Sol_Doc_1223623.pdf

FDA-RFP-1223623

Document Type Request for Proposal Solicitation Number FDA-RFP-1223623 Subject Support for the Establishment and Operation of a Center of

Excellence for Engagement with Compounding Outsourcing Facilities

Post Date July 21, 2020 Questions Due July 29, 2020 at 14:00 Eastern Proposal Due August 21, 2020 at 14:00 Eastern Product Service Code R408 - Support—Professional: Program Management

Support NAICS Code 325412 (Pharmaceutical Preparation Manufacturing)

PART I

SECTION A

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This solicitation is a Request for Proposals (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-05. The applicable North American Industry Classification System (NAICS) code assigned to this procurement is 325412 (Pharmaceutical Preparation Manufacturing).

This requirement is for full and open competition. All responsible offerors are permitted to submit a proposal as a result of this combined synopsis/solicitation.

SECTION B - SUPPLIES OR SERVICES AND PRICES

B.1 SOLICITATION DESCRIPTION

The Contractor shall furnish all necessary facilities, materials, and personnel, and shall perform all non-personal services and program support necessary in a requirement titled, “Support for the Establishment and Operation of a Center of Excellence for Engagement with Compounding Outsourcing Facilities.”

B.2 CONTRACT TYPE

The Government anticipates the award of a Time and Materials (T&M) contract to a single contractor as a result of this solicitation.

B.3 LABOR CATEGORIES, ANTICIPATED LEVEL OF EFFORT AND PROPOSED

LABOR RATES

The Labor Categories anticipated to be required for successful performance of this effort are shown below. Offerors shall propose equal or similar Labor Categories and estimated annual hours per labor category shown below are for budgeting purposes only. The number of hours actually used for each category may exceed or be less than the estimate by category as long as the ceiling price for the CLIN to be determined at time of award is not exceeded. The ceiling amount for each CLIN will be identified in any resulting contract. Offerors shall insert their proposed fully burdened rates in the table below and submit this in their Volume II Price proposal.

Offerors’ fully burdened rates shall be all inclusive of direct labor, fringe benefits, applicable indirect costs, and any profit for each labor category. Offerors are advised that it may be necessary to add or change labor categories during performance of this contract in order to carry out the services described in the Statement of Work. If new labor categories are added, or existing labor categories revised, the parties will negotiate the labor category(ies) prior to the incorporation into the contract. Any new labor rate proposed will be evaluated for reasonableness in accordance with FAR 15.4.

Labor Categories/Rates

BASE YEAR LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 615 $ $ Compounding SME 483 $ $ Training Lead 4747 $ $ Communications/Outreach Support 5079 $ $ Communications/Outreach/Logistic Support 3787

Training Design/Developer 8316 $ $ Base Year Total Labor $

OPTION YEAR 1 LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 615 $ $ Compounding SME 483 $ $ Training Lead 4747 $ $ Communications/Outreach Support 5079 $ $ Communications/Outreach/Logistic Support 3787

Training Design/Developer 8316 $ $ Option Year 1 Total Labor $

OPTION YEAR 2 LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 615 $ $ Compounding SME 483 $ $ Training Lead 4747 $ $ Communications/Outreach Support 5079 $ $ Communications/Outreach/Logistic 3787 $ $

Support Training Design/Developer 8316 $ $

Option Year 2 Total Labor $

OPTION YEAR 3 LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 615 $ $ Compounding SME 483 $ $ Training Lead 4747 $ $ Communications/Outreach Support 5079 $ $ Communications/Outreach/Logistic Support 3787

Training Design/Developer 8316 $ $ Option Year 3 Total Labor $

OPTION YEAR 4 LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 615 $ $ Compounding SME 483 $ $ Training Lead 4747 $ $ Communications/Outreach Support 5079 $ $ Communications/Outreach/Logistic Support 3787

Training Design/Developer 8316 $ $ Option Year 4 Total Labor $

SIX (6) MONTH EXTENSION (FAR 52.217-8) LABOR

Labor Category Estimated

Annual Hours Hourly Rate Total

Project Manager 308 $ $ Compounding SME 242 $ $ Training Lead 2374 $ $ Communications/Outreach Support 2540 $ $ Communications/Outreach/Logistic Support 1894

Training Design/Developer 4158 $ $ Six (6) Month Option Total Labor $

Total Contract Amount Labor $

B.3 CONTRACT LINE ITEMS

The table below outlines the contract line item structure for the total period of performance. The Contractor shall provide services in accordance with the Statement of Work (Attachment 1), in compliance with all other sections of this solicitation on a Time and Materials (T&M) basis inclusive of all labor, materials, overhead, profit, fee, general and administrative costs, travel, etc.

Line Item

Description Total

0001 Base Year – [Time and Materials] Support for the establishment and operation of a Center of Excellence for engagement with Compounding Outsourcing Facilities in accordance with the Statement of Work (SoW)

1001 Option Year 1 – [Time and Materials] Support for the establishment and

2001 Option Year 2 – [Time and Materials] Support for the establishment and

3001 Option Year 3 – [Time and Materials] Support for the establishment and

4001 Option Year 4 – [Time and Materials] Support for the establishment and

Outsourcing Facilities in accordance with the Statement of Work (Sow)

5001 Optional Six (6) Month Extension (In Accordance with FAR 52.217-8) – [Time and Materials] Support for the establishment and operation of a Center of Excellence for engagement with Compounding Outsourcing Facilities in accordance with the Statement of Work (Sow)

Total

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT*

*See Attachment 1 to this solicitation

SECTION D - PACKAGING AND MARKING

All deliverables required under this contract shall be packaged, marked and shipped/submitted in accordance with the Government specifications below. At a minimum, all deliverables shall be marked with the contract number and contractor name.

1. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

2. The Contractor shall scan all deliverables for viruses before submitting to the FDA.

3. Deliverables under this contract shall be prepared and packaged for shipment using standard shipping practices to ensure safe and timely delivery.

Electronic delivery is the preferred method of delivery and all deliverables shall assume to be submitted electronically, unless otherwise specified by the COR.

SECTION E - INSPECTION AND ACCEPTANCE

The FDA COR will inspect and make acceptance decisions for all materials, documents, and services provided under this contract. The FDA COR is the authorized representative of the Contracting Officer.

Review of Deliverables ---

(a) The COR will provide written acceptance, comments and/or change requests, if any, within thirty (30) business days from receipt by the Government of the initial deliverable.

(b) Upon receipt of the Government comments, the Contractor shall have fifteen (15) business days to incorporate the Government's comments and/or change requests and to resubmit the deliverable in its final form.

(c) If written acceptance, comments and/or change requests are not issued by the Government within thirty (30) calendar days of submission, the draft deliverable shall be deemed acceptable as written and the Contractor may proceed with the submission of the final deliverable product. The Contractor shall provide all deliverables to the COR in Microsoft Excel, PowerPoint or Word format.

Deliverables Chart*

Deliverable Due Date General Administration

1. Project Kick-off Meeting Within 5 business days after the contract period of performance starts

2. Government Furnished Inventory Issued after award; returned prior to end of performance

3. Meeting Agendas 2 business days prior to meetings

4. Meeting Minutes 2 business days after meetings

5. Project Closeout Meeting Within 5 business days before the contract period of performance ends

Task 1: Project Management Support, Planning & Outreach

6. Draft Project Management Plan Within 15 business days after the contract period of performance starts

7. Final Project Management Plan Within 5 business days after COR review

8. Biweekly Status Reports Beginning 15 business days after the contract period of performance starts

9. Weekly Status Meetings (when required by

FDA)

Beginning 15 business days after the contract period of performance starts

Task 2: Practical In-Person Trainings

10. Host four (4) separate sterile processing or environmental control or related topic training sessions

Staggered throughout the contract period of performance

11. Administer and produce an evaluation report after each session

15 business days after the end of each session

12. Host two (2) separate investigations and CAPA training sessions

Staggered throughout the contract period of performance

13. Administer and produce an evaluation report after each session

15 business days after the end of each session

Task 3: Annual Outsourcing Facilities Conference

14. Conference invitations sent Six months prior to conference

15. Final agenda and confirmed speakers Two months prior to conference

16. Hold end-of-year conference By end of the contract period of performance period

17. Consolidate feedback from attendees 3 days after end of conference

Task 4: Web-Based Training

18. Develop three (3) web-based courses related to drug compounding - topics TBD by FDA

Staggered throughout contract period of performance

Task 5: Evaluation and Assessment

19. Develop assessment questions for evaluations 15 business days prior to the start of the training session

20. Create a final report to include: training metrics, summary of accomplishments, and other quantified and qualified details for senior leadership and congressional reporting.

15 days prior to end of the contract period of performance

Task 6: Continuation of Training Roadmap

21. Develop roadmap for future trainings 1 month before end of the contract period of performance Task 7: Follow-on Environmental Scan and Analysis

22. Develop a research plan for the Environmental Scan that includes:

• Final set of research questions

• Plan for analysis of available data sources

• Plan and methodology for obtaining new data through use of interviews, focus groups and surveys.

• Draft survey instrument(s) ready for OMB review and clearance

45 days after the contract period of performance starts

23. Analyze outsourcing facility market using available data sources and develop a report of findings.

Draft: 4 months after the contract period of performance starts.

Final: 5 months after the contract period of performance starts

24. Conduct Interviews, Focus Groups, and Surveys based on questions developed in research plan.

9 months after the contract period of performance starts

25. Presentation and written summary of results and key findings from interviews, focus group discussions, and surveys

10 months after award.

26. Develop a report that: synthesizes and summarizes all research for the Environmental Scan including data analysis, surveys, focus groups, and interviews; highlights any significant barriers or other issues identified as a result of the research; makes recommendations for addressing the issues; and identifies potential program areas for the CoE.

Draft: 45 days before contract period of performance ends Final: 15 days before contract period of performance ends

Task 8: Advancement of the Center of Excellence

27. Develop a Charter for the Compounding

Quality Center of Excellence 6 months after contract period of performance starts

28. Develop a three-year strategic plan for the Compounding Quality Center of Excellence.

1 month before end of the contract period of performance

*Additional reporting may be required.

Unless otherwise specified, all deliverables shall be delivered to:

To be provided at the time of award

SECTION F - DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

The Period of Performance shall consist of a 12-month Base Year, four (4) 12-month Option Years and an optional six (6) month extension in accordance with FAR 52.217-8. The Period of Performance shall not exceed 66 months, if all Options are exercised.

F.3 PLACE OF PERFORMANCE

The contractor’s primary work location will be at the contractor’s place of business.

• Travel may be required for certain training sessions as described in the Statement of Work.

Work locations may fluctuate as required.

• Travel expenses incurred by the contractor will be paid in accordance with the Federal Joint Travel Regulations (JTR).

mailto:%20%20To

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 CONTRACTING OFFICERS REPRESENTATIVE (COR)

The following COR will represent the Government for the purpose of this contract:

To be provided at the time of award

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

G.2 CONTRACTING OFFICER (CO)

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in an order; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

The contact information for the Contracting Officer is:

Richard (Rob) Robinson Email: Richard.Robinson@fda.hhs.gov Tel: (301) 796-6508

The contact information for the Contract Specialist is:

Benjamin Golway Email: Benjamin.Golway@fda.hhs.gov Tel: (301) 837-7464

G.3 INVOICE SUBMISSION

A. The contractor shall submit all invoices to:

U.S. FOOD AND DRUG ADMINISTRATION

Attn: Vendor Payments Division of Payment Services 10903 New Hampshire Ave WO32 - Second Floor

MAIL HUB 2145

Silver Spring, MD 20993-0002 mailto:%20%20To mailto:Richard.Robinson@fda.hhs.gov mailto:Benjamin.Golway@fda.hhs.gov

301-827-3742 FDAVendorPaymentsTeam@fda.hhs.gov

*** Acceptable methods of delivery include: E-mail (preferred) and Standard Mail. Provide a copy marked courtesy to the COR or Technical Point of Contact (TPOC). The COR/TPOC is:

To be provided at the time of award

B. Invoices submitted under this contract must comply with the requirements set forth in FAR Clauses 52.232-25 (Prompt Payment) and 52.232-33 (Payment by Electronic Funds Transfer

- System for Award Management) and/or other applicable FAR clauses specified herein. To constitute a proper invoice, the invoice must be submitted on company letterhead and include each of the following:

(i) Name and address of the contractor;

(ii) Invoice date and invoice number;

(iii) Contract/Order number (including a reference to any base award for Indefinite- Delivery/Indefinite-Quantity Contracts or Blanket Purchase Agreements);

(iv) Description, quantity, unit of measure, unit price, and extended price supplies delivered, or services performed, including:

(a) period of performance for which costs are claimed;

(b) itemized travel costs, including origin and destination;

(c) any other supporting information necessary to clarify questionable expenditures;

(d) the contractor shall include the award item number for each description, quantity, unit of measure, unit price, and extended price supplies delivered, or services performed;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on government bill of lading;

(vi) Terms of any discount for prompt payment offered (Prompt Payment terms other than NET 30);

(vii) Name and address of official to whom payment is to be sent (must be the same as that in the purchase order/award, or in a proper notice of assignment);

(viii) Name, title, and phone number of persons to notify in event of defective invoice;

(ix) Taxpayer Identification Number (TIN);

(x) banking routing transit number of the financial institution receiving payment for Electronic funds transfer (EFT);

mailto:FDAVendorPaymentsTeam@fda.hhs.gov mailto:%20%20To

(xi) Name and telephone number of the FDA Contracting Officer Representative (COR) or other Program Center/Office point of contact, as referenced on the award;

(xii) For all Inspections, Time-and-Materials and Labor-Hour Awards, Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance;

(xiii) Any other information or documentation required by the award.

C. An electronic invoice is acceptable if submitted in Adobe Acrobat (PDF) format. All items listed in (i) through (xiii) of this clause must be included in the electronic invoice. Electronic invoices must be on company letterhead and must contain no ink changes and be legible for printing.

D. Questions regarding invoice payments should be directed to the Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742);

or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

SECTION H. – SPECIAL CONTRACT REQUIREMENTS

H.1 CONTRACTOR PERFORMANCE EVALUATION(S)

In accordance with Federal Acquisition Regulation (FAR) 42.15, FDA will complete annual and final contractor performance evaluations. Annual evaluations will be prepared to coincide with the anniversary date of the contract. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary. Final performance evaluations will be completed upon contract expiration.

FDA will utilize the Contractor Performance Assessment Reporting System (CPARS) in order to execute annual and final contractor performance evaluations. CPARS is a secure Internet website located at http://www.cpars.csd.disa.mil/cparsmain.htm. FDA will register the contractor in CPARS upon receipt of the name and email address of two (2) individuals who will be responsible for serving as the Contractor’s primary and alternate CPARS contacts. Once FDA registers the contractor in CPARS, the Contractor will receive an automated CPARS email message which contains User IDs and instructions for creating a password.

http://www.cpars.csd.disa.mil/cparsmain.htm

Once a performance evaluation is issued, the Contractor’s primary and alternate CPARS contact will receive an email instructing them to logon to CPARS in order to review the performance evaluation. The Contractor has 14 days from the date of performance evaluation issuance in which to review the evaluation. If the Contractor is in agreement with the performance evaluation outcome, the evaluation becomes final. Should the Contractor be in disagreement with the performance evaluation outcome, rebuttal comments must be submitted via the CPARS within 14 days from date the evaluation was issued by FDA. Any disagreement between the Contracting Officer and the Contractor will be referred to a contracting official one level above the Contracting Officer, whose decision will be final.

Copies of each performance evaluation and contractor responses, if any, will be retained as part of the official contract file and will be used to support future award decisions. Evaluations will also be stored for a 3-year period in the Past Performance Information Retrieval System (PPIRS) at www.ppirs.gov.

Contractors may obtain CPARS training material and register for on-line training at http://www.cpars.gov/allapps/cpcbtdlf.htm. There is no fee for registration or use of the CPARS.

H.2 OFFICE OF MANAGEMENT AND BUDGET (OMB) REVIEW

a) Some of this research may require approval from the Office of Management and Budget (OMB), consistent with the Paperwork Reduction Act and HHSAR clause 352.211-3 Paperwork Reduction Act (Dec 2015). If required, approval will be needed prior to large-scale data collection. In collaboration with the FDA, the Contractor shall develop the supporting statements that comprise the ICR for submission to OMB.

b) Some of this research may be exempt from OMB review, per the Paperwork Reduction Act 44 U.S.C. 35 § 3518:

§ 3518. Effect on existing laws and regulations

(a) Except as otherwise provided in this chapter, the authority of an agency under any other law to prescribe policies, rules, regulations, and procedures for Federal information resources management activities is subject to the authority of the Director under this chapter.

(b) Nothing in this chapter shall be deemed to affect or reduce the authority of the Secretary of Commerce or the Director of the Office of Management and Budget pursuant to Reorganization Plan No. 1 of 1977 (as amended) and Executive order, relating to telecommunications and information policy, procurement and management of telecommunications and information systems, spectrum use, and related matters.

(c)(1) Except as provided in paragraph (2), this chapter shall not apply to the collection of information—

(A) during the conduct of a Federal criminal investigation or prosecution, or during the disposition of a particular criminal matter;

http://www.ppirs.gov/ http://www.cpars.gov/allapps/cpcbtdlf.htm

(B) during the conduct of—

(i) a civil action to which the United States or any official or agency thereof is a party; or

(ii) an administrative action or investigation involving an agency against specific individuals or entities;

(C) by compulsory process pursuant to the Antitrust Civil Process Act and section 13 of the Federal Trade Commission Improvements Act of 1980; or

(D) during the conduct of intelligence activities as defined in section 3.4(e) of Executive Order No. 12333, issued December 4, 1981, or successor orders, or during the conduct of cryptologic activities that are communications security activities.

(2) This chapter applies to the collection of information during the conduct of general investigations (other than information collected in an antitrust investigation to the extent provided in subparagraph (C) of paragraph (1)) undertaken with reference to a category of individuals or entities such as a class of licensees or an entire industry.

(d) Nothing in this chapter shall be interpreted as increasing or decreasing the authority conferred by Public Law 89–306 on the Administrator of the General Services Administration, the Secretary of Commerce, or the Director of the Office of Management and Budget.

(e) Nothing in this chapter shall be interpreted as increasing or decreasing the authority of the President, the Office of Management and Budget or the Director thereof, under the laws of the United States, with respect to the substantive policies and programs of departments, agencies and offices, including the substantive authority of any Federal agency to enforce the civil rights laws.

H.3 CONFLICT OF INTEREST

As a regulatory agency charged with protection of public health, the Food and Drug Administration (FDA) must maintain public confidence in the integrity of its decisions. The FDA has policies and procedures that safeguard against actual and apparent conflict of interest on the part of its employees. In contracting for review and evaluation of scientific data and information submitted to the agency, it is critical that the FDA be assured that there is no actual or apparent conflict of interest on the part of the individual contractor. Offers performing work under this contract must assure the protection of information and data they receive under this contract from unauthorized use or disclosure and must avoid actions that would cause a reasonable person to question the impartiality of the contractor.

(a)Purpose. The purpose of this clause is to ensure that the contractor and its subcontractors:

(1) Are not biased because of their financial, contractual, organizational, or other interests which relate to the work under this contract, and

(2) Do not obtain any unfair competitive advantage over other parties by virtue of their performance of this contract.

(b)Scope. The restrictions described herein shall apply to performance or participation by the contractor, its parents, affiliates, divisions and subsidiaries, and successors in interest (hereinafter collectively referred to as “contractor”) in the activities covered by this clause as a prime contractor, subcontractor, co-sponsor, joint venturer, consultant, or in any similar capacity. For the purpose of this clause, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both.

(c)Warrant and Disclosure. The warrant and disclosure requirements of this paragraph apply with full force to both the contractor and all subcontractors. The contractor warrants that, to the best of the contractor's knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, and that the contractor has disclosed all relevant information regarding any actual or potential conflict. The contractor agrees it shall make an immediate and full disclosure, in writing, to the Contracting Officer of any potential or actual organizational conflict of interest or the existence of any facts that may cause a reasonably prudent person to question the contractor's impartiality because of the appearance or existence of bias or an unfair competitive advantage. Such disclosure shall include a description of the actions the contractor has taken or proposes to take in order to avoid, neutralize, or mitigate any resulting conflict of interest.

(d)Remedies. The Contracting Officer may terminate this contract for convenience, in whole or in part, if the Contracting Officer deems such termination necessary to avoid, neutralize or mitigate an actual or apparent organizational conflict of interest. If the contractor fails to disclose facts pertaining to the existence of a potential or actual organizational conflict of interest or misrepresents relevant information to the Contracting Officer, the Government may terminate the contract for default, suspend or debar the contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(e)Subcontracts. The contractor shall include a clause substantially similar to this clause, including paragraphs (f) and (g), in any subcontract or consultant agreement at any tier expected to exceed the simplified acquisition threshold. The terms “contract,” “contractor,” and “Contracting Officer” shall be appropriately modified to preserve the Government's rights.

(f)Prime Contractor Responsibilities. The contractor shall obtain from its subcontractors or consultants the disclosure required in FAR Part 9.507-1 and shall determine in writing whether the interests disclosed present an actual, or significant potential for, an organizational conflict of interest. The contractor shall identify and avoid, neutralize, or mitigate any subcontractor organizational conflict prior to award of the contract to the satisfaction of the Contracting Officer.

If the subcontractor's organizational conflict cannot be avoided, neutralized, or mitigated, the contractor must obtain the written approval of the Contracting Officer prior to entering into the subcontract. If the contractor becomes aware of a subcontractor's potential or actual organizational conflict of interest after contract award, the contractor agrees that the Contractor may be required to eliminate the subcontractor from its team, at the contractor's own risk.

(g)Waiver. The parties recognize that this clause has potential effects which will survive the performance of this contract and that it is impossible to foresee each circumstance to which it might be applied in the future. Accordingly, the contractor may at any time seek a waiver from the Head of the Contracting Activity by submitting such waiver request to the Contracting Officer, including a full written description of the requested waiver and the reasons in support thereof.

H.4 DISSEMINATION, PUBLICATION AND DISTRIBUTION OF INFORMATION

Data and information either provided to the Contractor, or to any subcontractor or generated by activities under this contract or derived from research or studies supported by this contract, shall be used only for the purposes of the contract. It shall not be duplicated, used or disclosed for any purpose other than the fulfillment of the requirements set forth in this contract. This restriction does not limit the Contractor’s right to use data or information obtained from a non-restrictive source. Any questions concerning “privileged information” shall be referred to the Contracting Officer.

Some data or information may require special consideration with regard to the timing of its disclosure so that preliminary findings which could create erroneous conclusions are not stimulated. Also, some data or information, which relate to policy matters under consideration by the Government, may also require special consideration with regard to the timing of its disclosure so that the open and vigorous debate, within the Government, of possible policy options is not damaged.

Any questions about use or release of the data or information or handling of material under the contract shall be referred to the COR who must render a written determination to the Contracting Officer. The COR’s determination will reflect the results of internal coordination with appropriate program and legal officials. After receipt of the COR’s written determination, the Contracting Officer will make a final decision authorizing the release of information.

Written advance notice of at least forty-five (45) days shall be provided to the COR of the Contractor’s desire to release findings of studies or research or data or information described above. If the Contractor disagrees with the COR’s determination and if the disagreement cannot be settled by the Contractor and the CO in a mutually satisfactory manner, then the issue will be settled pursuant to the “Disputes” clause.

Any presentation of any report, statistical or analytical material based on information obtained from this contract shall be subject to review by the COR before dissemination, publication, or distribution. Presentation includes, but is not limited to, papers, articles, professional publications, speeches, testimony or interviews with public, print or broadcast media. This does not apply to information that would be available under the Federal Freedom of Information Act.

The COR’s review shall cover accuracy, content, manner of presentation of the information, and the protection of the privacy of individuals. If the review finds that the Privacy Act is or may be violated, the release/use of the presentation shall be denied until the offending material is removed or until the Contracting Officer makes a formal determination, in writing, that the privacy of individuals is not being violated.

If the review shows that the accuracy, content, or manner of presentation is not correct or is inappropriate in the light of the purpose of the project, the COR shall immediately inform the Contractor, in writing, of the nature of the problem. If the Contractor disagrees, the COR may insist that the presentation contain, in a manner of equal importance, materials which show the government's problem with the presentation.

The Contractor agrees to acknowledge support by FDA whenever reports of projects funding, in whole or in part, by this contract are published in any medium. The Contractor shall include in any publication resulting from work under this contract, an acknowledgement substantially, as follows:

“The analyses upon which this publication is based were performed under Contract Number [ ], entitled, “[ ],” sponsored by the Food and Drug Administration, Department of Health and Human Services.”

H.5 PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR PHYSICAL

ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ x ] Moderate [ ] High Integrity: [ ] Low [ x ] Moderate [ ] High Availability: [ ] Low [ x ] Moderate [ ] High Overall Risk Level: [ ] Low [x ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ x ] Yes PII

Complete this section using the information obtained from the Security and Privacy Checklist in Appendix A, parts A and B.

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ x ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer- Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

See Appendix D for baseline deliverables.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where

(1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident…