CRADA_Builder_SOO_4-4-16.pdf

STATEMENT OF OBJECTIVES

Multi-Agency CRADA Builder Tool

1. Background

The Stevenson-Wydler Technology Innovation Act of 1986 (Public Law 96-480) was the first of several laws defining federal technology transfer. By this Act, federal laboratories were allowed to transfer technologies based on their research and development (R&D) to nonfederal parties and to provide outside entities with the means to access federal laboratory developments. The law also established an Office of

Research and Technology Applications in each laboratory to coordinate and promote technology transfer.

The Federal Technology Transfer Act of 1986 (Public Law 99-502) established that all federal laboratory scientists and engineers are required to consider technology transfer an individual responsibility. The Act further established a charter and funding mechanism for the Federal Laboratory Consortium for

Technology Transfer (FLC). Government-owned, government-operated (GOGO) laboratories were also authorized to enter into Cooperative Research and Development Agreements (CRADAs) and to negotiate the licensing of government inventions created in federal laboratories. Since 1988, under the Omnibus

Trade and Competitiveness Act (Public Law 100-418), the National Institute of Standards and

Technology (NIST) has served as the host agency for the FLC, collecting contributions from various federal agencies and departments for the purpose of funding the activities of the Consortium and providing administrative support as needed.

Lab to Market is a Cross Agency Priority goal established by the White House as part of the Presidential

Management Agenda. It is carried out by a working group with representation from the White House

Office of Science and Technology Policy, the Office of Management and Budget, and a number of federal agencies, and comprises five sub-goal areas: Developing Human Capital, Empowering Effective

Collaborations, Opening Research and Development Assets, Fueling Small Business Innovation, and

Evaluating Impact.

NIST has a critical coordination role among the various interagency working group efforts, including the

Lab to Market working group and the FLC. NIST received funding to carry out several interagency-based projects in support of the Lab to Market efforts, under which this CRADA Builder tool development is being funded. The FLC plays a role in helping to carry out the Lab to Market Cross Agency Priority goal, particularly in maintaining tools that support the subgoals of Empowering Effective Collaborations and

Opening Research and Development Assets.

2. Objectives

The objective of this contract is to research, design, develop, and deploy a multi-agency tool to automate and streamline the creation of Cooperative Research and Development Agreements (CRADAs). The final tool shall be hosted on the FLC’s federallabs.org website.

3. General Requirements

The Contractor shall furnish all personnel, materials, services, and facilities necessary to perform the requirements set forth in this Statement of Work (SOW).

The Contractor shall perform the following support functions and activities and perform the identified tasks for the CRADA Builder tool development, testing, and deployment to the federallabs.org website, whether internally or through a combination of expertise resources partnered with the Contractor:

TASK 1: Conduct assessment and strategy session

a. Meet with representatives from the National Institutes of Health to evaluate their current single agency CRADA Builder tool and develop a strategy for creating an expanded tool for additional agencies in a single web portal system

b. Meet with agency stakeholders and develop detailed strategy for web application development

c. Hold agency focus groups on current processes and needs

d. Create detailed requirements strategy and software requirements document that integrates user feedback and prior assessments of the existing tool

TASK 2: Develop a Multi-Agency CRADA Builder Tool and web application interface

a. Create a way to incorporate different agency needs into a single tool

b. Create database schemas and data hierarchies for tool

c. Create graphic interface designs

d. Design wireframes of website tool

e. Create database schemas and interfaces

f. Prepare database mapping strategies

TASK 3: Build all necessary databases and pages to implement the CRADA Builder tool and provide the code documentation for all revisions. Incorporate databases and ensure functionality, to include appropriate user access.

a. Integrate, enhance and modify databases as needed

b. Develop security framework as needed to allow appropriate user access (user, administrator, etc) for the appropriate agency information.

c. Ensure 508 compliance

TASK 4: Testing of tool

a. Test 508 compliance

b. Test database connectivity and all links

c. Test user functionality

d. Test cross-browser access

TASK 5: Release the CRADA Builder tool

a. Coordinate with existing FLC contract personnel to integrate the CRADA Builder tool into the federallabs.org website.

4. Specific Requirements:

4.1 Background.

Many agencies use Cooperative Research and Development Agreements, or CRADAs, to partner with outside organizations. These documents can be long and complex, and may take substantial amounts of time to prepare the first draft of the document. The National Institutes of Health (NIH) has previously developed a web-based CRADA Builder tool to use internally for the development of agreement documents. Likened to the “Turbo Tax” of document preparation, the system walks NIH users through a series of questions about the intended project and partnership, and then generates an initial annotated draft of the CRADA document based on the answers with the appropriate legal and policy clauses inserted.

From there, negotiation with the outside party is more streamlined. Agencies have varied requirements about legal clauses, internal policies, and document structure for their CRADAs. These challenges will need to be evaluated and a strategy proposed to allow users from multiple agencies to use the same tool.

The Contractor’s effort shall require not only coordination with NIST, but also with elected members of the FLC’s Executive Board and the current FLC contractor responsible for maintenance of the federallabs.org website. Within the FLC, the Communications Committee has oversight of the general website and the Laboratory and Business Systems (LaBS) Committee is responsible for oversight of tools to promote and facilitate technology transfer. Previously, the FLC has delivered the Available

Technologies tool and FLCBusiness tool to provide laboratories and industry access to datasets previously unavailable in highly searchable manners. A background in technology transfer methods, the operations and technical expertise of federal laboratories across agencies, and a background in connecting technologies across multiple business sectors and scientific disciplines with potential partners for the federal labs will be useful in developing this CRADA Builder tool and working with the relevant agencies and Executive Board members to understand their needs.

The Contractor shall provide database development, graphics, communications, and website enhancement services necessary to build a multi-agency CRADA Builder tool as set forth below.

4.2 Personnel Requirements: The Contractor shall have a firm understanding of database design and development, and of Graphic User Interface (GUI) design and development, with a minimum of five years’ experience in each of the aforementioned areas. A demonstrated understanding of federal technology transfer laws, principles, and practices across federal agencies and laboratories will be useful but is not required. The Contractor shall apply their expertise, in coordination with relevant members of the FLC Executive Board (EB) and working with the Contracting Officer’s Representative (COR), to implement a sound strategy to design, develop, test, and launch a multi-agency CRADA Builder tool to be hosted on the federallabs.org website.

4.3 Tasks: The Contractor shall perform the following tasks during the Period of Performance:

Task 1: Conduct assessment and strategy sessions.

The Contractor shall complete the following tasks:

a. Perform a comprehensive design requirements analysis of the existing NIH CRADA Builder tool in-person or via webinar within 15 business days of award. This analysis shall, at a minimum, demonstrate that the Contractor fully understands: the existing NIH system capabilities and user interfaces for the generation of real CRADA documents; the current system architecture; the document generation and storage capabilities; and the user log-in systems.

b. Set in-person and/or teleconference meetings (estimated 2-8) within 60 days of award with relevant stakeholders to hold focus groups and develop a detailed strategy plan for the development of the multi-agency CRADA Builder tool. Relevant stakeholders shall include participating agency tech transfer representatives; relevant members of the FLC Executive Board;

Communications and Laboratory and Business Systems committee members; and members of the

FLC’s National Advisory Council. These meetings will, in total, include approximately 15-20 stakeholders. Minutes from this meeting shall be distributed to the COR, the FLC Executive

Board, and the participating agency representatives.

c. Prepare a written software requirements document outlining the necessary development steps and timelines, utilizing an agile development environment if appropriate.

d. Provide a quarterly written report to the FLC Executive Board and the FLC Communications and

LaBS Committees throughout the Period of Performance, detailing expenditures, progress on the tool, stakeholder feedback at each of the various stages, and requests for any additional input that is required from the Board and Committees.

Task 2: Develop a Multi-Agency CRADA Builder tool and web application interface

The Contractor shall complete the following tasks:

a. Develop a database structure that allows multiple agencies (up to 6) to use a single tool with their specific agency clauses built into the system and accessible from an individual agency log-in.

b. Generate database schemas and data hierarchies to fully capture existing agency legal and policy clauses, variations, and both internal use and external use annotations (which will be provided by participating agencies).

c. Develop a process by which information about the agency and partner is selected and/or entered into a form by the user and automatically inserted in appropriate places throughout the document.

d. Develop a process by which the appropriate agency clauses are inserted into a standard template backbone based on a user’s answers to a series of questions about the specified partnership

(which will be provided by participating agencies).

e. Create administrator access that allows an authorized agency user to make updates to the approved clauses and template structure when legal or policy revisions need to be made.

f. Build functionality that allows a user to save drafts in progress.

g. Build functionality that allows a user to export a completed draft as an MS Word document.

h. Build functionality that allows multi-party CRADAs comprising of up to three federal agencies plus multiple outside partners, and highlights conflicting language within the document and/or suggests mutually acceptable clauses.

i. Create graphic interface designs and wireframes for the tool

j. Create a site architecture map utilizing information architecture principles.

k. Hold a Preliminary Design Review meeting within six (6) months of award with the agency stakeholders for preliminary design approval. NIST will arrange for a meeting location in the DC metro area and provide webinar capabilities as needed. The Contractor shall demo the preliminary draft of the tool, receive and incorporate stakeholder feedback, and highlight any remaining challenges or outstanding issues. Minutes from this meeting shall be distributed to the COR, the

FLC Executive Board, and the participating agency representatives.

Task 3: Build all necessary pages to implement the tool and provide the code documentation for all revisions. Incorporate databases and ensure functionality.

The Contractor shall perform the following tasks:

a. Include alt tags and other necessary techniques for full compliance with Section 508 incorporated into the tool.

b. Provide the ability for individuals to have secure user name and password access to the tool website, which directs them to the appropriate agency section and user-level access (user, administrator, etc).

c. Create automated testing scripts to ensure code functionality.

d. Organize and hold a Critical Design Review meeting within fifteen (15) months of award with the participating agency stakeholders, FLC contractor personnel responsible for the website, and relevant members of the FLC EB once the tool has been completed and is ready for final testing.

NIST will arrange for a meeting location in the DC metro area and provide webinar capabilities as needed. The Contractor shall demo the final draft of the tool, receive and incorporate final stakeholder feedback, and generate a plan to coordinate with FLC contract personnel for deployment of the completed tool on the federallabs.org website. Minutes from this meeting shall be distributed to the COR, the FLC Executive Board, and the participating agency representatives.

Task 4: Perform testing of website for functionality and user experience prior to website launch.

a. Conduct accessibility testing across all pages within the tool website to ensure Section 508 compliance.

b. Perform all necessary testing to validate code.

c. Conduct regression testing against all databases.

d. Test for browser independence and printed pages.

Task 5: Release the Multi-Agency CRADA Builder tool.

a. Coordinate with existing FLC contract personnel to integrate the CRADA Builder tool into the federallabs.org website.

The following are the deliverables identified for the task(s) above.

Description Quantity Frequency and/or Due

Date

[1] Quarterly Report to FLC Executive Board, Communications and

Laboratory and Business Systems Committees regarding Contractor support activities and expenditures

4 each January 1, April

1, July 1, October 1

[1] Analysis of existing NIH tool 1 15 business days from award

[1] Requirements Gathering Meetings Up to 8 45 days from date of award

[1] Minutes from Requirements Gathering Meetings 1 Two weeks after last meeting date

[2] Database structure for CRADA Builder tool 1 3 months from date of award

[2] Preliminary Design Review Meeting 1 6 months from date of award

[2] Minutes from Preliminary Design Review Meeting 1 Two weeks after meeting date

[3] Critical Design Review Meeting 1 8 months from date of award

[3] Minutes from Critical Design Review Meeting 1 Two weeks after meeting date

[3] Code documentation 1 10 months from date of award

[4] Website testing report 1 11 months from date of award

[5] Launch CRADA Builder tool on FLC website 1 12 months from date of the award

TASK ORDER REPORTS

In addition to the previously identified reports to the FLC Executive Board, monthly status reports must be provided to the COR identified within the task order by the 10th day of the next month. The status reports, at a minimum, must address the status of each deliverable, which deliverables have been completed under the task order, outstanding deliverables, any delays, reason for delays and risk/issue management.

INSPECTION AND ACCEPTANCE

As tasks and deliverables are completed, the Contractor shall submit the deliverables for review by the

COR. The COR will provide comments on any given deliverable within five business days after the receipt of deliverables. The Contractor shall revise and resubmit the deliverable(s) in accordance with the

COR’s comments and resubmit for COR review and further comment/approval. All revisions shall be made at no additional cost to the Government.

QUALITY ASSURANCE PLAN

The COR will monitor the timely execution of deliverables through monthly status task order reports.

TRAVEL

Only local travel in the DC metro area will be authorized under this contract.

PERIOD OF PERFORMANCE

Deliverables are due twelve (12) months from the date of award. The period of performance for this task order shall be for eighteen (18) months from the date of award to account for any potential Government delays.

PLACE OF PERFORMANCE

All work shall be accomplished at Contractor’s facilities or meeting facilities in the DC metro area as designated in the task(s) above.

GOVERNMENT-FURNISHED PROPERTY, DATA, AND INFORMATION

1. Access to NIH CRADA Builder website and source code as needed.

2. Tables of agency legal clauses, approved language modifications, and annotations regarding the use of the standard and alternate clauses. These tables are to be provided to the Contractor upon award.

INVOICES

Upon acceptance of the deliverable by the COR, an invoice may be submitted in accordance with the billing instructions. Monthly status reports will be considered deliverables and should be included as part of a payment schedule for this task order. A courtesy copy of each invoice shall be sent to the COR.

GENERAL INFORMATION

Approved language modifications and internal annotations provided by the participating agencies shall be considered confidential.

IT Requirements:

IT Security. The Contractor shall submit their documentation, including any subcontractors involved, that indicates an Authorization to Operate (ATO) letter issued by a Federal Government agency as evidence that they have been assessed and authorized according to the Federal Information Processing Standards

(FIPS) Publication 200 and NIST Special Publication 800-53 Rev4, or that they have passed an independent security audit. If using a Federal Government agency-issued ATO letter, that letter shall clearly state the impact rating level (low, moderate, high) at which the Contractor has been assessed and authorized.

Internet Protocol Version 6 (IPv6). Per the Office of Management and Budget (OMB) Memorandum, “Transition to IPv6,” the Contractor services shall be accessible through both Internet Protocol Version 6

(IPv6) and IPv4. If not already compliant, the Contractor shall provide the Government with a statement regarding its plans to implement IPv6, including timeframe.

Section 508. The Contractor shall already have or create and maintain a system that complies with

Section 508 of the Rehabilitation Act. Proof must be submitted.

Authentication. The Contractor shall configure its system or application to be compliant with:

Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification

Standard for Federal Employees and Contractors.

National Strategy for Trusted Identities in Cyberspace (NSTIC)

The preferred authentication methods are through integration with Connect.gov and application-issued credentials. Connect.gov can provide both PIV card and approved third party credentials. Users shall be given the option of using an acceptable PIV, third party credential or establishing a credential with the contractor provided solution. Applications that cannot integrate with Connect.gov will implement user authentication via Government-issued PIV cards, approved third party credentials and contractor solution-provided credentials. Third party authentication must be consistent with the National Strategy for Trusted

Identities in Cyberspace (NSTIC); with providers and protocols approved by the Federal Identity, Credential, and Access Management (FICAM) Trust Framework Solution (TFS) Program. In all cases a contractor solution-provided credential must also be supported to allow access by external collaborators that do not have or do not wish to use a trusted third party credential. All credentials shall be consistent with NIST Special Publication 800-63 and the system’s accessed Level of Assurance (LOA). The required minimal LOA is Level 2.

HTTPS and HSTS. Pursuant to the Office of Management and Budget (OMB) Memorandum, “Policy to

Require Secure Connections across Federal Websites and Web Services,” the Contractor shall ensure that any publicly accessible Federal website(s) and web service(s) are required to provide service only through a secure connection through use of Hypertext Transfer Protocol Secure (HTTPS), and must have HTTP

Strict Transport Security (HSTS) enabled.

Incident Response. The contractor shall provide to NIST the qualifications and contact information of their security and incident response team. The contractor shall be able to notify NIST within three (3) hours of any possible malicious activity, providing a unique incident reference number and contact information for further details. The contractor shall be able to provide any application and operating system logs associated with an incident as well as a file system timeline for potentially compromised hosts and any additional files referenced during forensic analysis upon request.

Media Inquiries: The Contractor employee(s) shall not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the COR. There shall be no interviews, comments, or any other response without the knowledge and approval of the Chief of the NIST Public Affairs Office.

Printing Services: All printed materials shall be compliant with Government printing regulations (44

U.S.C. 501).

Publicity Materials: All publicity materials shall be submitted electronically to be reviewed and approved by the NIST Contracting Officer Representative (COR) prior to release. All publicity materials shall be transferred to the COR on completion of the contract.