Sol_Doc.pdf

FY 22 MQSA 75F40122R00022

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B-1 – BACKGROUND AND OBJECTIVES

In performing the work as described in Section C: DESCRIPTION/ SPECIFICATIONS/ STATEMENT OF WORK, the Contractor shall review and consider the following:

A. Background

The Mammography Quality Standards Act of 1992, (MQSA) was signed into law on October 27, 1992. The intent of the Act is to ensure that women receive high quality mammography for early breast cancer detection by requiring the establishment of a federal certification and inspection program for mammography facilities. The Act authorizes The U.S. Food and Drug Administration (FDA) to obtain State and/or local assistance in enforcing MQSA requirements, including annual inspections of all certified mammography facilities.

NOTE: Interim regulations were published on September 30,1994 and April 03, 1996.

FDA published final MQSA regulations in the Federal Register on October 28, 1997;

these final regulations became effective April 28, 1999.

B. Objectives

The MQSA Program Contracting objective is to obtain State and/or local assistance in the inspection of certified non-Federal mammography facilities to document and report compliance with mammography quality standards issued under 21 CFR Part 900.

B-2 – COMPENSATION AND PERIOD OF PERFORMANCE

A. The contract type is Firm Fixed Price with Other Direct Costs (ODCS).

B. As consideration for full performance of the work stated in Part I, Section C - Scope of Work, the Government may pay the State contractor a unit fixed price not to exceed of $ if all inspections are done, and not to exceed $ for Continuing Education Units, for a total contract amount of $ . The base period of performance is 12 months, options periods will be included to prevent this expiration using clauses FAR 52.217-8 and 52.217-9.

C. Payment up to the full amount of this contract shall be contingent upon receipt and acceptance by the Government of inspection reports and proper invoices as required by Part I, Section F, F2- Reports/Deliverables and Section G, G-3 - Invoice Submission, and in accordance with the schedule in part F

D. Mammography Continuing Education Units for MQSA Inspectors

Total expenditures for each certified inspector to acquire fifteen (15) Mammography Continuing Education Units (MEUs) is strictly limited to course registration and tuition fees, membership dues to join professional organizations that offer free or reduced price continuing education courses (i.e. American Society of Radiologic Technologists (ASRT)), course materials) and if necessary, travel expenses. The fixed allotment of $1,500 per inspector shall not be exceeded within any three-year certification period.

Funds in the NTE amount of $ to be billed separately for inspectors are allotted for MEUs under this contract.

Note: Salary is not a reimbursable expenditure while receiving Continuing Education.

E. MQSA Inspector Training Course III:

MQSA Inspector Training will be funded as a modification to this contract and shall be in accordance with Federal Travel Regulations.

NOTE: All training and travel under this contract shall be paid as Other Direct Cost (ODC). Travel and training ODCs are subject to FAR clause 52.216-7 “Allowable Cost and Payment’ and FAR clause 52.232-20 “Limitation of Cost”. These FAR clauses are included by reference in Section I of the contract.

F. Schedule

Base Period NTE: $____________________________________

Base Period of Performance: ___________ to ____________

Item Unit Estimated Quantity Price Total Price

MQSA Inspections FFP Unit Price $ $

MEU NTE XXXXXXX $ $

Option Period 1 NTE: $________________________________

Option Period 1 Period of Performance: ___________ to ____________

Quantity Price Total Price

MQSA Inspections FFP Unit $ $

Price

MEU NTE XXXXXX $ $

Option Period 2 NTE: $________________________________

Option Period 2 Period of Performance: ___________ to ____________

Quantity Price Total Price

MQSA Inspections FFP Unit

Option Period 3 NTE: $________________________________

Option Period 3 Period of Performance: ___________ to ____________

Quantity Price Total Price

MQSA Inspections FFP Unit

Option Period 4 NTE: $____________________________

Option Period 4 Period of Performance: ___________ to ____________

Quantity Price Total Price

MQSA Inspections FFP Unit

52.217-8 Option to Extend up to Six Months NTE: $______________________

Period of Performance: ___________ to ____________

Quantity Price Total Price

MQSA Inspections FFP Unit

MEU NTE XXXXXXXX $ $

C – DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C-1 SCOPE OF WORK

A. BACKGROUND

The Mammography Quality Standards Act of 1992, (MQSA) was signed into law on October 27, 1992. The intent of the Act is to ensure that women receive high quality mammography for early breast cancer detection by requiring the establishment of a federal certification and inspection program for mammography facilities. The Act authorizes The U.S. Food and Drug Administration (FDA) to obtain State and/or local assistance in enforcing MQSA requirements, including annual inspections of all certified mammography facilities.

NOTE: Interim regulations were published on September 30,1994 and April 03, 1996. FDA published final MQSA regulations in the Federal Register on October 28, 1997; these final regulations became effective April 28, 1999.

B. SCOPE

The Contractor shall inspect non-federal mammography facilities that have been certified by the Food and Drug Administration (FDA) to perform mammography under MQSA using inspectors from state, local, and territorial governments who have attained, and continue to maintain, an active FDA MQSA certification status. The Contractor shall adhere to the procedural requirements of the “FDA Compliance Program 7385.014, Mammography Facility Inspections” (Attachment 1), and “Mammography Quality Standard Act (MQSA) Inspection Procedures” (Attachment 2).

C. OBJECTIVE

The objective is to have trained, FDA-certified inspectors perform inspections of certified non- Federal mammography facilities to document and report compliance with mammography quality standards issued under 21 CFR Part 900.

D. CONSTRAINTS

The contractor shall adhere to the following constraints during performance of this contract:

1. For Contractor-supplied computer equipment, the Contractor shall ensure all certified inspectors are equipped with and maintain computer equipment that meet the performance specification capabilities as outlined in “Computer Specifications for MQSA Inspections” (Attachment 3).

2. Only FDA-certified inspectors are allowed to perform inspections under this contract.

The FDA reserves the right to revoke an inspector’s certification if serious and significant deficiencies (inspection performance requirements, MEUs, etc.) are found.

Revocation of certification would result in the inspector’s inability to perform inspections under this contract and requires remediation as outlined in the “MQSA Inspector Certification Process” (Attachment 4).

E. TASK REQUIREMENTS

1. Inspections

a. The Contractor shall perform inspections of non-federal mammography facilities, as identified in the Advanced Facility Search of Mammography Program Reporting and Information System (MPRIS), in accordance with the procedures contained in the FDA Compliance Program 7385.014, Mammography Facility Inspections, and any subsequent revisions (Attachment 1), and the Mammography Quality Standard Act (MQSA) Inspection Procedures (Attachment 2). The COR/COR designee (RHR) will provide instructions on how to access data stored in MPRIS upon award.

i. Before proceeding with an inspection of a provisionally certified facility, as identified in MPRIS, the Contractor shall verify that the facility has performed mammography at least 4 months after receiving its provisional certificate. The Contractor shall consult via email with the COR/COR Designee (RHR) and obtain approval before scheduling an inspection at any provisionally certified facility, as identified in MPRIS.

ii. The Contractor shall not perform an inspection earlier than ten (10) months, and not later than fourteen (14) months from the last inspection unless directed to do so by the COR/COR Designee (RHR), nor conduct an inspection of the same facility within the same contract period of performance except in limited circumstances as approved by the COR/COR Designee (RHR).

iii. The Contractor shall notify the COR/COR Designee (RHR), via email, as soon as possible, but no later than five (5) business days from date of inspection and prior to the issuance of a report to the facility, whenever inspection results indicate a Level 1 (serious) or Repeat Level 2 observation, as described in “FDA Compliance Program 7385.014, Mammography Facility Inspections” (Attachment 1). The Contractor shall ensure the notification includes the facility ID, name, and description of the observations that indicate a Level 1 or Repeat Level 2 determination, and any relevant inspection documentation. The contractor shall obtain approval from the COR/COR designee (RHR) prior to issuance of the report to the facility.

iv. The Contractor shall complete computer-generated inspection reports (MQSA Inspection Report, the Inspection Detail Report, and any supporting documentation) for each inspection using the latest version of the Facility Inspection Support System (FISS) software made available by COR/COR designee (RHR) upon award.

v. The Contractor shall ensure that the inspection reports are submitted to MPRIS on the MPRIS Web and submitted within five (5) business days from completing the facility inspection. The COR/COR designee (RHR) will provide instructions on how to access MPRIS upon award.

vi. The Contractor shall maintain, and make available upon request, a copy of the MQSA Inspection Report, the Inspection Detail Report, and any supporting documentation collected during the MQSA inspection for the duration of the current contract.

vii. The Contractor shall notify FDA disclosure team members at

ORAinfoshare@fda.hhs.gov and the COR/COR Designee (RHR) within three (3) business days after receipt of a public records request for information obtained during and after the performance of the contract, even if the records collected were obtained under state authority. The Contractor is not authorized to release confidential commercial information without permission from COR/COR Designee. Refer to Section H – Special Contract Requirements for additional requirements for maintaining confidential commercial information.

2. Training

a. MQSA Inspector Training Courses I – III - The Contractor shall provide a nominee based on the COR-provided information about a future training to the “MQSA Inspector Certification Process” (Attachment 4). Upon FDA approval, COR/COR Designee will inform the Contractor of approval of the nominee. The Contractor shall submit a Travel Cost Estimate (TCE) (Attachment 5), based upon Federal Government Travel/GSA Regulations, to the COR/COR designee no later than twenty (20) business days after receiving notification of acceptance from the

FDA.

b. MEUs

i. - The Contractor shall ensure that each certified inspector earns a minimum of fifteen (15) Mammography Continuing Education Units

(MEUs) during each 36-month period as outlined in “MQSA Inspector Certification Process” (Attachment 4, Appendix H). The Contractor shall submit a Quarterly MEU Tracking and Spending Report to the COR/COR designee, as provided in (Attachment 7)

ii. The Contractor shall submit Successful MEU Course Completion Certificates upon invoicing to IPP.

3. State Contract Progress Reports

The Contractor shall submit a State Contract Progress Report using MPRIS by the final day of each quarter during the contract period of performance (POP) in accordance with “MQSA State Contract Progress Report Submission” (Attachment 6).

SECTION D – PACKAGING AND MARKING

This section is not applicable to this solicitation/contract.

SECTION E – INSPECTION AND ACCEPTANCE

E-1 – INSPECTION AND ACCEPTANCE

Pursuant to the appropriate inspection clause as provided below, final inspection and acceptance of all items called for by this contract shall be made by the FDA Contracting Officer Representative at the Food and Drug Administration.

52.246-4 Inspection of Services – Fixed Price (Aug 1996)

(a) Definition. “Services,” as used in this clause, includes services performed, workmanship, and material furnished or utilized in the performance of services.

(b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires.

(c) The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all time and place during the term of the contract.

The Government shall perform inspections and tests in a manner that shall not unduly delay the work.

(d) If the Government performs inspections or tests on the premises of the Contractor or a subcontractor, the Contractor shall furnish, and shall require subcontractors to furnish, at no increase in contract price, all reasonable facilities and assistance for the safe and convenient performance of these duties.

(e) If any of the services do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by re-performance, the Government may—

1. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

2. Reduce the contract price to reflect the reduced value of the services performed.

(f) If the Contractor fails to promptly perform the services again or to take the necessary action to ensure future performance in conformity with contract requirements, the Government may—

1. By contract or otherwise, perform the services and charge to the Contractor any cost incurred by the Government that is directly related to the performance of such service; or

2. Terminate the contract for default.

SECTION F – DELIVERIES OR PERFORMANCE

F-1 – PERIOD OF PERFORMANCE

The period of performance is From: __________ through__________(base period). Option Periods (See B-2).

F-2 – REPORTS/DELIVERABLES

The Contractor shall submit the following reports/ deliverables by the due dates indicated:

Reference Deliverable Method of Delivery Frequency/Due Date (in Calendar Days unless otherwise noted) E.1.a Travel Cost

Estimate Email to the COR/COR designee

No later than twenty

(20) business days after receiving notification of acceptance from the

FDA

E.1.a.iv and E.1.a.v

Inspection Reports

MPRIS Five (5) business days from completing the facility inspection

E.3 State Contract Progress Reports

MPRIS and IPP By the final day of each quarter during the contract POP (MPRIS) and at invoice submission

(IPP)

E.4 MEU Tracking and Spending Reports

Email to the COR/COR designee

By the final day of each quarter during the contract POP

E.5 Successful MEU Class Completion Certificate

IPP At the time of invoice submission

Copies of the Reports shall be provided as follows:

• One copy to:

Neal Alcalay Food and Drug Administration ORA/Office of Management Email: Neal.Alcalay@fda.hhs.gov Phone: 347-652-5155

** Acceptable method of delivery is via email.**

SECTION G – CONTRACT ADMINISTRATIVE DATA

G-1 - ADMINISTRATIVE PERSONNEL

The following personnel shall represent the Government for this contract:

1. Contracting Officers Representative (COR):

Neal Alcalay Food and Drug Administration ORA/Office of Management Email: Neal.Alcalay@fda.hhs.gov Phone: 347-652-5155

a. The COR may be changed at any time by the Government without prior notice to the Contractor by a unilateral modification to the contract.

b. The responsibilities and limitations of the COR are as follows:

• The COR is responsible for monitoring the Contractor’s technical progress, including the surveillance and assessment of performance and recommending to the Contracting Office changes in the requirement. The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor.

mailto:Neal.Alcalay@fda.hhs.gov mailto:Neal.Alcalay@fda.hhs.gov

• The COR is not authorized to make any commitments or otherwise obligate the

Government or authorize any changes which may affect the cost, period of performance, or terms and conditions of the contract. Any Contractor request for changes shall be referred to the Contracting Officer (CO) directly or through the COR. No such changes shall be made without the expressed prior authorization of the CO. The CO may designate assistant or alternate CORs to act for the COR by naming such assistant/alternate(s) in writing and transmitting a copy of such designation to the Contractor.

G-2 - TECHNICAL DIRECTION

Performance of work under this contract is subject to the technical direction of the COR/COR Designee. The term “technical direction” includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily. To be a valid Technical Direction Letter (TDL), it must be within the general scope of work stated in the contract, and it would not require any increase to the negotiated price and/or adjust the delivery terms under the contract.

Each TDL issued hereunder is subject to the terms and conditions of this contract. It shall be in writing and include, as a minimum, the following information:

a. Effective date of TDL;

b. Task Order and sequential TDL number;

c. Reference to the relevant section in the statement of work; and

d. Requirements to be performed.

Technical direction must be within the scope of this statement of work (SOW). The COR does not have authority to issue technical direction that:

a. Constitutes a change of assignment or additional work outside the specification(s)/statement of work;

b. Constitutes a change as defined in the clause entitled “Changes”;

c. In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

d. Changes any of the terms, conditions, or specification(s)/work statement of the contract;

e. Interferes with the contractor's right to perform under the terms and conditions of the contract; or

f. Directs, supervises or otherwise controls the actions of the contractor's employees Technical direction may be oral or in writing. The COR/COR Designee shall confirm oral direction in writing within three (3) work days.

The Contractor shall not comply with any TDL if the Contractor believes it is not a valid TDL. In the event of a conflict between a TDL and the scope of the contract/order, the terms of the contract/order shall prevail. If the Contractor believes or has reason to believe that a TDL is not valid, the Contractor shall notify the COR/COR Designee and Contracting Officer thereof by email within three (3) days of receiving the TDL in question. The Contracting Officer will give appropriate direction to the Contractor and COR to resolve the TDL issue. Technical Direction provided in meetings with minutes submitted by the Contractor for Government acceptance does not need to be documented via TDL. The Technical Direction shall be documented in the meeting minutes.

Contractor’s failure to comply with this clause is grounds for finding that incurred costs are not allowable.

G-3 - INVOICE SUBMISSION

352.232-71 Electronic Submission of Payment Requests (FEB 2022)

(a) Definitions. As used in this clause—

Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

(a) All Invoice submissions for goods and or services must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.htm

(b) Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract, or the clause 52.212-4 http://www.ipp.gov/vendors/index.htm

Contract Terms and Conditions – Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov.

(c) -----

(1) The Agency will enroll the Contractors new to IPP. The Contractor must follow the

IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 – 5 business days of the contract award for new contracts or date of modification for existing contracts.

(2) Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone

(866) 973-3131.

(3) The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

(4) If your company is already registered to use IPP, you will not be required to re-register.

(5) If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

(d) Invoices that include time and materials or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

(e) Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

(1) At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

- Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

- Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

https://www.ipp.gov/

- Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

- Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

- Fee – amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

(f) Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(1) list of all invoices submitted to date under the subject award, including the following:

- invoice number, amount, & date submitted

- corresponding payment amount & date received

- total amount of all payments received to date under the subject contract or order

- and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

(g) Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

(h) If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

(i) Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

(j) The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

(k) Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC)

Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

G-4 - GOVERNMENT FURNISHED MATERIALS

The FDA shall furnish the Contractor with a laptop computer and equipment needed to conduct inspections under this contract, unless the Contractor declines to use GFE. If the Contractor declines to use GFE, the Contractor shall provide laptops and equipment needed to conduct inspections under this contract, in accordance with FDA equipment specifications (Attachment 3).

The Contractor shall notify DMQS at cdrhmqrp@cdrh.fda.gov, as well as copy the COR and COR Designee within 5 days when an inspector leaves the MQSA inspection program to coordinate the return of FDA-issued IT equipment, and FDA-issued inspector identification card, or if the equipment is lost, stolen, or otherwise malfunctioning.

(Attachment 2)

G-5 - CONTRACTING OFFICER’S AUTHORITY

The Contracting Officer (CO) identified below has responsibility for ensuring the performance of all necessary actions for effective contracting; ensuring compliance with the terms of the contract and safeguarding the interests of the United States in its contractual relationships. The CO is the only individual who has the authority to enter into, administer, or terminate this contract and is the only person authorized to approve changes to any of the requirements under this contract, and notwithstanding any provision contained elsewhere in this contract, this authority remains solely with the CO.

No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this Contract. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the contract. The Government will not reimburse the Contractor for any work not authorized by the CO, including work outside the scope of the contract.

Contracting Officer Name:

Email:

Contract Specialist Name:

mailto:cdrhmqrp@cdrh.fda.gov

Email:

G-6 – CONTRACTING OFFICER REPRESENTATIVE

The Contracting Officer may designate other Government personnel (known as the Contracting Officer’s Representative) to act as the authorized representative for contract administration functions which do not involve changes to the scope, price, schedule, or terms and conditions of the contract. The designation will be in writing, signed by the Contracting Officer, and will set forth the authorities and limitations of the representative(s) under the contract. Such designation will not contain authority to sign contractual documents, order contract changes, modify contract terms, or create any commitment or liability on the part of the Government different from that set forth in the contract. The Contractor shall immediately contact the Contracting Officer if there is any question regarding the authority of an individual to act on behalf of the Contracting Officer under this contract.

G-7 –CONTRACTOR PERFORMANCE EVALUATION

In accordance with Federal Acquisition Regulation (FAR) 42.15, FDA will complete annual and final contractor performance evaluations. Annual evaluations will be prepared to coincide with the anniversary date of the contract. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary.

Final performance evaluations will be completed upon contract expiration.

FDA will utilize the Contractor Performance Assessment Reporting System (CPARS) in order to execute annual and final contractor performance evaluations. CPARS is a secure Internet website located at http://www.cpars.csd.disa.mil/cparsmain.htm. FDA will register the contractor in CPARS upon receipt of the name and email address of two (2) individuals who will be responsible for serving as the Contractor’s primary and alternate CPARS contacts. Once FDA registers the contractor in CPARS, the Contractor will receive an automated CPARS email message which contains User IDs and instructions for creating a password.

Once a performance evaluation is issued, the Contractor’s primary and alternate CPARS contact will receive an email instructing them to logon to CPARS in order to review the performance evaluation. The Contractor has 14 days from the date of performance evaluation issuance in which to review the evaluation. If the Contractor is in agreement with the performance evaluation outcome, the evaluation becomes final. Should the Contractor be in disagreement with the performance evaluation outcome, rebuttal comments must be submitted via the CPARS within 14 days from date the evaluation was issued by FDA. Any disagreement between the Contracting Officer and the Contractor will be referred to a contracting official one level above the Contracting Officer, whose decision will be final.

Copies of each performance evaluation and contractor responses, if any, will be retained as part of the official contract file and will be used to support future award decisions.

Contractors may obtain CPARS training material and register for on-line training at http://www.cpars.csd.disa.mil/allapps/cpcbtdlf.htm. There is no fee for registration or use of the CPARS.

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H-1 - PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR

PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [x] Moderate [ ] High Integrity: [ ] Low [x] Moderate [ ] High Availability: [ ] Low [x] Moderate [ ] High Overall Risk Level: [ ] Low [x] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [x] Yes PII Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer- Related Storage Media. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract without obtaining permission from FDA disclosure team members at ORAinfoshare@fda.hhs.gov and the COR/COR Designee. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with //HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

mailto:ORAinfoshare@fda.hhs.gov

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys.

Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA) (Attachment 9). The FDA Contracting Officer shall provide a Non-Disclosure Agreement to the Contractor. The Contractor shall have the agreement signed by the Agency official authorized to sign the form. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the FDA Program Manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP) https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html..

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-rules-of-behavior-for-the-use-of-hhs-information-and-it-resources-policy.html.

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-rules-of-behavior-for-the-use-of-hhs-information-and-it-resources-policy.html https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-rules-of-behavior-for-the-use-of-hhs-information-and-it-resources-policy.html

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

The Federal Information Security Modernization Act (FISMA) defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where

(1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send FDA approved notifications to affected individuals as directed by FDA’s SOP.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the FDA Systems Management Center, COR, CO, and other stakeholders, (Recommend adding the FDA Senior Official for Privacy with…