the user. This information would include:

i. The user’s NIOSH PCA Panel size (cell size and head size) and NIOSH Bivariate Panel Size (cell size and face size), and respirator model options with predicted high, moderate, and low fit potential.

Option 3. (Apple Version). App update no. 1 for debugging or other need to update. -Six (6) months from exercise of option.

Option 4. (Apple Version). App update no. 2 for debugging or other need to update. - Six (6) months from exercise of option.

Option 5. (Android Version). Develop a base Android version of the app. (3 Years from exercise of option)

1. The same functional requirements for the Apple version apply to the Android version.

Option 6. (Android Version). Add app capability of proving reports to NIOSH at a CDC-hosted location. -Six

(6) Months

1. The same functional requirements for the Apple version apply to the Android version.

Option 7. (Android Version). Develop app to include a respirator selection page for a limited number of respirators that have a high probability of fitting. - Six (6) Months

1. The same functional requirements for the Apple version apply to the Android version.

Option 8. (Android Version). App update no. 1 for debugging or other need to update. - Six (6) months from exercise of option.

Option 9. (Android Version). App update no. 2 for debugging or other need to update. - Six (6) months from exercise of option.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

1. The ISO digital headforms which reflect the five NIOSH PCA Panel head sizes can be downloaded at no cost from the NIOSH website at: NIOSH Anthropometric Data and ISO Digital Headforms Anthropometric Data and ISO Digital Headforms | NPPTL | NIOSH | CDC

2. NIOSH will consult with the awardee regarding the requirements for developing the app.

3. NIOSH will conduct and cover all expenses related to the app validation study and the app user experience study. These expenses do not cover the cost of the developer developing the app.

4. HHS Policy for Software Development Secure Coding Practices and the CDC Secure Software

Development Standard for secure coding best practice requirements.

SECTION 6 – PERIOD OF PERFORMANCE

Apple Version

• Base Period: Apple App: 09/01/2023 – 08/31/2026. Three (3) years.

• Option 1 –(Reporting Capabilities -Apple Version). Six (6) months. Reporting capabilities. Must be exercised on or before 09/01/2026 or prior to the expiration of Option 2, if Option 2 is exercised.

• Option 2 – (Respirator Selection Page -Apple Version).. Six (6) months. Respirator Selection Page. Must be exercised on or before 09/01/2026 or prior to the expiration of Option 1, if Option 1 is exercised.

• Option 3 – (Update 1 -Apple Version). Six (6) months. App update no. 1 for debugging or other need to update.

Must be exercised on or before 09/01/2026.

• Option 4 – (Update 2 - Apple Version). Six (6) months. App update no. 2 for debugging or other need to update. Six (6) Months. Must be exercised by either: 1.) on or before 09/01/2026, or if Optional 1 Update has https://www.cdc.gov/niosh/npptl/topics/respirators/headforms/default.html been exercised then, on or before the expiration of that option.

Android Version

• Option 5 – (Android App Version). Three (3) years. Develop a base Android version of the app. Must be exercised before 9/01/2025.

• Option 6 – (Reporting Capabilities -Android Version). Six (6) months. Add app capability of proving reports to NIOSH at a CDC-hosted location. Must be exercised on or before 3/01/2028.

• Option 7 – (Respirator Selection Page - Android Version). Six (6) months Develop app to include a respirator selection page for a limited number of respirators that have a high probability of fitting.. Must be exercised on or before 3/01/2028.

• Option 8 – (Update 1 -Android Version). Six (6) months App update no. 1 for debugging or other need to update. Six (6) months from date requested by NIOSH. Must be exercised on or before 03/01/2028.

• Option 9 – (Update 2-Android Version). Six (6) months App update no. 2 for debugging or other need to update. Six (6) months from date requested by NIOSH. Must be exercised on or before 03/01/2028.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

(Note: List each deliverable, quantity or (in the case of reports) number of copies required, the date required, and who to deliver the item to. Reports, for example, are often delivered to both the COR and the CO. Add or delete rows in the table as needed. Delete this note before submitting the Statement of Work.)

Items

Description Quantity or No. of Copies

Delivery Date

Deliver To

BASE (Apple Version)

Contractor Employee Non- Disclosure Agreement (NDA)

Signed NDA agreement.

1 copy Prior to performing any work on behalf of

HHS/CDC.

Project Officer at

NIOSH

Monthly Meetings and Written Monthly Status Report

Meeting with contract COR and NIOSH Project Team, and written monthly status report.

1 meeting per month, and 1 report per month

Each month during the period of performance

Project Officer at

NIOSH

HHS EPLC Project Planning and Design documents

Project Charter, Project schedule, Requirements document, High-level Design document

4 documents Within 1 month of award

Project Officer at

NIOSH

HHS EPLC

Monthly Project Progress Reporting

Monthly invoice and Project Schedule updates showing actual costs and percent complete

1 copy Each month during the period of performance

Project Officer at

NIOSH

Pre-Alpha version Skeleton of app with all button locations, logos, and ability for buttons to work.

Minimum of 1 program.

Within 1 month of award.

Project Officer at

NIOSH

Alpha version 1 Has ability to start camera and capture facial features.

Minimum of 1 program.

Within 3 months of award.

Alpha version 2 Has ability to calculate facial dimensions and assign user to

NIOSH

Bivariate Panel and PCA Panel.

of receipt of Alpha Version 1.

Beta version Readily testable by NIOSH for anthropometric measurements study.

Within 9 months of receipt of Alpha Version 2.

HHS EPLC

Operational Readiness documents

Product Technical documentation, User Instruction Guide, User Training material, Operations & Maintenance manual

4 documents Within 3 months of receipt of NIOSH’s validation testing input.

Project Officer at

NIOSH

NIOSH-approved version of app for User Experience Testing

Readily testable version for NIOSH study with user groups.

of receipt of NIOSH’s validation testing input.

App Store Ready Package

Final App Store Ready package.

Minimum of 1 package.

Within 6 months of receipt of NIOSH’s user experience testing input.

Project Summary Report and presentation to

NIOSH

Project Summary Report which includes all documentation, reports, and actions related to the development and testing of the app. Formal meeting with NIOSH to present project summary.

Minimum of 1 report, 1 slide deck, and 1 meeting.

Within 1 month of App Store ready package received by NIOSH.

Mobile App- Specific Privacy Policy

App must inform user of necessary specific privacy policy statement in accordance with CDC policy

Minimum of one copy. Must also show statement in app.

Within 1 month of App Store ready package received by NIOSH.

Project Officer at

NIOSH

Adequate vulnerability scan using the CDC static code analyzer

This is a service that NIOSH IT Security provides. It is a check of vulnerabilities for the developer to fix before NIOSH will sign off on the app release.

Minimum of one copy demonstrating a passed vulnerability scan.

Within 1 month of App Store ready package received by NIOSH.

First app update (part of contract base) following app release as required by Apple’s App Store and/or any identified operational problems (bugs), or NIOSH requested update.

App update (part of base contract).

Minimum of one copy and written description of the update.

Within 1 month following the update request.

OPTIONS

Option 1 Apple version.

The app will provide reports to NIOSH at a CDC-hosted location.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 03/01/2027. Six

(6) months.

Project Officer at

Option 2

Apple version.

The app will be expanded to include a respirator selection aid page.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 03/01/2027. Six

(6) months.

Project Officer at

NIOSH

Option 3 Apple Version.

Update/Debug

no. 1 – Apple iOS App.

1 copy demonstrating the functionality

Period of Performance:

Must be exercised on or before 09/01/2026. Six

(6) months from date requested by

NIOSH.

Option 4 Apple Version.

Update/Debug

no. 2 – Apple iOS App.

1 copy demonstrating the functionality

Period of Performance:

Must be exercised by either: 1.) on or before 09/01/2026, or if Optional 1 Update has been exercised then, on or before 04/01/2027. Six

(6) Months.

Project Officer at

NIOSH

Option 5 Android version. An app for mobile Android devices. All of the same base requirements for the base Apple app apply.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised before 9/01/2024.

Three (3) years.

Project Officer at

NIOSH

Option 6 Android version. The app will provide reports to NIOSH at a CDC-hosted location.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 9/01/2024. Six (6) months.

Option 7 Android version. The app will be expanded to include a respirator selection aid page.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 9/01/2024. Six (6) months.

Project Officer at

NIOSH

Option 8 Android version.

Update/Debug

no. 1.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 09/01/2026. Six

(6) months from date requested by

NIOSH.

Option 9 Android version.

Update/Debug

no. 1.

1 copy demonstrating the functionality.

Period of Performance:

Must be exercised on or before 09/01/2026. Six

(6) months from date requested by

NIOSH.

(a) Required Reports/Documentation and Content

(1) Monthly Technical Report The Contractor shall prepare and submit monthly technical progress reports in narrative form which shall contain technical results of the work accomplished during the reporting period. This report shall be in sufficient detail to disclose all work started and results achieved during the reporting period, an indication of any current problems which may impede performance, the proposed corrective action, and the work forecast for the next period. This document shall report progress and planning so as to correspond with the work schedule contained in the Center approved program plan.

(b) Reporting Period

All monthly reporting periods shall end on the last day of a calendar month.

(1) For contracts awarded (i.e., effective date) on or before the fifteenth (15th) of a calendar month, the initial reporting period shall end on the last day of the calendar month during which the contract became effective.

(2) For contracts awarded (i.e., effective date) on or after the sixteenth (16th) of a calendar month, the initial reporting period shall end on the last day of the month immediately following the month during which the contract became effective.

(c) Delivery of Reports One copy of each report, in draft and/or final form as required by the contract, shall be delivered to the COR and Project Officer.

SECTION 8 – REFERENCE MATERIALS

1. Zhuang and Bradtmiller (2005). Head-and-Face Anthropometric Survey of U.S. Respirator Users, Journal of Occupational and Environmental Hygiene. 2:11, 567-576

2. Zhuang Z, Bradtmiller B, Shaffer RE. New respirator fit test panels representing the current U.S.

civilian work force. J Occup Environ Hyg. 2007 Sep;4(9):647-59. doi: 10.1080/15459620701497538.

PMID: 17613722.

3. NIOSH Anthropometric Data and ISO Digital Headforms Anthropometric Data and ISO Digital

Headforms | NPPTL | NIOSH | CDC

SECTION 9 – TECHNICAL POINT OF CONTACT

The Technical Point of Contact (POC) is:

Mike Bergman, Project Officer

CDC NIOSH NPPTL

Bruceton Research Center 626 Cochrans Mill Road

Bldg 13, Rm 201 Pittsburgh, PA 15236 412-386-4815 mbergman@cdc.gov

SECTION 10 – PAYMENT TERMS

Payments made in accordance with the deliverables in the deliverable table. Excludes monthly meeting/reports and NDAs.

SECTION 11 – SPECIAL CONSIDERATIONS

Electronic and Information Technology Accessibility Notice

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues.

Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

mailto:mbergman@cdc.gov http://www.hhs.gov/web/508 http://www.access-board.gov/sec508/standards.htm http://hhs.gov/web/508

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Access to Government Information or Systems Security Language

Deliverables

Deliverable Title/Description Due Date

Roster By effective date of this contract

Contractor Employee Non- Disclosure Agreement (NDA)

Prior to performing any work on behalf of HHS

Assist in the completion of a PTA/PIA form

Within specified date after contract award

Copy of training records for all mandatory training

In conjunction with contract award and annually thereafter or upon request

Signed ROB for all employees Initiation of contract and at least annually thereafter

Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

Incident and Breach Response Plan Upon request from government

List of Personnel with defined roles and responsibilities

Prior to performing any work on behalf of HHS

Off-boarding documentation, equipment and badge when leaving contract

Within 7 days of contractor departure and at contract expiration

Onboarding documentation when beginning contract

Prior to performing any work on behalf of HHS

Form or deliverables required by CDC/NIOSH At contract expiration

If the procurement involves a system or cloud service, Disposition/Decommission Plan

At contract expiration

Contract initiation and expiration Due after contract award http://508.hhs.gov/ https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html

SA&A Package including BSI, SSP, RAR, POA&M, CP and CPT Report, E-Auth, PTA/PIA, SSN Usage Approval Request (if applicable), RoB (if applicable), Interconnection/Data Use Agreements (if applicable), Authorization Letter, Configuration Management Plan (if applicable), Configuration Baseline

Due in accordance with the timeline proscribed in the CDC

SA&A SOP

Retirement Checklist, All deliverables and data/records retained in accordance with Records Management and other requirements, Device sanitization documentation, Destruction documentation for all other CDC data/information (soft/hard copy)

Prior to system retirement/decommissioning

POA&M updates; Revised security documentation/Agreements

Monthly/as requested by CDC

Incident reports (as needed) Incident Response Plan

As requested by CDC

Computer software, including the source code Prior to performing any work on behalf of HHS

Other source code Prior to performing any work on behalf of HHS

Standard Language

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC/NIOSH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

• Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

• Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

• Comply with the Privacy Act requirements and tailor FAR clauses as needed.

b. Categorize all information owned and/or collected/managed on behalf of HHS/CDC/NIOSH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ x] Moderate [ ] High

Integrity: [ ] Low [ x] Moderate [ ] High Availability: [ ] Low [ x] Moderate [ ] High Overall Risk Level: [ ] Low [ x] Moderate [ ] High

c. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/CDC/NIOSH regardless of location or purpose.

d. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

e. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/CDC/NIOSH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/CDC/NIOSH security and/or privacy officials.

3) Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

4) Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/CDC/NIOSH privacy policies, and complete all the requirements below:

a. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

b. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements.