Attch_1_SOW_eQMS_eTMF_RFQRML75N93019Q00001.pdf

Last Saved: 6/18/2019 2:49 PM

National Institutes of Health (NIH) National Institute of Allergy and Infectious Diseases (NIAID)

NIAID eTMF and eQMS

Statement of Work FINAL V4.0 – June 18, 2019

NIAID eTMF and eQMS Statement of Work

Last Saved: 6/18/2019 2:49 PM Page 2 of 61

TABLE OF CONTENTS

1 INTRODUCTION AND OBJECTIVES

2 BACKGROUND

2.1 Mission

2.2 Organization

2.3 Clinical Research Systems

2.4 Current State

3 SCOPE

4 SOFTWARE REQUIREMENTS

4.1 Common Requirements

4.2 eTMF Specific Requirements

4.3 eQMS Specific Requirements

5 PROFESSIONAL SERVICES S REQUIREMENTS

5.1 Initial Tasks

5.2 Ongoing Tasks

5.3 Optional Tasks

5.4 Key Personnel

6 PLACE OF PERFORMANCE

7 DELIVERABLES/DELIVERY SCHEDULE

8 INFORMATION AND/OR PHYSICAL ACCESS SECURITY

Last Saved: 6/18/2019 2:49 PM Page 3 of 61

1 INTRODUCTION AND OBJECTIVES

This Statement of Work (SOW) is for Software and Services to support the implementation of an Electronic Quality Management System (eQMS) and an Electronic Trial Master File (eTMF) for the National Institutes of Health (NIH), National Institute of Allergy and Infectious Diseases (NIAID) to ensure compliance with the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) Integrated Addendum to ICH E6(R1): Guideline for Good Clinical Practice E6(R2) and other applicable and current clinical research regulations and requirements.

The purpose of this initiative is to:

• Promote standardization

• Improve consistency in meeting regulatory requirements

• Increase efficiency

• Provide a comprehensive approach to quality and compliance

• Provide a means for Regulatory Authorities to understand NIAID’s approach to managing sponsor essential documents and quality processes.

by acquiring:

• Commercial off-the-shelf (COTS) eTMF and eQMS software (System) that can interoperate and scale to support multiple NIAID Divisions (Divisions).

• Professional services to configure, deploy, train, validate, migrate existing documents, and support NIAID’s use and adoption of the eTMF and eQMS.

• Ongoing support including maintaining compliance with changing regulatory requirements and mitigation of security vulnerabilities.

NIAID is interested in a unified approach in which the eTMF and eQMS share common functionality, infrastructure, and operational support to the greatest degree possible. Unless explicitly stated otherwise, all requirements, deliverables, and tasks must apply to both eTMF and eQMS and use of the term COTS, System, or software must imply both eTMF and eQMS.

During a phase of approximately six months, a Pilot System will be made available to one or more Divisions to evaluate and validate the System and NIAID’s approach to its use. The Pilot System and Divisions will then transition into production use of the System over an approximately six-month period.

Once the production System is available, other Divisions will be on boarded when and as ready. We expect all Divisions to be using the System within five years of its deployment.

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities not otherwise provided by the Government, as needed to perform this Statement of Work.

Last Saved: 6/18/2019 2:49 PM Page 4 of 61

2 BACKGROUND

NIAID defines an eQMS as a web-based system for electronically logging, managing, and trending quality processes in accordance with Good x Practice (GxP) quality standards, including 21 Code of Federal Regulations (CFR) Part 11 requirements. An electronic eQMS must be validated for its intended purpose, which is to support trial data submissions to regulatory authorities for licensure of the investigational product.

NIAID defines an eTMF as a web-based system for managing essential documents which individually and collectively permit evaluation of the conduct of a clinical trial and the quality of the data produced. The essential documents and data records stored in the eTMF should allow for the evaluation of compliance with the protocol, the evaluation of the trial’s safe conduct, and the evaluation of the quality of the data obtained.

NIAID sponsors numerous domestic and international clinical trials. As sponsors of clinical research, Divisions are expected to implement a system to manage quality throughout the design, conduct, recording, evaluation, reporting, and archiving of clinical trials. A QMS is expected to follow a risk-based approach to quality management, focusing on critical processes and data identification, risk identification, risk evaluation, risk control, risk communication, risk review, and risk reporting.

As sponsors, Divisions are also expected to establish TMFs containing essential documents that individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced during those trials. Documents collected throughout the lifecycle of a clinical trial serve to demonstrate the compliance of the investigator, sponsor, monitors, and contractors with the current standards of Good Clinical Practice (GCP)and with all applicable regulatory requirements.

Although all Divisions are part of NIAID, share NIAID’s mission, and leverage each other’s expertise and tools, they operate with a fair degree of independence and have different purposes, processes, and needs. This independence, along with differences in their research portfolios and other Division specific imperatives require that the eQMS and eTMF software be flexible enough to support Division specific processes and to securely segregate data and users. Moreover, the timing of the implementation and use of specific functionality will vary based on Division priorities and needs.

2.1 MISSION

NIAID conducts and supports basic and applied research to better understand, treat, and ultimately prevent infectious, immunologic, and allergic diseases. For more than 60 years, NIAID’s research has led to new therapies, vaccines, diagnostic tests, and other technologies that have improved the health of millions of people in the United States and around the world. The scope of the NIAID research portfolio has expanded considerably in recent years in response to new challenges such as bioterrorism, emerging and re-emerging infectious diseases, and the increase in asthma prevalence among children in the United States. The growth of NIAID programs has also been driven by unprecedented scientific opportunities in the core NIAID scientific disciplines of microbiology, immunology, and infectious diseases. Decades of NIAID-funded research has helped further the understanding, diagnosis, and

Last Saved: 6/18/2019 2:49 PM Page 5 of 61 treatment of many of the world's most intractable and widespread conditions in the areas of allergy, immunology and infectious diseases.

NIAID conducts or supports research in numerous countries worldwide, requiring interaction with multiple regulatory frameworks. Conducting research in international settings allows NIAID-supported scientists to study infectious diseases and immunology under a variety of environmental and social conditions. It also provides opportunities to study the effectiveness of investigational drugs and vaccines in populations that vary genetically and immunologically, in the hope of finding treatments and preventions for wide ranges of disease strains and mutations. This also means that NIAID supports hundreds of clinical trials, including registrational or potentially registrational investigational new drug or device studies in various geographical locations subject to multiple regulatory agencies. This regulatory oversight is provided by in-country authorities often with additional Food and Drug Administration (FDA) and/or European Medicines Agency (EMA) filings.

2.2 ORGANIZATION

Divisions support extramural research by directing and managing grants, contracts, and cooperative agreements with external academic and research institutions. Divisions also conduct intramural research via studies and clinical investigations within NIAID laboratories. The Divisions described below will be the primary users of the eTMF and eQMS System.

2.2.1 Division of Acquired Immune Deficiency Syndrome (DAIDS)

The Division of Acquired Immune Deficiency Syndrome (DAIDS) was formed in 1986 to develop and implement the national research agenda to address the Human Immunodeficiency Virus Infection (HIV)/ Acquired Immune Deficiency Syndrome (AIDS) epidemic. Toward that end, the division supports a global research portfolio to advance biological knowledge of HIV/AIDS, its related co-infections, and co-morbidities. With the ultimate goal of creating an “AIDS-Free Generation,” the Division develops and supports the infrastructure and biomedical research needed to: 1) halt the spread of HIV through the development of an effective vaccine and biomedical prevention strategies that are safe and desirable; 2) develop novel approaches for the treatment and cure of HIV infection; 3) treat and/or prevent HIV co-infections and co-morbidities of greatest significance; and 4) partner with scientific and community stakeholders to efficiently implement effective interventions.

NIAID-supported investigators are conducting a large portfolio of research on all areas of HIV infection, including developing and testing preventive HIV vaccines, prevention strategies, and new treatments for HIV infection and AIDS-associated opportunistic infections.

2.2.2 Division of Allergy, Immunology, and Transplantation (DAIT)

The Division of Allergy, Immunology, and Transplantation (DAIT) explores how the immune system maintains health and, under abnormal conditions, also contributes to disorders. DAIT supports basic and clinical research to improve our understanding of the causes of immunologic diseases and to develop better diagnostic, treatment, and prevention strategies.

Last Saved: 6/18/2019 2:49 PM Page 6 of 61

NIAID supports basic and clinical research to increase our understanding of the causes and mechanisms that lead to the development of allergic and immunologic diseases and to expand knowledge that can be applied to improving techniques of diagnosis, treatment, and prevention.

2.2.3 Division of Microbiology and Infectious Diseases (DMID)

The Division of Microbiology and Infectious Diseases (DMID) supports extramural research to control and prevent diseases caused by virtually all human infectious agents except HIV. DMID provides funding opportunities and a comprehensive set of resources for researchers that support basic research, preclinical development, and clinical evaluation.

DMID conducts and supports research on nearly 300 infectious agents and investigates the biological properties of these pathogens and the immune system’s responses to them. Findings from this research are vital to NIAID efforts to create vaccines, drugs, and diagnostic tools to better diagnose, prevent, and treat infectious diseases.

2.2.4 Division of Clinical Research (DCR)

The Division of Clinical Research (DCR) plays an integral role in facilitating the efficient and effective performance of NIAID research programs on both the domestic and the international level. This is accomplished through a multi-faceted approach to the provision and support of services vital to the research infrastructure that include oversight and management of intramural clinical research, program planning and management, regulatory monitoring and compliance, statistical consultation and research methodology, and clinical research capacity building.

DCR vision is to facilitate high quality, state-of-the-art NIAID clinical research in the areas of allergic, immunologic, and infectious diseases. DCR provides multi-disciplinary trans-NIAID services for facilitating clinical research and managing special projects as directed by NIAID leadership.

2.2.5 Division of Intramural Research (DIR)

The Division of Intramural Research (DIR) is a component of NIAID. For more than 60 years, DIR has been at the forefront of research on immunologic, allergic, and infectious diseases. Our purpose is to make scientific discoveries that promote the development of new vaccines, diagnostics, and therapeutics that improve human health. DIR Research goals are to expand knowledge of normal immune system components and functions, define mechanisms responsible for abnormal immune function (immunodeficiency, allergy, and autoimmunity), understand the biology of infectious agents (viruses, bacteria, fungi, and parasites) and the host response to infection, and develop strategies to prevent and treat immunologic, allergic, and infectious diseases.

DIR scientists study all aspects of infectious diseases, including the causative agent, vectors, and pathogenesis in human and animal hosts. Clinical research also is integral to the DIR mission, enabling key lab discoveries to be rapidly translated into methods to prevent, diagnose, or treat disease. DIR researchers conduct more than 100 clinical trials at the NIH Clinical Center on the Bethesda, Maryland, campus and at collaborating U.S. and international sites.

Last Saved: 6/18/2019 2:49 PM Page 7 of 61

2.2.6 Vaccine Research Center (VRC)

The Dale and Betty Bumpers Vaccine Research Center (VRC) at the National Institutes of Health (NIH) was established to facilitate research in vaccine development. The VRC is dedicated to improving global human health through the rigorous pursuit of effective vaccines for human diseases. Established by former President Bill Clinton as part of an initiative to develop an AIDS vaccine, the VRC is a unique venture within the NIH intramural research program. Initially spearheaded by NIAID, the National Cancer Institute (NCI), and the NIH Office of AIDS Research, the VRC is now part of the NIAID organization.

The VRC mission is to conduct research that facilitates the development of effective vaccines and therapeutics for human disease. The primary focus of research include:

• HIV/AIDS Vaccine and Monoclonal Antibody Development

• Ebola Vaccine and Monoclonal Antibody Development

• Influenza and other respiratory diseases Vaccine and Monoclonal Antibody Development

• Vaccines and monoclonal development for other emerging infectious diseases

2.3 CLINICAL RESEARCH SYSTEMS

NIAID’s Clinical Research Informatics landscape is complex and evolving. Like many research organizations, NIAID relies on Contract Research Organizations (CRO), Networks, and other consortia to help achieve its research goals. Often, these partners and vendors supply NIAID with software and services in support of the Institute’s mission. In addition, NIAID has developed several in-house systems including those summarized below. The use of in-house versus partner provided software and services varies by Division.

1. NIAID Clinical Research Management System (NCRMS). NCRMS supports all of NIAID’s extramural Divisions (DAIDS, DMID, and DAIT) as well as the VRC. NCRMS is a custom application tailored for NIAID’s needs and, and depending on Division implementation it may manage sites, Expedited Adverse Events (EAEs), Serious Adverse Events (SAEs), protocols, monitoring, essential documents that comprise sponsor TMF, Investigational New Drug applications (IND’s), and other clinical research information. NCRMS has a robust set of application programming interfaces (APIs) that allow integration with other systems internal and external to the Institute.

2. Electronic Document and Records Management System (EDRMS). EDRMS leverages NIAID’s on-premises instance of OpenText Content Suite. It provides NIAID with enterprise content management (ECM) solutions in document and records management, workflow, and business process automation. NIAID manages two EDRMS environments - one is used for applications that must be in compliance with applicable regulatory requirements, including Section 21 Part 11 of the Code of Federal Regulations (21 CFR Part 11). It was developed and is maintained using guidance provided by Good Automated Manufacturing Practice version 5 (GAMP5). The other is used for a wide variety of administrative and non-clinical research- oriented applications.

Last Saved: 6/18/2019 2:49 PM Page 8 of 61

3. Electronic Common Technical Document (eCTD). NIAID manages an on-premises instance of Paraxel’s Liquent Software for publishing submissions to the FDA and other regulatory agencies.

This system uses NIAID EDRMS for document management functionality. NIAID’s eCTD system is used by some Divisions and their CROs. Other Divisions utilize their CRO’s eCTD platforms.

4. Electronic Data Capture (EDC). NIAID manages instances of DataFax and RedCap for its Intramural programs. NIAID’s CROs, partners, and networks utilize other EDC systems, including MediData RAVE.

5. CRIMSON (Clinical Research Information Management System of the NIAID). CRIMSON is a combined clinical documentation and clinical research data management solution that supports data entry and exchange requirements of the NIAID Intramural clinical research program. It supports protocol recruitment and enrollment management; ensures clinical and clinical research documentation is complete and predictably formatted; captures records of patient encounters in widely-accepted clinical formats; automatically maps clinical observations into research data sets; serves as an aggregated single-source for retrieval and analysis of clinical, laboratory, and other patient, treatment, disease and protocol data; and reduces redundancies in clinical documentation and research data entry.

2.4 CURRENT STATE

Currently each Division has a set of policies, procedures, work instructions, and guidance documents that are used to standardize what each Division views as critical aspects of clinical research processes.

These are kept as paper or electronic copies, or as a hybrid of both. Other components of a quality management system such as training, audits, and Corrective and Preventative Actions (CAPAs) are implemented by each Division (or individual programs within a Division) and are not centralized in a system.

Some Divisions contract with independent qualified quality management consultants to develop quality management programs and serve as quality managers. The program is paper based and includes staff training, documentation of corrective and preventive actions, risk-based vendor and contractor audits, standard quality procedures, and Division-specific policies and procedures.

Divisions currently use a decentralized mix of paper file system and eTMFs, often with the assistance of outside vendors. Records are kept in multiple locations, including at NIAID, at clinical research sites, and with vendors or contractors.

3 SCOPE

The scope of this procurement is to acquire, configure, deploy, validate, and support an eQMS and eTMF System for use by NIAID and its partners in accordance with regulated clinical research requirements as set forth by applicable health authorities.

Last Saved: 6/18/2019 2:49 PM Page 9 of 61

4 SOFTWARE REQUIREMENTS

4.1 COMMON REQUIREMENTS

The requirements specified in this section must be satisfied by both the eTMF and eQMS software. The Contractor shall provide a configurable COTS System. A custom developed system or systems requiring significant customization will not be considered.

4.1.1 Licenses

The Contractor shall provide:

1. Licenses must be provided for an enterprise solution capable of supporting all NIAID divisions within the Institute as well as external NIAID partners, CROs, and other collaborators.

2. A System with no dependencies, restrictions, or limitations on the number of trials, protocols, documents, workflows, or other entities managed by the System.

3. Licenses must be offered in increments of 25 with discounts increasing along with total license count. NIAID expects the total license count to increase to approximately 200 within five years.

4. Licenses must not be required for:

a. NIAID System Administrators and helpdesk support staff

b. Development, QA, or Training environments

5. Licenses and support periods of performance will become effective and payment will be due upon NIAID’s acceptance of the System Release Memo.

4.1.2 General

The Contractor shall provide a System that must:

1. Be an enterprise solution capable of supporting all Divisions within the Institute as well as external NIAID partners, CROs, and other collaborators.

2. Provide NIAID administrators with the ability to logically partition the organizational, procedural, process, and functional elements of the System.

3. Be accessible from within and external to the NIAID network by employees and partners for a variety of tasks and user types.

4. Support integration with NIAID specified Security Assertion Markup Language (SAML)-based identity providers to permit single-sign-on for NIAID staff. The System must also support native authentication for users without records in a SAML identity management provider.

5. Support role-based access and permission management.

6. Support role-based access to all functions and workflows.

Last Saved: 6/18/2019 2:49 PM Page 10 of 61

7. Include security features to restrict and report unauthorized access attempts.

8. Maintain audit logs of all system activity and document changes.

9. Support configurable metadata and naming conventions on a per Division basis.

10. Fully support current and new versions of Windows and Macintosh operating systems.

11. Fully support current and new versions of Google Chrome on Windows and Macintosh, and Apple Safari, Microsoft Edge, and Microsoft Internet Explorer on their respective operating systems.

12. Be Section 508 compliant, in a way that is efficient to develop, implement, test, and use by all members of the NIAID user community.

13. Be offered as Software-as-a-Service and/or cloud-hosted solutions. Systems designed to be installed on premise at NIAID’s computing facility will not be considered.

14. Be Federal Information Security Management Act (FISMA) Moderate compliant. FISMA certification will be required prior to placing the system in production use. Federal Risk and Authorization Management Program (FedRAMP) certification is highly desirable but is not necessary.

15. Include fully functional quality assurance (QA) and training (TRN) environments that are configured identically to the production (PROD) environment.

4.1.3 Electronic Signatures

The Contractor must provide a System which supports electronic signatures that meet the necessary regulatory requirements, in particular 21 CFR Part 11 for electronic records, for all document approvals and procedural affirmations.

4.1.4 Inspection Readiness and Support

The Contractor must provide a System which supports inspections. Inspections are defined as formal and informal audit, assessments, and reviews conducted by internal and external regulatory agencies, government entities, and organizations engaged or authorized by NIAID. The Contractor must:

1. Be inspection ready at all times.

2. Track the different stages of internal and external inspections (scheduling, preparation, execution, report approval, and issuance).

3. Capture and maintain inspection documentation, information, and inspection reports in a central repository that can be used for trending analysis.

4. Manage any necessary follow-up activities including but limited to responding to inspection findings, recommendations, and mitigations.

5. Inform and obtain sponsor approval prior to any inspection.

6. Require minimal sponsor assistance while the inspection is being conducted.

Last Saved: 6/18/2019 2:49 PM Page 11 of 61

4.1.5 Document Management System

The Contractor must provide a System which utilizes a common document management platform that supports:

1. Automatic versioning.

2. Generation of certified copies.

3. Full text search with stemming, wildcarding, and Boolean options.

4. Document searches based on keyword, NIAID defined metadata, user roles, document status, process, and workflow activity.

5. Shared access between eTMF and eQMS.

6. Various file formats (Word, SAS, Excel, JPEG, PDF, etc.).

7. Automatic maintenance of relationships between different renditions of the same document (e.g. MS Word and PDF).

4.1.6 Administration

The Contractor shall provide a System which must be configurable such that NIAID administrators can:

1. Onboard additional Divisions without the need to execute new agreements, purchase orders, or otherwise engage the Contractor except that additional licenses may be required.

2. Create, manage, and modify workflows.

3. Create, manage, and modify metadata and naming conventions.

4. Create, manage, and modify user roles and access permissions.

5. Generate and export detailed audit and usage reports.

4.1.7 Computer Systems Validation (CSV) Support

The Contractor shall provide a System which must be delivered with a Computer Systems Validation (CSV) package that provides documented evidence of compliance with regulatory requirements including 21 CFR part 11, ICH E6 (R2), and GAMP 5 (or similar risk-based framework). CSV packages must be provided for the initial deployment and for any subsequent upgrades. At a minimum, the CSV package must include:

1. Documentation of System features supporting 21 CFR part 11, particularly electronic signatures.

2. Installation Qualification (IQ) and Operational Qualification (OQ) artifacts such as IQ Plan, OQ Plan, executed test scripts, and summary reports.

3. Exemplar Performance Qualification (PQ) Plan and PQ test scripts that NIAID can adapt to meet its specific requirements.

Last Saved: 6/18/2019 2:49 PM Page 12 of 61

4. Any Standard Operating Procedures (SOPS) referenced by the qualification plans.

4.1.8 Other Inspections

The Contractor provided System will be subject to government initiated Federal Information Security Management Act (FISMA) audits and Independent Verification and Validation (IV&V). The reports and findings of any similar inspections done on behalf of the Contractor must be provided to NIAID.

4.2 ETMF SPECIFIC REQUIREMENTS

The Contractor must provide eTMF software which includes a means to centralize sponsor documents that serve to demonstrate the compliance of the investigator, sponsor and monitor with the standards of current Good Clinical Practice (GCP) and with all applicable regulatory requirements. It must:

1. Support the complete TMF lifecycle workflow from study start to archive.

2. Implement Drug Information Association (DIA) and ICH TMF Reference Model for Trial Master Files, the Electronic Document Management (EDM) Reference Model for Regulatory Documents, and the ICH eCTD model for Regulatory Submissions.

3. Support configurable TMF folder structures that differ from the reference models specified above.

4. A centralized repository (specifically, the document management system used by both the eQMS and eTMF) for all eTMF documents.

5. Provide tools for planning, identifying, and tracking the capture of essential documents.

6. Support configurable file plan that allow selection of documents to create template file plans.

7. Support robust notifications on change requests, expiring documents, and TMF current status versus plan.

8. Provide tools for efficiently capturing, filing, and reviewing essential documents.

9. Provide tools for reviewing and management Investigational Site File (ISF) reconciliation.

10. Support bulk importation and upload of documents.

11. Support document placeholders to provide the ability to create full “package” of required documents.

12. Provide tools for monitoring the contemporaneousness of essential documents capture in the eTMF by monitoring and reporting actual to planned activities.

13. Support current and future TMF Export and Content Exchange standards.

14. Enable authorized users and NIAID leadership to view – in detail and at a high level – eTMF related activity, status, history, completeness, and staff assignments.

Last Saved: 6/18/2019 2:49 PM Page 13 of 61

4.3 EQMS SPECIFIC REQUIREMENTS

The Contractor provided eQMS software must support the consolidation of quality processes into a single, integrated system.

4.3.1 General

The following requirements must be satisfied by the Contractor in all eQMS functional areas:

1. Provide process workflows to be configured to meet the different business needs of multiple Divisions.

2. Automate the entire lifecycle of all quality related documents such as guidelines, policies, procedures, standard operating procedures (SOPS), and work instructions. The lifecycle includes creation, review, approval, revision, dissemination, and obsolescence.

3. Must have an automated revision control to ensure that the current version of a document is available by default and that prior versions can be easily accessed on demand.

4. Must automatically create PDF renditions of all non-PDF documents.

5. Support customized naming conventions, numbering, and formatting of quality related documents (these are likely to vary on a Division by Division basis).

6. Manage quality processes, such as assessments, audits, Corrective and Preventative Actions (CAPAs), change control, customer complaints, deviations, inspections, reviews, and training.

7. Promote detection, reporting, and management of processes and activities that may signify risks to clinical research programs, and document changes to manage the risk.

8. Enable authorized users and NIAID leadership to view – in detail and at a high level – quality related activity, status, history, and resources.

9. Must generate reports of QMS activities and issues at the Division level, to allow review by NIAID leadership, and document the oversight of NIAID leadership.

4.3.2 Training Management

The Contractor provided eQMS must include a platform to document and manage training requirements and activities, including:

1. A centralized repository to capture all sponsor training documents. Specifically, this repository must be the common document management system used by both the eQMS and eTMF.

2. The ability to develop and maintain training assignments for different positions or roles.

3. The ability to track training needs and completed training.

4. The ability to automatically notify employees when training is required due to a change in a SOP or the need for refresher training.

Last Saved: 6/18/2019 2:49 PM Page 14 of 61

4.3.3 Quality Events

The Contractor provided eQMS must include functionality for automating and documenting the initiation, management, and reporting quality events such as deviations, Corrective and Preventative Actions (CAPAs), and nonconformance. This includes:

1. The ability to link and cross-reference quality events to other quality related documents such as SOPs and policies.

2. Automatic generation of alerts.

3. Assignment of milestone dates (e.g. planned completion due dates, follow-up reviews, actual completion dates, and effectiveness checks).

4. Review and approval process workflows.

5. Capture of e-signature, root cause, and investigation processes as appropriate.

6. The ability to track and report on status of all current and historical quality events.

7. The capability for reporting trends to determine possible systemic quality issues.

4.3.4 Change Control

1. The Contractor provided eQMS must automate change control process steps (initial request, pre-approval, change execution, post-approval) for different types (processes, facilities, products, etc.).

2. The Contractor provided eQMS must provide options to assess the change control based on risk.

4.3.5 Risk and Mitigation Management

1. The Contractor provided eQMS must have the automation for clinical risk assessment at the system level and protocol level capturing impact, likelihood, and detection for a risk log (register) including tracking of risk indicators and quality tolerance limits

2. The Contractor provided eQMS must support reporting capabilities and trending analysis for system and protocol level risk assessments.

4.3.6 Out of Specification Management (OOS)

1. The Contractor provided eQMS must have automated workflow with e-signature to document product out of specification (OOS) issues.

2. The Contractor provided eQMS must include trending of OOS and reporting capabilities.

Last Saved: 6/18/2019 2:49 PM Page 15 of 61

5 PROFESSIONAL SERVICES S REQUIREMENTS

The second objective of this procurement is to obtain services to ensure the successful configuration, integration, validation, adoption, and operation of the System. The Contractor must provide these tasks through the professional services arm of the Contractor’s company, a third-party systems integrator, or both.

Professional services deliverables are grouped into two broad categories:

Initial Tasks – These include all the activities needed to configure and evaluate the System for at least one Division.

Ongoing Tasks – These include all the activities needed to support a fully operational System.

5.1 INITIAL TASKS

The Contractor shall work on the following tasks upon contract award. The primary objectives of these tasks are to:

1. Train key NIAID project team members and initial users in the capabilities and use of the System.

2. Determine and document NIAID requirements (e.g. permissions model, business processes, naming conventions, etc.).

3. Configure a pilot configuration to meet the requirements of at least one Division.

4. Evaluate and revise the pilot configuration during an approximately six-month pilot period.

5. Finalize and deploy the initial production System for the first Division within six months of the completion of the pilot.

5.1.1 Project Planning Teleconference

Within one week of contract award, the Contractor must participate in a conference call prior to the kickoff meeting to exchange sufficient information to develop an agenda, organize, and prepare questions and discussion topics for the project kickoff meeting, project planning, project team training, System Setup Workshop, and technical planning sessions.

5.1.2 Project Kickoff Meeting

Within two weeks of contract award key Contractor personnel must participate in an onsite project kickoff meeting with key NIAID project team members. The objectives of the meeting are to confirm project objectives, scope, schedule, roles and responsibilities and to review a preliminary project plan.

Last Saved: 6/18/2019 2:49 PM Page 16 of 61

5.1.3 Project Team Training

The Contractor must provide training to the NIAID project team members so they have the knowledge needed to participate in, and make decisions during, the pilot phase. NIAID intends to manage and deliver training to new users after the System is in production use using documentation and materials provided by the Contractor.

1. Within two weeks of contract award the Contractor must provide onsite train-the-trainer training for up to 20 NIAID staff on the configuration and use of the System. The purpose of the training is to give the NIAID team sufficient understanding and experience of the System so they can participate in other project activities.

2. Within two weeks of contract award the Contractor must provide onsite System Administrator training for up to 8 NIAID staff on the technical aspects of the System’s configuration, maintenance, and operation. The purpose of the training is to give NIAID System Administrators sufficient understanding and experience with the System so they can participate in other project activities and provide support and guidance to NIAID’s user community.

3. The Contractor must provide a dedicated training environment accessible from NIAID’s network for classroom use. Training content and focus will be refined based on information provided in this SOW and the Kickoff Planning Teleconference.

4. This training must be conducted immediately after the kickoff meeting so that team members have a better understanding of the System before beginning detailed planning activities.

5. The Contractor must provide electronic copies of training materials for all System roles.

6. NIAID staff may adapt and incorporate Contractor training materials into NIAID training materials for use by any and all licensed users of the System.

7. The Contractor may offer computer-based-training (CBT) options provided it is available to all licensed users and is updated coincident with updates to the System.

5.1.4 System Setup Workshop

Following project team training, the Contractor must lead one onsite interactive System Setup Workshop (SSW) with approximately 20 NIAID team members. The Contractor shall:

1. Ensure that NIAID stakeholders have a full understanding of the System’s capabilities and how they relate to NIAID’s needs.

2. Identify and document the specific options, configuration, and functionality that will be made available to NIAID users. This includes but is not limited the following:

a. User groups, System roles, and logical partitions for Divisions.

b. Process mapping and workflows.

c. Metadata and naming conventions.

d. eTMF reference models.

Last Saved: 6/18/2019 2:49 PM Page 17 of 61

e. Document templates.

f. System notifications (emails) and alerts.

g. Reports, dashboards, and Key Performance Indicators (KPIs).

5.1.5 Final Project Plan

Using information collected during the kickoff meeting and SSW, the Contractor must create and deliver the Project Plan with two weeks after the kickoff meeting. The project plan must identify schedules, deliverables, and responsible parties for all project tasks and activities.

5.1.6 Technical Planning Sessions

Within two weeks of contract award and on an as-needed basis, the Contractor must participate in technical planning sessions with NIAID staff. The primary objectives of these meetings will be to ensure that NIAID technical and information security has sufficient information needed to ensure that the technical and operational aspects of the System satisfy requirements. Areas of particular interest are user access management, SAML configuration, backups, restores, disaster recovery, performance monitoring, vulnerability scans, and mitigations.

5.1.7 Quality Assurance

The Contractor must provide and review with NIAID staff all relevant IQ and OQ Plans, test scripts, and summary reports.

The Contractor must provide an exemplar PQ Plan and PQ Test Scripts and assist NIAID staff in revising and tailoring the PQ Plan and PQ Test Scripts to satisfy NIAID requirements.

5.1.8 Pilot Evaluation

Based on the input from the SSW, the Contractor must configure the eQMS and eTMF software and provide guidance and assistance needed to enable NIAID to conduct a 6-month pilot of the System. The purpose of the pilot is to refine the Institute’s needs as well as the configuration of the System.

5.1.9 Initial Production Deployment

Following the conclusion of the pilot evaluation, the Contractor must deploy and make available the QA environment for NIAID to conduct PQ. Upon successful completion of PQ, the Contractor must deploy the production and training environments and issue the System Release Memo. The training environment must be available within 4 months of the conclusion of the pilot evaluation. The production environment must be available within 6 months of the conclusion of the pilot evaluation.

Last Saved: 6/18/2019 2:49 PM Page 18 of 61

The Contractor must provide technical support to complete the Certification and Accreditation (C&A) of the System, as well as ongoing support to obtain the System’s Authorization to Operate (ATO). This will include:

1. Completing FISMA requirements and documentation conforming to National Institute of Standards and Technology (NIST) guidelines such as, but limited to, security controls (NIST SP 800-53), configuration management, business continuity, and incident response.

2. Identification of monitoring, vulnerability scanning and assessment tools.

3. Documentation describing risk identification, management, and mitigation procedures and policies.

5.2 ONGOING TASKS

The following tasks and deliverables primarily apply to the operation and support of the production use of the System throughout the period of performance.

5.2.1 Administrative

The Contractor’s Project Manager (PM) must participate in regular teleconference status meetings (no less frequently than once a month) to review System activity, utilization, billings, issues, and future plans. Onsite meetings will be scheduled on an ad hoc basis as needed.

5.2.2 Training & Documentation

The Contractor must provide updated end-user training and documentation whenever there are new or significant changes to System functionality.

5.2.3 Operations

The Contractor must be responsible for all backups, restores, disaster planning and recovery, patching, and server monitoring and provisioning.

The Contractor’s SOPs, procedures, and other relevant documentation for these activities must be provided during the initiation phase of the project and whenever significantly changed. Regular reports and logs demonstrating compliance with these requirements must be provided no less than monthly.

The Contractor must provide technical support to maintain the Certification and Accreditation (C&A) of the System, as well as ongoing support to maintain the System’s Authority to Operate (ATO). Tasks will include:

1. Updating security controls (NIST SP 800-53) as necessary.

2. Conducting periodic System security scans and submitting the results to NIAID.

Last Saved: 6/18/2019 2:49 PM Page 19 of 61

3. Proactive monitoring, identification, and mitigation of security vulnerabilities – including any vulnerabilities reported by NIAID.

4. Notify the Government of System breaches, compromises, or data losses within 4 hours of detection.

5. Remedial action must be taken to address security vulnerabilities within the following timeframes:

a. Critical – 2 days

b. Severe – 4 days

c. Serious – 7 days

5.2.4 Inspection Support

The Contractor must provide timely and qualified assistance in support of an assessment or audit by a regulatory agency or a NIAID partner or contractor. This includes responding to corrective actions and recommendations.

5.2.5 Support, Service Level Agreement (SLA) and Communication

1. The Contractor must provide service level agreement that provides a definition for grading the severity of issues and timing expectation for the Contractor’s response based on the severity level of the issue. NIAID expects the following issue response times:

Issue Level

Impact Examples Maximum Response Time to Confirm Issue with

NIH

Maximum Time to Resolve the Issue

Critical The issue is a major application problem making it impossible to use the System.

Service is not available;

application does not save critical data correctly

4 business hours 1 business day

High The issue impacts a large number of users and no work around exists.

Slow application response time, session timeouts, some application functionality is broken

1 business day 2 business days

Last Saved: 6/18/2019 2:49 PM Page 20 of 61

Issue Level

Impact Examples Maximum Response Time to Confirm Issue with

NIH

Maximum Time to Resolve the Issue

Medium The issue impacts a small number of users of a particular user role, or large number of broad users.

However, a workaround does exist.

Users running a supported browser are impacted but can use an alternate browser.

Minor function is broken, but workflow can still proceed.

2 business days 4 business days

Low The issue does not impact the users.

A new feature request, or the issue is minor and does not impact workflow.

5 business days N/A

2. The Contractor must provide first level support via email and a 24/5 toll-free helpdesk for routine end-user issues such as:

a. The authorization, addition, removal, and modification of user access using criteria and within a timeframe specified by NIAID.

b. Access problems.

c. System functionality and usage.

d. Enhancement requests.

3. The Contractor must notify users and NIAID administrators at least 24 hours in advance of any planned outage and its expected duration.

4. Within one hour of the occurrence of an unplanned outage, the Contractor must notify users and NIAID administrators of the issue and an anticipated resolution time. Thereafter, updates must be provided no less frequently than every four hours until the issue is resolved.

5. The Contractor must provide NIAID administrators with direct access to qualified technical experts via email and a 24/5 toll-free helpdesk.

6. On an as-needed basis the Contractor must make qualified technical staff available on status calls to review and discuss identified issues.

7. The Contractor must provide monthly operational reports summarizing updates, usage, outages, issues, and response times.

8. The Contractor must provide contact information for the corporate executives responsible for all professional services and operations. These executives will be contacted to escalate critical issues in the event normal processes are not working.

Last Saved: 6/18/2019 2:49 PM Page 21 of 61

5.2.6 Updates

The Contractor shall provide:

1. System and software updates and patches required to address regulatory changes must be implemented at least one month in advance of the regulatory effective date.

2. Updated training material and user documentation must be delivered at least one month in advance of any implemented change.

3. An updated CSV package must be delivered at least one month in advance of any implemented change.

4. Provide Installation Qualification and Operational Qualification (IQ/OQ) testing and supporting documentation for all System upgrades.

5.2.7 Transition or Termination

No later than 45 days prior to end of the contract period of performance (POP) or within 5 days notification that NIAID intends to terminate the contract, the Contractor must prepare and deliver a detailed transition plan. During the transition period, the incumbent Contractor must provide all resources required to ensure a smooth transition to the successor Contractor. This includes a validated transfer of all documents and data. NIAID requires the maintenance of all customer support during this period. All performance requirements of the contract will remain in effect until contract term as defined expires.

At no time and under no circumstances will the Contractor withhold or render inaccessible any NIAID documents or data.

5.3 OPTIONAL TASKS

The following two optional tasks may be exercised at NIAID’s discretion during the period of performance in accordance with FAR 52.217-7 Option for Increased Quantity – Separately Priced Line Item.

5.3.1 Integration with NIAID Clinical Research Systems (Optional)

Upon exercise of this option, the Contractor must provide a sub-task to assist NIAID in developing integrations between the eTMF and eQMS systems and NIAID’s existing Clinical Research Informatics system. For example, synchronizing the list of Clinical Research sites from NIAID’s CRMS to the eTMF system.

Last Saved: 6/18/2019 2:49 PM Page 22 of 61

5.3.2 Data Migration (Optional)

Upon exercise of this option, the Contractor must provide a sub-task to transfer existing data and documents into the eTMF and eQMS system. This includes but is not limited to the following tasks:

• Transfer of SOPs/documents from file shares or document management systems.

• Transfer of data/documents into Equipment module, CAPA modules and other modules as needed.

• Transfer of data from other eTMF systems under a validated the transfer of the data/SOPs into the systems.

• All quality assurance and control processes needed to ensure that all migrated documents and data maintain compliance with regulatory requirements.

5.3.3 Subject Matter Expert Hours (Optional)

Upon exercise of this option, the Contractor must provide ad hoc subject matter expertise that includes but is not limited to the following:

• Identifying and supporting the implementation of eTMF and eQMS best practices.

• Adapting and reconfiguring the eTMF and eQMS system in support of evolving regulatory requirements.

• Providing analysis and recommendations in support of unusual or unexpected out-of-scope operational issues and opportunities.

5.4 KEY PERSONNEL

The Contractor must assign a technical single point of contact, also known as the Program Manager (PM), to be the Contractor’s authorized point of contact with the Government’s Contracting Officer (CO) and Contracting Officer’s Representative (COR). The Contractor PM must ultimately be responsible for ensuring that the Contractor’s performance meets all Government contracting requirements within price and schedule. The Program Manager must be responsible for formulating and enforcing work standards, assigning schedules, reviewing work discrepancies, and communicating policies, purposes, and goals of the organization to subordinates. In support of open communication, the Contractor PM must initiate regular meetings with the COR.

Skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” and are those persons whose resumes were submitted and marked by the Contractor as “Key Personnel”. Key personnel must be identified by name and title/job classification. The must be identified as key personnel.

Last Saved: 6/18/2019 2:49 PM Page 23 of 61

The key personnel specified in this contract are essential to work performance. At least 30 days prior to the Contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor must notify the Contracting Officer and must submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract. If the employee of the Contractor is terminated for cause or separates from the Contractor voluntarily with less than thirty days’ notice, the Contractor must provide the maximum notice practicable under the circumstances. The Contractor must not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

Substitutions of key personnel must only be…