ORDER FOR SUPPLIES OR SERVICES

PAGE OF PAGES

1 22 IMPORTANT: Mark all packages and papers with contract and/or order numbers.

1. DATE OF ORDER 2. CONTRACT NO. (If any) 6. SHIP TO:

07/30/2026 a. NAME OF CONSIGNEE

3. ORDER NO. 4. REQUISITION/REFERENCE NO. CENTERS FOR DISEASE PREVENTION AND LONGEVITY, IN 000HCKDE-2026-97423 b. STREET ADDRESS

5. ISSUING OFFICE (Address correspondence to) Centers for Disease Control and Prevention Chamblee Campus Building 102, MS S102-4 4770 Buford Hwy Atlanta, GA 30341-3717

1600 CLIFTON RD NE D 14

c. CITY

ATLANTA

d. STATE

GA

e. ZIP CODE

30329-4018

f. SHIP VIA

a. NAME OF CONTRACTOR

8. TYPE OF ORDER

b. COMPANY NAME a. PURCHASE X b. DELIVERY

REFERENCE YOUR:

c. STREET ADDRESS

d. CITY e. STATE f. ZIP CODE

9. ACCOUNTING AND APPROPRIATION DATA

9210961 2555 2026 75-26-0950 5610411101

10. REQUISITIONING OFFICE

HCKDE

11. BUSINESS CLASSIFICATION (Check appropriate box(es))

a. SMALL b. OTHER THAN SMALL c. DISADVANTAGED d. WOMEN-OWNED

12. F.O.B. POINT

Destination

13. PLACE OF

a. INSPECTION b. ACCEPTANCE

14. GOVERNMENT B/L NO. 15. DELIVER TO F.O.B. POINT

ON OR BEFORE (Date)

08/31/2029

16. DISCOUNT TERMS

Net 30 Days

17. SCHEDULE (See reverse for Rejections)

ITEM NO.

(a)

SUPPLIES OR SERVICES

(b)

QUANTITY

ORDERED

(c)

UNI

T (d)

UNIT

PRICE

(e)

AMOUNT

(f)

QUANTITY

ACCEPTED

(g)

“See Continuation Page”

Questions Due Date 7 August 2026 2:00 EDT

Proposal Due August 14, 2026; 2:00 PM EDT

18. SHIPPING POINT 19. GROSS SHIPPING WEIGHT 20. INVOICE NO.

21. MAIL INVOICE TO: 0.00

a. NAME

Centers for Disease Control and Prevention (FMO)

b. STREET ADDRESS (or P.O. Box)

PO Box 15580 404-718-8100

c. CITY

Atlanta

d. STATE

GA

e. ZIP CODE

303330080 0.00

23 NAME (Typed)

NSN 7540-01-152-8083

PREVIOUS EDITION NOT USABLE

OPTIONAL FORM 347 (REV. 6/95)

Prescribed by GSA/FAR 48 CFR 53.213(e)

Except for billing instructions on the reverse, this delivery order is subject to instructions contained on this side only of this form and is issued subject to the terms and conditions of the above-numbered contract.

Please furnish the following on the terms and conditions specified on both sides of this order and on the attached sheet, if any, including delivery as indicated.

17(h)

TOT.

(Cont.

) SEE BILLING

INSTRUCTIONS

ON

REVERSE

17(i)

GRAND

TOTAL

7. TO:

SUPPLEMENTAL INVOICING INFORMATION

If desired, this order (or a copy thereof) may be used by the Contractor as the Contractor’s invoice, instead of a separate invoice, provided the following statement, (signed and dated) is on (or attached to) the order: “Payment is requested in the amount of $_____. No other invoice will be submitted.”

However, if the Contractor wishes to submit an invoice, the following information must be provided: contract number (if any), order number, item number(s), description of supplies or service, sizes, quantities, unit prices, and extended totals. Prepaid shipping costs will be indicated as a separate item on the invoice. Where shipping costs exceed $10 (except for parcel post), the billing must be supported by a bill of lading or receipt. When several orders are invoiced to an ordering activity during the same billing period, consolidated periodic billings are encouraged.

RECEIVING REPORT

Quantity in the “Quantity Accepted” column on the face of this order has been inspected, accepted, received by me and conforms to contract. Items listed below have been rejected for the reasons indicated.

SHIPMENT PARTIAL DATE RECEIVED SIGNATURE OF AUTHORIZED U.S. GOV’T REP. DATE

NUMBER FINAL

TOTAL CONTAINERS GROSS WEIGHT RECEIVED AT TITLE

REPORT OF REJECTIONS

ITEM NO. SUPPLIES OR SERVICES UNI

T

QUANTITY

REJECTED REASON FOR REJECTION

OPTIONAL FORM 347 (REV. 6/95) BACK

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

BASE YEAR:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 CTMS Base Year

This is a new procurement request. The purpose of this PR is to purchase a software as a service clinical trial management system (CTMS) to plan, manage, and track clinical trial documents throughout the lifespan of a TB clinical trial.

Period of Performance September 1, 2026 to August 31, 2027

12 Months

0002 System Configuration and

Implementation Provision of a 21 CFR Part 11 compliant, web-based CTMS application. Includes 20 CDC user accounts, 22 trial site accounts, and 50 eISF portal users.

Includes technical support and system maintenance.

Period of Performance September 1, 2026 to August 31, 2027

1 Job

0003 CDC Electronic Datat Capture(EDC) Technical integration and API establishment connecting the new CTMS with the existing CDC EDC system.

Period of Performance September 1, 2026 to August 31, 2027

1 Job

0004 Security Authorization and FedRAMP Security Autorization and FedRAMP Compliance Obtaining/maintaining FedRAMP Low-risk authorization, executing 3PAO security assessments, and continuous vulnerability monitoring.

Period of Performance September 1, 2026 to August 31, 2027

1 Job

0005 eTMF Document Storage(Optional)

Expanded document repository functionality for long-term clinical trial file management.

(Optional)

1 Gigabytes (GB)/Month

Period of Performance September 1, 2026 to August 31, 2027

12 Months

Option YEAR 1 1001 CTMS Software as a Service (SaaS)

CTMS Software as a Service (SaaS) Subscription Continued web-based application access, ongoing maintenance, and technical support for all user roles.

Period of Performance September 1, 2027 to August 31, 2028

1002 Annual FedRAMP and 3PAO Annual FedRAMP Continuous Monitoring and 3PAO Assessment Required annual third-party assessment (3PAO) and monthly vulnerability scanning to maintain agency ATO

Period of Performance September 1, 2027 to August 31, 2028

1 Years

1003 eTMF Document Storage(Optional) Option Year 1 extension of the expanded document repository.

1 Gigabytes (GB)/Month

Period of Performance September 1, 2027 to August 31, 2028

12 Months

Option YEAR 2 2001 CTMS Software as a Service (SaaS)

CTMS Software as a Service (SaaS) Subscription

Continued web-based application access, ongoing maintenance, and technical support for all user roles.

Period of Performance September 1, 2028 to August 31, 2029

2002 Annual FedRAMP and 3PAO

Annual FedRAMP Continuous Monitoring and 3PAO Assessment

Required annual third-party assessment (3PAO) and monthly vulnerability scanning to maintain agency ATO.

Period of Performance September 1, 2028 to August 31, 2029

1 Years

2003 IT Transition and Contract Closeout IT Transition and Contract Closeout Services

Secure offboarding of IT personnel, final code consolidation, data delivery to CDC, and system media sanitization per NIST

SP 800-88.

1 Job

2004 eTMF Document Storage (Optional) Electronic Master File (eTMF) Document Storage Option Year 2 extension of the expanded document repository.

1 Gigabytes (GB)/Month

Statement of Work

Clinical Trial Management System for TB Clinical Research

I. BACKGROUND

The TB Trials Consortium (TBTC) is based in the Clinical Research Branch (CRB) of CDC’s Division of Tuberculosis Elimination (DTBE). The CRB includes medical officers, epidemiologists, health scientists, clinical research specialists, laboratorians, data analysts, data managers, statisticians, and contract specialists. TBTC’s mission is to conduct programmatically relevant research concerning the diagnosis, clinical management, and prevention of tuberculosis infection and disease. Current funding has awarded contracts to a new group of TBTC trial sites for the next 10-year cycle, from December 2020 to December 2030. There are also trial sites funded via an interagency agreement with the Veteran’s Administration. Clinical trial documentation and tracking is required under Federal regulations (FDA 21 CFR part 11), which dictate how documents may be stored electronically and require specific capabilities of an electronic system. Up to this point, CRB has relied on paper documentation to serve as the original source, but this is time-consuming and challenging when performing site visits or remote monitoring of sites. A clinical trial management system (CTMS) is a project management system that is developed specifically to plan, manage, and track clinical trials throughout the lifespan of a clinical trial. These systems are already validated to demonstrate compliance with US federal regulations regarding electronic documentation of clinical trials (FDA 21 CFR part 11). As the sponsor of TB clinical trials through the TB Trials Consortium (TBTC), including 22 trial sites in eight countries, the use of a fit for purpose system to manage the requirements will alleviate staff strain and improve efficiency. This is especially relevant for compliance in monitoring activities, a regulatory requirement of clinical trials. With two active clinical trials and impending implementation of new components, management and tracking needs are crucial. CRB spends a substantial amount of person time on organizing and tracking documents, as well as manually recording findings during monitoring visits. A CTMS will streamline this work into a part-11 compliant system to store and track trial files, perform and track monitoring visits, and improve ability to track trends by site and by study. Streamlining and improving capability of these activities will allow the program to meet regulatory requirements, manage ongoing clinical trials more efficiently and effectively, and free up person time to spend on implementation of additional clinical trials.

II.PURPOSE

To purchase a software as a service clinical trial management system (CTMS) to plan, manage, and track clinical trial documents throughout the lifespan of a TB clinical trial.

III.SCOPE OF WORK

CRB has an immediate need for a CTMS to ensure the continuation of a 10-year cycle research portfolio. Clinical trial documentation and tracking is required under Federal regulations and is essential for performance of the TBTC trial sites. The vendor will provide all labor, materials, and equipment required to complete the tasks outlined below.

IV. TASKS TO BE PERFORMED

The vendor shall perform the following tasks to maintain and enhance a Software as a Service clinical trial management system:

A. Kick-off Meeting: Within 10 business days of the effective Base Period start date, the Contractor shall hold a virtual kick-off meeting to include the COR and CO to review the project goals and objectives and discuss the Contractor’s proposed plans, required contractor inputs, activities, timeframes, and staff that will participate in the project. If the product requires configuration to be performed by the vendor, provide timeframes for completion based on the CDC system requirements, and timeframe and process for change requests.

B. Provide a Clinical Trial Management System including the following: • A software as a service product that meets 21CFR part 11 requirements for an electronic system

• Role-based access for CDC users (up to 20 users)

• Document repository with audit history and versioning control, with notifications and alerts to users based on expiration dates or other parameters, that meets requirements of an eTMF

• Manages site and study startup tracking and management of progress

• Hosts a contact list that can set up mailing lists

• Ability to plan, track, and manage clinical trial monitoring

• Support and automate tracking and reporting processes across multiple clinical trials and study sites

• Interoperability with existing electronic data capture system

• Edit rights for program staff to make configurations internally without developer support

• Configurable and role-based views for dashboards

• Site or study startup tracking that is directly linked to eISF

• Apply metrics and indicators of various clinical trial processes, such as key risk indicators or site performance metrics

• Document management

• Ability to enter metadata for a document

• Function as an eISF for sites

• Track document versions, archive previous versions

• Track dates over the lifespan of a document (e.g., CDC approval dates, IRB approvals, etc.)

• Enable E-signatures

• Data entry tools

• Configurable fields and/or templates

• Calculatable fields

• Role-based access to non-CDC users

• 22 User Accounts, one per site for study documents

• 50 eISF Portal Users for Regulatory and Study Coordinators

C. The Contractor shall obtain and maintain a FedRAMP authorization at the Low-risk level for the entirety of the contract’s duration. This authorization must be achieved through agency sponsorship and must maintain agency Authority to Operate (ATO). The provider must ensure that the services are fully compliant with the security controls outlined in the FedRAMP baseline for the specified impact level. This shall include performance of scans for vulnerabilities, and the Contractor shall remediate all risks or vulnerabilities immediately after the risks or vulnerabilities have been identified. The Contractor shall ensure the software is fully functional, operates correctly on systems configured in accordance with government policy and federal configuration standards. The Contractor is required to implement a continuous monitoring program that meets or exceeds the requirements outlined in the FedRAMP continuous monitoring requirements. This includes, but is not limited to, monthly vulnerability scanning, regular updates to the security documentation, and prompt reporting of security incidents. A security control assessment must be conducted by a FedRAMP third-party assessment organization (3PAO) for the initial ATO and annually thereafter or whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan. No private or sensitive data shall be used during software configuration or testing.

D. Contractor shall provide all necessary licenses, materials, and software for CDC. The licenses shall include all necessary modules for web-based data entry, centralized hosting, and data visualization and reporting functionality. The CTMS shall be a web-based application compatible with various web browsers (e.g., Google Chrome, Microsoft Edge) and shall require no installation of software on CDC devices to be functional and secure.

E. The contractor shall integrate with and utilize the Centers for Disease Control and Prevention (CDC) Secure Access Management Services (SAMS) for all user authentications. This requirement applies to all individuals accessing the service, the contractor agrees to collaborate with the CDC's technical teams to ensure successful integration and ongoing compatibility with the SAMS platform.

Authentication shall be implemented using industry-standard protocols such as Security Assertion Markup Language (SAML) or OAuth to establish a secure and trusted identity federation.

F. The Contractor shall securely maintain, manage, and transmit data using a secure method of data transfer and storage consistent with CDC Information Technology Security protocols, such as full data encryption at rest and in transit, to be approved by the COR. The Contractor shall provide database version control and records retention. The Contractor shall ensure long-term maintenance of systems operations, including external interface management, data connections, data integrity validation, operation reporting, database administration, network monitoring, performance tuning, backup and disaster recovery, upgrades and maintenance, monitoring and performance. The Contractor shall ensure modifications are made as necessary. Assigning priority to maintenance tasks shall be done in consultation with the COR.

G. Provide on-going technical support, as needed, throughout the contract period.

H. Provide change requests as needed within the contract period.

I. OPTIONAL TASK: Provide document storage as Electronic Master File.

V. GOVERNMENT FURNISHED MATERIALS

N/A

VI. PERIOD OF PERFORMANCE

The period of performance shall commence upon award of a purchase order and continue for three years. Start date is September 1, 2026, to August 31, 2029.

VII. DELIVERABLES

The vendor shall provide the following deliverables to the Project Officer by the dates reflected below. Deliverables

Date Required

Provide users with at least one onboarding training, if configuration can be done by CDC staff

Within 15 days of contract start date

If the product must be configured by the vendor for use, then review and provide feedback on CDC requirements, and finalize requirements for configuration

Within 15 days of contract start date

Clinical Trial Management System with minimum initial functions

• Role-based access for CDC users (up to 20 users)

• Document repository with audit history and versioning control, with notifications and alerts to users based on expiration dates or other parameters, that meets requirements of an eTMF

• Manage site and study startup tracking and management of progress

• Host a contact list, set up mailing lists from it – optional task

• Ability to plan, track, and manage clinical trial monitoring

• Support and automate tracking and reporting processes across multiple clinical trials and study sites

• Interoperability with the existing electronic data capture system

Within 30 days of contract start date

Provide users with at least one onboarding Within 30 days of contract start date training, if configuration must be done by vendor

If configuration must be done by the vendor, complete the configuration for user acceptance testing

Within 35 days of contract start date

Complete the configuration following UAT feedback

Within 45 days of contract start date

Complete the integration of the CTMS with the CDC EDC

Within 50 days of contract start date

Initiate FedRAMP authorization of the software-as-a-service, if not already FedRAMP authorized.

Within 1 day of contract start date

Respond to technical issues Within same business day of notification

Section I - Contract Clauses

Section I-1 - Clauses Incorporated By Reference

FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates all clauses by reference as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The full text of a clause may be accessed electronically at this address:

https://www.acquisition.gov/ Part 52 - Solicitation Provisions and Contract Clauses | Acquisition.GOV

HHSAR | Acquisition.GOV

FAR SOURCE TITLE AND DATE

52.204-7 System for Award Management (Aug 2025) ( Deviation) 52.204-13 System for Award Management Maintenance (Apr 2026) (Deviation) 52.204-91 Contractor Identification Code (Apr 2026) (Deviation) 52.212-1 Instructions to Offerors-Commercial Products and Commercial Services (Apr 2026) (Deviation) 52.212-2 Evaluation-Commercial Products and Commercial Services (Apr 2026) (Deviation) 52.212-4 Contract Terms and Conditions- Commercial Items (Apr 2026) (Deviation) 52.222-36 Equal Opportunity for Workers with Disabilities (Apr 2026) (Deviation) 52.222-50 Combating Trafficking in Persons (Apr 2026) (Deviation) 52.222-90 Addressing DEI Discrimination by Federal Contractors (April 2026)(Deviation)

(End of Clause)

Clauses Incorporated by Full Text

52.217-8 Option to Extend Services (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within _30 days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.(Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within __1 Day;

provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least _30____ days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed ___________ (months) (years).

(End of clause)

HHSAR 352.232-71 Electronic Submission of Payment Requests (Feb 2022) Electronic Submission of Payment Requests

(a)Definitions. As used in this clause -

Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

https://www.acquisition.gov/ https://www.acquisition.gov/far-overhaul https://www.acquisition.gov/hhsar

(b)Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c)The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d)If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

(End of Clause)

HHSAR 352.239-79 INFORMATION AND COMMUNICATION TECHNOLOGY ACCESSIBILITY (FEB

2024) (DEVIATION)

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all information and communication technology (ICT) supplies, products, platforms, information, documentation, and services support developed, acquired, maintained or delivered under this contract or order must comply with the Revised 508 Standards, which are located at 36 C.F.R. 1194.1 and Appendices A, B, and C, and are available at https://www.access-board.gov/ict/ Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html

(b) Additional Section 508 accessibility standards applicable to this contract or order may be identified in the specification, statement of work, or performance work statement. If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract or order, which adds new ICT supplies or services or revises the type of, or specifications for, supplies, products, platforms, information, documentation, or services support, the Contracting Officer shall require that the Contractor submit a completed HHS Section 508 Accessibility Conformance Checklist (see http://www.hhs.gov/web/section-508/accessibility-checklist/index.html ) or an Accessibility conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat ), and any other additional information necessary to assist the Government in determining that the ICT supplies or services conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(d) If this is an Indefinite-Delivery type contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include ICT supplies, products, platforms, information, documentation, or services support will define the specifications and accessibility standards for the order. In those cases, the Contractor shall be required to provide a completed HHS Section 508 Accessibility Conformance Checklist (see http://www.hhs.gov/web/section-508/accessibility-checklist/index.html ) or an ACR (based on VPAT see https://www.itic.org/policy/accessibility/vpat ), and any other additional information necessary to assist the Government in determining that the ICT supplies, products, platforms, information, documentation, or services support conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) The contractor shall identify to the Contracting Officer any perceived exception or exemption to Section 508 requirements.

(End of clause)

In addition to the contract clauses, the following clauses are incorporated:

CDC0_G008 Contracting Officer’s Representative (COR) (Jul 2017) Performance of the work hereunder shall be subject to the technical directions of the designated COR There are no clauses/provisions included in this section for this contract.

As used herein, technical directions are directions to the Contractor which fill in details, suggests possible lines of inquiry, or otherwise completes the general scope of work set forth herein. These technical directions must be within the general scope of work and may not alter the scope of work or cause changes of such a nature as to justify an adjustment in the stated contract price/cost, or any stated limitation thereof.

In the event that the Contractor believes full implementation of any of these directions may exceed the scope of the contract, he or she shall notify the originator of the technical direction and the Contracting Officer, immediately or as soon as possible, in a letter or e-mail separate of any required report(s). No technical direction, nor its fulfillment, shall alter or abrogate the rights and obligations fixed in this contract.

The Government COR is not authorized to change any of the terms and conditions of this contract. Contract changes shall be made only by the Contracting Officer by properly written modification(s) to the contract.

The Government will provide the Contractor with a copy of the COR delegation memorandum upon request.

CDC42.0002 Evaluation of Contractor Performance Utilizing CPARS (Aug 2021) In accordance with FAR 42.15, the Centers for Disease Control and Prevention (CDC) will review and evaluate contract performance. FAR 42.1502 and 42.1503 require agencies to prepare evaluations of contractor performance and submit them to the Contractor Performance Assessment Reporting System (CPARS). The CDC utilizes this web-based system to prepare and report contractor performance evaluations. All information contained in these assessments may be used by the Government, within the limitations of FAR 42.15, for future source selections in accordance with FAR 15.304 where past performance is an evaluation factor.

The CPARS system requires a contractor representative to be assigned so that the contractor has appropriate input into the performance evaluation process. The CPARS contractor representative will be given access to CPARS and will be given the opportunity to concur or not-concur with performance evaluations before the evaluations are complete. The CPARS contractor representative will also have the opportunity to add comments to performance evaluations.

The assessment is not subject to the Disputes clause of the contract, nor is it subject to appeal beyond the review and comment procedures described in the guides on the CPARS website. Refer to: www.cpars.gov for details and additional information related to CPARS, CPARS user access, how contract performance assessments are conducted, and how Contractors participate. Access and training for all persons responsible for the preparation and review of performance assessments is also available at the CPARS website.

The contractor must provide the CDC contracting office with the name, e-mail address, and phone number of their designated CPARS representative who will be responsible for logging into CPARS and reviewing and commenting on performance evaluations. The contractor must maintain a current representative to serve as the contractor representative in CPARS. It is the contractor’s responsibility to notify the CDC contracting office, in writing (letter or email), when their CPARS representative information needs to be changed or updated. Failure to maintain current CPARS contractor representative information will result in the loss of an opportunity to review and comment on performance evaluations.

CDC37.0001 Non-Personal Services (Jun 2020)

(a) Personal services shall not be performed under this contract. Although the Government may provide sporadic or occasional instructions within the scope of the contract, the Contractor is responsible for control and supervision of its employees. If the Contractor (including its employees) believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

(b) The contractor shall comply with, and ensure their employees and subcontractors comply with, CDC Policy titled "Contractor Identification and Safeguarding of Non-Public Information". No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work. The contractor is limited to performing the services identified in the contract statement of work and shall not interpret any communication with anyone as a permissible change in contract scope or as authorization to perform work not described in the contract. All contract changes will be incorporated by a modification signed by the Contracting Officer.

(c) The Contractor shall ensure that all of its employees and subcontractor employees working on this contract are informed of the terms and conditions herein. The Contractor agrees that this is a non-personal services contract; and that for all the purposes of the contract, the Contractor is not, nor shall it hold itself out to be an agent or partner of, or joint venture with, the Government. The Contractor shall notify its employees that they shall neither supervise nor accept supervision from Government employees. The substance of the terms herein shall be included in all subcontracts at any tier.

(d) The terms and conditions above do not limit the Government's rights under other terms of the contract, including those related to the Government's right to inspect and accept or reject the services performed under this contract.

CDC0_G018 Payment by Electronic Funds Transfer (Feb 2018)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer –System for Award Management, in Section I, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In the case that EFT information is not within the System of Award Management, FAR 52.232-34 requires mandatory submission of Contractor’s EFT information directly to the office designated in this contract to receive that information (hereafter: “designated office”); see below. The contractor shall submit the EFT information within the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting Officer or the CDC Office of Financial Resources at 678-475-4510.

(c) In cases where the contractor has previously provided such information, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention Office of Financial Resources (OFR) P.O. Box 15580 Atlanta, GA 30333 Or – Fax copy to: 404-638-5342

CDCA_H042 Records Management Obligations (Jun 2020)

A. Applicability The following applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes Centers for Disease Control and Prevention (CDC) records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their CDC contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2.In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisionsof44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA)(5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C.

552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3.In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4.CDC and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of CDC or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the Contracting Officer and the Contracting Officer’s Representative. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5.The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to CDC control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6.The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and CDC guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7.The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with CDC policy.

8.The Contractor shall not create or maintain any records containing any non-public CDC information that are not specifically tied to or authorized by the contract.

9.The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10.Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take CDC-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flow down of requirements to subcontractors

1.The Contractor shall incorporate the entire substance of the terms and conditions herein, including this paragraph, in all subcontracts under this contract, and must require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth herein will be attributed to the Contractor.

1.0 INSTRUCTIONS TO OFFERORS (QUOTING PROCEDURES)

FAR 52.212-1 Instructions to Offerors-Commercial Products and Commercial Services (Apr 2026) (Deviation) (Addendum)

To be considered for award, the vendor must submit a quotation split into three distinct volumes

• Volume I: Technical Approach & Software Capabilities (Page Limit 15 Pages)

This volume must not contain any reference to pricing or software licensing costs.

o Demonstrate compliance with FDA 21 CFR Part 11.

o Provide a system-architecture diagram illustrating integration with the CDC SAMS and EDC systems.

o Outline a draft configuration and onboarding plan to be executed within 15–50 days of award.

o If pricing is entered in the techical proposal the submittal will nto be evaluated

• Volume II: Past Performance (5 Pages) o Offerors must submit exactly three (3) past performance references for contracts performed within the last three (3) years that are similar in size, scope, and technical complexity to this CTMS requirement.

Each reference must include:

o Agency/Client Name o Contract Number and Order Number (if applicable) o Total Contract Dollar Value o Period of Performance o Points of Contact (Name, Title, Email, Phone Number) o A concise description of the technical work performed, specifically highlighting experience with clinical trial management software, FedRAMP maintenance, and agency offboarding protocols.

• Volume III: Price Proposal (No Limit) o Completed Pricing sheet provided in the RFQ package (Attachment 2) you may also submit your own pricing sheet. Static values without formulas will be rejected.

o Labor Category Rates o Separate costs by software subscription licenses and Labor rates.

o Letter of Supply: offerors using a reseller or value-added reseller pathway must submit the providers’ letter of supply on the Original Software Manufacturer’s official letterhead.

Marano-Lee, Mariette R. (CDC/NCHHSTP/DHP) Does this apply to open solicitation? Also, is this a provider letter? This may be a miss-spelling

2.0 EVALUATION FACTORS FOR AWARD

(FAR 52.212-2 Evaluation-Commercial Products and Commercial Services (Apr 2026) (Deviation)

(ADDENDUM)

The government intends to award a Firm-Fixed-Price (FFP) contract to the responsible offeror whose quote represents the Best Value utilizing a trade-off process based on the following weighted criteria:

1. Technical Approach and Platform Functionality: Superiority of the platform’s out-of-the-box features and configuration flexibility.

2. Information Security and Compliance Capability: Demonstrated path or baseline verification of FedRAMP Low status and FIPS 140-2 encryption compatibility.

3. Past Performance: Quality and relevance of similar clinical trial software implementations.

4. Price: Evaluated for completeness, balance, and price reasonableness

Technical Approach Rating Scale

Sub-factor 1.2 (System Architecture & Integration) and Sub-factor 1.3 (Implementation Timeline).

• Outstanding o Definition: Proposal meets all requirements and demonstrates an exceptional understanding of CDC clinical trial workflows.

o Strengths: Contains multiple significant strengths that directly benefit the agency (e.g., pre-built, production-ready CDC EDC API connectors) and evidence of successful contract performance.

o Weaknesses: Zero weaknesses or deficiencies present.

o Risk: Risk of unsuccessful contract performance is extremely low.

• Good o Definition: Proposal meets all requirements and demonstrates a thorough understanding of system configuration and FedRAMP maintenance.

o Strengths: Contains at least one or more strengths with no significant weaknesses.

o Weaknesses: Minor, easily correctable weaknesses only.

o Risk: Risk of unsuccessful contract performance is low.

• Acceptable o Definition: Proposal meets the minimum baseline requirements of the SOW.

o Strengths: Demonstrates adequate capability to execute the contract but offers few or no additional strengths.

o Weaknesses: May contain some weaknesses, but none that heavily impact overall core mission performance.

o Risk: Risk of unsuccessful contract performance is moderate but manageable.

• Unacceptable o Definition: Proposal fails to meet one or more critical requirements specified in the

SOW.

o Strengths: Missing or completely offset by severe technical deficiencies.

o Weaknesses: Contains significant weaknesses, deficiencies, or omissions (e.g., failure to address 21 CFR Part 11 compliance or data sanitization protocols).

o Risk: Risk of performance failure is unacceptably high. Proposal is un-awardable.

Past Performance Confidence Rating Scale

• Substantial Confidence o Definition: The contractor's recent and relevant past performance is highly similar in scope, size, and complexity.

o Context: Vendor has documented success managing identical FedRAMP architectures or active clinical trial systems for federal health agencies (CDC, FDA, NIH).

o Expectation: High expectation that the offeror will successfully perform the required effort.

• Satisfactory Confidence o Definition: The contractor's past performance is relevant in scope and complexity.

o Context: References show successful performance on general cloud data integrations or software hosting, with positive past performance evaluations (CPARs).

o Expectation: Reasonable expectation that the offeror will successfully perform the required effort.

• Limited Confidence o Definition: The contractor's past performance is only marginally relevant or contains documented performance issues.

o Context: References show history of delivery delays, cost overruns, or recurring minor SLA breaches without aggressive corrective action.

o Expectation: Low expectation that the offeror will successfully perform without heavy government oversight.

• No Confidence o Definition: The contractor's past performance history contains severe, systemic performance issues.

o Context: Documented cure notices, terminated contracts for cause, or critical security baseline failures.

o Expectation: No expectation that the offeror can successfully perform the contract.

• Neutral Confidence o Definition: The offeror lacks a record of relevant past performance, or past performance information is not available.

o Context: A newer small business entity or a company entering the federal clinical trials space for the first time.

o Evaluation: The offeror will not be evaluated favorably or unfavorably on past performance and will receive an "Acceptable" baseline score.

3.0 BASIS FOR FINAL AWARD

The government reserves the right to award the contract to a business with a higher-rated technical approach or superior past performance history, provided their overall proposed price is determined to be fair, reasonable, and realistic.

ATTACHMENTS

• This RFQ contains 6 attachments; review and complete the following attachments as applicable:

o Attachment 1 SOW Crosswalk o Attachment 2 Pricing Schedule: You may use your own pricing matrix.

o Attachment 3 Letter of Supply for software support if applicable o Attachment 4 CTMS Questions o Attachment 5 Artificial Intelligence (AI) if applicable

Attachment 6 VPAT ( if applicable)o