SBSSN - Revvity Electronic Laboratory Notebook FedRAMP.pdf

SOURCES SOUGHT NOTICE

1. Solicitation Number: 75N95025Q00218SB

2. Title: Revvity Electronic Laboratory Notebook FedRAMP

3. Classification Code: 6640 – Instruments and Laboratory Equipment

4. NAICS Code: 334516 – Analytical Laboratory Instrument Manufacturing

5. Description:

This is a SMALL BUSINESS SOURCES SOUGHT NOTICE. This is NOT a solicitation for proposals, proposal of abstracts or quotations. The purpose of this notice is to obtain information regarding: (1) the availability and capability of qualified small business sources; (2) whether they are small businesses (e.g., 8(a), Veteran-owned small businesses, service-disabled Veteran-owned small businesses, HUBZone small businesses, small disadvantaged businesses, and women-owned small businesses);

and (3) their size classification relative to the North American Industry Classification

System (NAICS) code for the proposed acquisition. Your response to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible.

This notice is issued to help determine the availability of qualified companies technically capable of meeting the Government requirement and to determine the method of acquisition. It is not construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals or quotes. No award will be made as a result of this notice. The Government will NOT be responsible for any costs incurred by the respondents to this notice. This notice is strictly for market research and information purposes only. Furthermore, it should be noted that any future solicitations that may be issued as a result of this notice, or in response to this requirement, may be issued using a different solicitation number from the one identified above.

Background: Scientific Software as a Service (SaaS) applications are becoming increasingly prevalent in the scientific community. The growing adoption of cloud computing, big data analytics, and artificial intelligence in scientific research is driving the demand for SaaS applications that can provide researchers with easy access to powerful computing resources, data storage and management, and sophisticated analysis tools.

SaaS applications are particularly popular in fields such as genomics, proteomics, drug discovery, and clinical research, where large amounts of data must be managed and analyzed. SaaS applications also offer the advantage of scalability, allowing researchers to easily expand or contract their computing resources as their needs change.

At NIH, the prevalence of scientific SaaS applications is expected to continue to grow as researchers seek out more efficient, flexible, and cost-effective ways to manage and analyze their data.

There are several typical security risks associated with scientific Software as a Service (SaaS) applications, including:

• Interoperability: A key requirement for scientific SaaS applications to be part of the NIH collaborative cloud environment is interoperability. Such interoperability across boundaries creates security conditions that must be addressed prior to issuance of the authority to operate (ATO).

• Data breaches: Scientific SaaS applications often handle sensitive and confidential data, such as patient health information, research data, and intellectual property. Data breaches can result in the theft or unauthorized disclosure of this information.

• Malware and viruses: Scientific SaaS applications can be vulnerable to malware and viruses, which can infect the application or the user's computer and compromise security.

• Insider threats: Insiders, such as employees, contractors, or partners, can pose a security risk by intentionally or unintentionally accessing, modifying, or destroying sensitive data.

• Insecure APIs: Scientific SaaS applications often use APIs to connect with other applications or services. Insecure APIs can be exploited by attackers to gain unauthorized access to the SaaS application or sensitive data.

Security is critically important for scientific Software as a Service (SaaS) applications for several reasons:

• Protecting sensitive data: Scientific SaaS applications often handle sensitive and confidential data, such as patient health information, research data, and intellectual property. Security measures such as data encryption, access controls, and firewalls can help protect this data from unauthorized access, theft, or tampering.

• Ensuring compliance: Many scientific SaaS applications are subject to regulatory compliance requirements, such as FedRAMP. Implementing security measures can help ensure that the application meets these requirements and avoid costly fines and legal liabilities.

• Maintaining trust: Scientific SaaS applications rely on user trust to be successful. Security breaches can damage the reputation of the application and erode user trust. By implementing robust security measures, providers can demonstrate their commitment to protecting user data and maintaining user trust.

• Preventing downtime: Security breaches can also result in downtime for the application, which can have significant financial and operational consequences. By implementing security measures such as intrusion detection and prevention systems, providers can prevent security breaches and minimize downtime.

Security is essential for scientific SaaS applications to protect sensitive data, ensure compliance, maintain trust, and prevent downtime. By implementing robust security measures, providers can help ensure the success and sustainability of their applications.

NIH has already invested substantially in multiple scientific SaaS applications that although determined to meet agency security requirements have not undergone a full FedRAMP assessment. The purpose of this contract is to build upon these investments to help these SaaS applications achieve FedRAMP Moderate authorization.

Modification of SaaS applications to meet FedRAMP requirements does not alter the commercial nature of the applications, alter their non-governmental function or essential characteristics, or change their purpose.

1.1. Purpose and Objectives: General Requirements

Independently and not as an agent of the Government, the contractor shall provide all necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, necessary for specific scientific Software as a Service (SAAS) cloud service providers (CSPs) to obtain FedRAMP Moderate authorization, as follows.

1.2. Contract and Project Management

1.2.1. The contractor shall provide project management to obtain FedRAMP authorization for the Revvity Signals Software Signals ELN, through the stage of submission to FedRAMP. The contractor shall work in coordination with designated federal staff, and be responsible for performing all the non-inherently governmental activities associated with performance of this SOW.

1.2.2. Deliverables:

1.2.2.1. The contractor shall prepare a management plan describing the technical approach, organizational resources, and management controls to be employed to meet the cost, performance, and schedule requirements throughout contract execution. The proposed management plan shall include a milestone schedule for FedRAMP package submission. The proposed management plan shall be submitted with the written technical proposal. At the time of award, the Government may recommend changes to the management plan which will be made final within fifteen days of contract award.

1.2.2.2. The contractor shall document the efforts performed in the completion of each task in a detailed monthly report and presentation. The report shall include the following items and any additional information that NCATS deems necessary:

a. Individual project status to include objectives met, work completed, and work outstanding.

b. Issues and obstacles impeding progress and recommended solutions.

c. Status of deliverables/milestones.

d. Topics or issues identified by the COR.

1.3. General FedRAMP Authorization Support

1.3.1. Provide comprehensive support through submission of the FedRAMP package to the FedRAMP PMO.

1.3.2. Deliverables:

1.3.2.1. Monthly status updates throughout the FedRAMP

submission process.

1.4. Gap Remediation

1.4.1. Remediation efforts will be required for both technical and documentation deficiencies. Based on the Gap Analysis the Contractor shall manage the remediation of identified deficiencies.

This includes but is not limited to:

1.4.1.1. Develop a plan for the implementation of appropriate security controls to address identified risks and vulnerabilities.

1.4.1.2. Document the implemented security controls, including policies, procedures, and technical controls.

1.4.2. Deliverables

1.4.2.1. Monthly status updates throughout the FedRAMP

submission process.

1.5. Interoperability assurance

1.5.1. NIH has invested substantial resources in many different SaaS applications, and to maximize the investment and the overall functionality and usability of each application within the collaborative cloud environment it is crucial that the contractor works to ensure that there is a focus on interoperability between applications with guidance from the government on key features as required. An ideal time to ensure interoperability is during the Remediation phase as that is most likely when technical changes will be made to a SaaS application. With direction from the government, the contractor will be responsible for ensuring the interoperability of each SaaS application by ensuring the following criteria, and others as determined by federal staff, are met:

1.6. Prepare and Submit FedRAMP Moderate Package

1.6.1. Once Remediation is completed and Interoperability is assured, the government will contact the FedRAMP PMO and shall act as the sponsor for the authorization package.

1.6.2. The SaaS provider complete the FedRAMP Moderate package and prepare for the 3PAO assessment.

1.6.3. The SaaS provider will submit a FedRAMP Moderate package to a FedRAMP-accredited third-party assessment organization (3PAO) for review and validation of the implemented security controls.

1.6.4. Once the 3PAO assessment is complete, the SaaS provider shall work to address any remaining vulnerabilities or areas for improvement identified during the assessment.

1.6.5. Based on the results of the security assessment, the SaaS provider may obtain FedRAMP Moderate authorization to operate (ATO) from the government agency that will use the SaaS application.

1.6.6. The SaaS provider will maintain FedRAMP Moderate compliance and continuously monitor and improve the implemented security controls.

1.7. CSP Reimbursement

1.7.1. CSPs will be reimbursed for the direct cost of remediation, interoperability assurance, and 3PAO assessment necessary to obtain FedRAMP authorization. The Government will authorize such reimbursement only after determining whether such reimbursement is allowable, reasonable, and allocable.

1.7.2. Deliverables:

1.7.2.1. Periodic progress reports.

1.8. Government Responsibilities

1.8.1. The Government will identify scientific SaaS providers to be supported under this requirement.

1.8.2. The Government will provide the contractor with access to all systems and information required to successfully perform the work requirements specified in this SOW.

Capability statement /information sought.

Companies that believe they possess the capabilities to provide the required products or services should submit documentation of their ability to meet each of the project requirements to the Contracting Officer. The capability statement must specifically address each of the project requirements separately. Additionally, the capability statement should include 1) the total number of employees, 2) the professional qualifications of personnel as it relates to the requirements outlined, 3) any contractor

GSA Schedule contracts and/or other government-wide acquisition contracts (GWACs) by which all of the requirements may be met, if applicable, and 4) any other information considered relevant to this program. Capability statements must also include the

Company Name, Unique Entity ID from SAM.gov, Physical Address, and Point of

Contact Information. The response must include the respondents’ technical and administrative points of contact, including names, titles, addresses, telephone and fax numbers, and e-mail addresses.

Interested companies are required to identify their type of business, applicable North

American Industry Classification System (NAICS) Code, and size standards in accordance with the Small Business Administration. The government requests that no proprietary or confidential business data be submitted in a response to this notice.

However, responses that indicate the information therein is proprietary will be properly safeguarded for Government use only. Capability statements must include the name and telephone number of a point of contact having authority and knowledge to discuss responses with Government representatives. Capability statements in response to this market survey that do not provide sufficient information for evaluation will be considered non-responsive. When submitting this information, please reference the solicitation notice number.

One (1) copy of the response is required and must be in Microsoft Word or Adobe PDF format using 11-point or 12-point font, 8-1/2” x 11” paper size, with 1” top, bottom, left and right margins, and with single or double spacing.

The information submitted must be in and outline format that addresses each of the elements of the project requirement and in the capability statement /information sought paragraphs stated herein. A cover page and an executive summary may be included but is not required.

The response is limited to ten (10) page limit. The 10-page limit does not include the cover page, executive summary, or references, if requested.

All responses to this notice must be submitted electronically to the Contract Specialist and Contracting Officer. Facsimile responses are NOT accepted.

The response must be submitted to Scott Duernberger, Contract Specialist at e-mail address scott.duernberger@nih.gov.

The response must be received on or before 3:00pm Eastern Time July 25, 2025.

“Disclaimer and Important Notes: This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The

Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the

Government to determine the organization’s qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published in www.sam.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

Confidentiality: No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).”