Sol-Doc FINAL.docx

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued. This synopsis is to notify contractors that the government intends to issue a Purchase Order in accordance with FAR Part 13 for the following, under simplified acquisition procedures. The Request for Proposal number is FDA-SOL-21-1238430. Provisions and clauses in effect through Federal Acquisition Circular 2005-97 are incorporated into this request. It is the contractor's responsibility to be familiar with the applicable clauses and provisions. The provisions and clauses may be accessed in full text at www.acquisition.gov/far.

The NAICS code is 551519, Software Publishers. All qualified vendors are encouraged to respond. The purpose of this procurement is to procure EMU software maintenance that is BRAND NAME OR EQUAL for a 12-month period. The Product shall support the U.S. Food and Drug Administration (FDA). This requirement will ensure the FDA adheres to management and scientific collection mandates. The FDA requests proposal responses from qualified sources capable of meeting the requirements outlined in the Statement of Work.

U.S. Food and Drug Administration Center for Food Safety and Applied Nutrition

Electronic Museum Scientific Collections Management System (SCMS) and Support (BRAND NAME OR EQUAL) Statement of Work

Overview

The U.S Food and Drug Administration is establishing a contract to provide software and services associated with implementing the Electronic Museum (EMu) Scientific Collection Management System (SCMS) software. This includes training and support services to assist the FDA in maintaining and supporting the EMu SCMS.

Type of Contract

This is a single Firm Fixed Price (and Labor Hour should options be exercised) contract with a base period of 12-months from the date of award with optional tasks based on funding.

Purpose The purpose of this statement of work is to procure the EMu, Electronic Museum Scientific Collection Management System (SCMS), software licensing and related support. The SCMS shall meet the requirements as outlined in the Holdren memorandum cited below (Background section) and, in particular, aid the Agency in the long-term preservation, maintenance, and accessibility of new and existing collections and maximize public benefit from their use. The requirements and activities associated with implementing, training, and effectively leveraging the EMu SCMS, in accordance with industry standards are contained within this statement of work. This requirement will ensure the FDA adheres to management and scientific collection mandates, as outlined below.

Background The FDA’s permanent institutional scientific collections are agency assets that serve as important primary resources for scientific reference, research, discovery, judicial decisions, and support FDA’s regulatory mission. The proper management and stewardship of the Agency’s scientific collections is critical to maintaining and enhancing their value. Public access to these valuable scientific collections is central to FDA’s mission and the Agency’s regulatory science efforts.

In 2014 a White House mandate1 (the “Holdren memo”) was issued to the Federal government to better manage its collections and to make them more accessible, both inside government and to the public. Following that directive, the FDA prepared and released the Scientific Collections Management and Access Policy 9005.12 that further details how collections within the FDA will be handled, including increasing the public’s access to them.

An initial survey of FDA’s institutional collections in June 2016 shows that the Agency owns ~150,000 bacterial cultures, ~20,000 entomological specimens (pinned, in alcohol or slide mounted), >10,000 historic artifacts, >4,000 photomicrographs, ~2,000 Herbarium specimens, and ~2,000 natural history collections stored in at least eight different locations across the country. Currently, the records for artifacts are digital and non- digital. The digital records are in Microsoft Word, Access, and Excel formats. With digitized collections, connected by a secure internet connection, it would be possible for the Agency to share their even larger virtual collection with each other and the public.

To comply with the White House mandate, the FDA requires the EMu, Electronic Museum Scientific Collection Management System (SCMS), software licensing, service packs and related support. This SCMS will document all collections used by the research and regulatory scientists in the Agency in a uniform fashion, making these materials available to every scientist in the Agency and, ultimately, the public. Currently the Agency does not have a single, primary SCMS and only a limited number of the collections are databased using a wide variety of ad hoc in-house systems employing Excel, Access, FoxPro, etc. A single SCMS would address the key points outlined in the Holdren memorandum which requires robust management of scientific collection and public access to these collections.

The EMu, Electronic Museum SCMS will bring FDA collections into accordance with the following four mandates:

1) FDA’s Scientific Collections Management and Access Policy 9005.1 (SMG 9005.1), was issued on 10/05/2015, drafted in response to the Holdren memo, and requires the proper management of the Agency’s scientific collections to maintain their value. During the drafting of the policy, it was recognized that a centralized, shared resource would be the most efficient (with respect to budget and personnel) way to approach this challenge.

1 Holdren Memo:

https://obamawhitehouse.archives.gov/sites/default/files/microsites/ostp/ostp_memo_scientific_collections_march _2014.pdf

2 SMG 9005.1

FDA-SOL-21-1238430

2) Hazardous Biological Agents and Toxins Biosecurity and Inventory Control FDA SMG 2130.8 requires regulatory and research scientists to maintain records documenting location and accessibility of potentially hazardous biological agents. An SCMS would also serve to meet the requirements specified in the Staff Manual Guide.

3) The report entitled “Scientific Collections: Mission-Critical Infrastructure for Federal Science Agencies” (https://usfsc.nal.usda.gov/sites/usfsc.nal.usda.gov/files/IWGSC_GreenReport_FINAL_2009.pdf) published by the Interagency Working Group on Scientific Collections outlines several best practices for the management of, and access to, institutional scientific collections.

4) Among the criteria cited in Section 104 of Public Law 111-358, American Competes Reauthorization Act of 2010, https://www.congress.gov/111/plaws/publ358/PLAW-111publ358.pdf, are requirements by Federal Agencies to improve the “organization, access, including online access, to information about Federal scientific collections.” Therefore, any SCMS used should be able to facilitate the sharing about specimens, samples, and related information on them. The international scientific community has developed a body of standards called the Darwin Core to facilitate the exchange of data. The Darwin Core standards detail the definitions of the terms and how they are to be used to share data about specimens in a simply structured way.

Scope The scope of this effort includes the following: EMu, Electronic Museum Scientific Collection Management System (SCMS), software licensing and related support, project management, application configuration, testing, data conversion of legacy data, implementation, training, and general system process consulting services to support FDA. Initially, the FDA anticipates there to be between 3-5 administrators, 5-10 power user and up to 20 regular users.

The scope of this project will include a base scope and two optional scopes to be added, depending on funding.

Base Scope- Operations and Maintenance (Firm Fixed Price): Contractor shall maintain the already installed internal User Interface for internal users for three environments (Development, Test/Pre-Production, and Production). Contractor shall maintain and update user roles and permissions to accommodate new collections and changing needs of stakeholders. Contractor shall conduct Operation and Maintenance to include bug fixes and support to include method to get a hold of Contractor, response time that is acceptable to owner for maintenance of system past DME lifecycle.

DME for Entomology and Botany (optional task) (Labor Hour):

Contractor shall Contractor shall work with business stakeholders to develop and configure new user interfaces for new collections that are identified.

Contractor shall make modifications and enhancements to existing user interfaces for collections and build reports and dashboards as needed.

Contractor shall maintain and update user roles and permissions to accommodate new collections and changing needs of stakeholders.

Contractor shall create a Test Plan, organize User Acceptance Testing and present all test scripts one week before User Acceptance Testing separately for all tasks within this contract. It is expected that there will be three major releases during the each annual Period of Performance.

Contractor shall collaborate with FDA staff to design customized user interfaces and modules with required fields for each of the following disciplines: bacterial/microbiological, botany, entomology, and historical. The current data are stored in different file formats including Microsoft Access, Excel, and Word.

The Contractor shall build test criteria and test script for user testing that is validated and accepted by business owners with tractability back to requirements gathered.

DME for Public Facing Application (optional task) (Labor Hour):

Contractor shall also install and configure new public facing EMu servers for the public facing side and integrate it with the internal servers. Public facing servers will also be built in three environments (Development, Test/Pre-Production, and Production).

Specific Tasks

The contractor shall perform the following tasks. The solution and support are related to the EMu, Electronic Museum software. The solution shall meet the following:

Software Licenses and Support

· Solution shall be located on FDA premises and use machine-readable, open formats, data standards, and common-core and extensible metadata for all new information creation and collection to facilitate search and discoverability.

· Solution shall provide clear public guidance for accessing collections materials, consistent with the Executive Order on Making Open and Machine Readable the New Default for Government Information.

· Solution shall have the capability to make all digital files easily accessible to the public. Files shall be in the highest available fidelity and resolution, including, but not limited to, photographs, videos, digital 3D models, and associated records and documentation, describing or characterizing objects in FDA-managed scientific collections.

· Solution shall have the capability to limit access to collections and information about collections for the purpose of protecting national interests including honoring copyright, international or tribal agreement, confidentiality, privacy and other laws, and regulations, or addressing security concerns. For example, locality information could be withheld or its release limited for the purpose of protecting endangered or otherwise protected species or research site. In the event that access to objects within or information about a collection must be restricted, restrictions on access shall be limited to the minimal subset of specific objects and records possible, with all other collection content made public. Where possible, redaction of specific metadata fields should be favored over limiting access to the entire object or subset of objects.

· System shall natively implement Darwin Core specifications for accession data (established international standard for collection data, (e.g., who, what, where, when, why, and how) of the particular accession, http://rs.tdwg.org/dwc/) as well as:

· System shall maintain records of accession distribution of bacterial subcultures

· System shall generate and print accession labels

· System shall be capable of inventory accession physical locations

· System shall maintain records of accession distribution of bacterial subcultures

· System shall maintain data on growth conditions (temp, media, etc.). for bacterial isolates

· System shall maintain data for viral isolates, e.g., cell lines used to grow the viruses and the number of passes, etc.

· System shall document the food from which the microbe was isolated

· System shall track information on isolates linked to outbreaks data

· System shall maintain tables of references that can be shared by each discipline

· System shall store ancillary material relevant to accession

· System shall be capable of the following Taxonomic requirements:

· Have populated lookup tables with the full taxonomic hierarchy for botanical, zoological, and microbiological. The taxonomic standards for microbiology shall be based on the International Code of Nomenclature of Bacteria.

· Is linked to authoritative nomenclature sites and has pre-populated look up tables for common names

· System shall be capable of Electronically exchanging data between computer systems as well as:

· Maintain a synonym try of accession numbers with ability to trace back to FDA sample numbers

· Electrophoresis patterns, serology and DNA results, or other research data associated with the accession

· Can be linked to other FDA data sources e.g. FACTS, CMS

· Allows for the easy entry and preservation of Pulse Field Gel Electrophoresis patterns, serology and DNA results, or other research data associated with the accession

· Allow for the ease of migration from legacy systems to new one. Legacy data is store in Access, Oracle, Excel, CSV formats, etc.

· Interface with National Center for Biotechnology and Smithsonian for data exchange

· Interface data to Pulse Net to exchange data and have the capability to make data accessible within and outside of the FDA.

· Implement geographical mapping of the origin of accession

· Maintain records of the ranking of insect pests of regulatory significance

· Allows for limited public access to some data elements in the database over the internet, e.g. allow access to images from the FDA history office.

· Alert researchers to Biosafety level required for handling isolates

· Computer/data requirements

· Has a simple, easy data entry system

· Labels metadata info on commodities to ease search

· Readily stores ancillary digital information on the accession, e.g., photo, mpeg files, etc. in the highest available fidelity and resolution

· Store large data files generated from whole genome sequencing

· Be accessible from multiple sites around the country at the same time

· Allows for automatic backups

· Can be linked to other FDA data sources e.g. FACTS, CMS

Configuration and Installation

· The contractor shall configure roles and permissions and intake user interface, install, configure, and test EMu onto the server purchased by the FDA at the AWS GoveCloud

· Contractor shall engage stakeholders and build the requirements for configuration of the UI and reports based on best practices and requirement gathering done with stakeholders (e.g. data reports should be configured to show holdings, storage locations, additions and subtractions, transfers,).

· Contractor shall install and configure solution and user interface in 4 FDA environments (Development, Test, Pre-Production, and Production). Development and Test application servers will be installed and configured directly by contractor and contractor will coordinate with VDD document and ERWIN models with HP to have production environments built by HP. Unless otherwise stated in the statement of work

· Currently, FDA accession data is stored as Excel, Access, text files or other electronic forms. Contractor shall migrate and normalize information from existing data sets, (Excel, Access, and other relational databases) to populate existing data to their Darwin Code equivalents and populate data into the appropriate SCMS fields. Delivered in .CSV format.

· Contractor shall collaborate with FDA COR to design customized user interfaces and modules with required fields for each of the following disciplines: bacterial/microbiological, botany, entomology, and historical. The current data are stored in different file formats including Microsoft Access, Excel, and Word.

· DME Releases shall be identified in the Project Management Plan (PMP) and negotiated during PMP approval. Contractor shall provide mock ups and use cases for all DME change requests (CRs).

· Contractor shall develop all software in accordance with sound and acceptable software engineering industry best practices. All software delivered shall be optimized for performance and resource utilization for FDA’s pre-production and production environments. All software developed shall maintain existing database integrity, error handling and graceful termination of execution for unexpected problems and not adversely affect other applications running on the FDA production environment.

· Contractor shall ensure new modules incorporate SSO along with the rest of the CFROCE Application.

· All data in the database for the transactional system must be in Third Normal Form or better to prevent loss of data over time.

· Contractor shall provide database definition documentation that outlines the data structure, associated business rules, naming standards, and definition for all database entities including tables, fields and stored procedures.

· Contractor shall create a Test Plan, organize User Acceptance Testing and present all test scripts one week before User Acceptance Testing. It is expected that there will be three major releases during the Period of Performance.

· The Contractor shall build test criteria and test script for user testing that is validated and accepted by business owners with tractability back to requirements.

· Computer equipment, servers, CITRIX workstations, and laptops will be supplied by the FDA to meet the vendor’s hardware requirements.

Consulting Support / Training

· Contractor shall provide annual online end user training for all FDA employees that will be recorded and made available as a training aid. As part of the training, contractor shall provide Job Aids for each role as well as a user manual for the entire system so that users will have a single source for their specific tasks.

· Contractor shall provide or update existing job aids for staff for any task that should be done within application that has been created or modified by this IDIQ. All major releases should be followed with training for users.

· Contractor shall create and successfully negotiate a plan to transition new development modernization and enhancements (DME) into Operation and Maintenance to include bug fixes and support to include a method to get a hold of Contractor, response time that is acceptable to owner for maintenance of system past DME lifecycle.

Project Management

The Contractor shall provide project management support necessary to plan, coordinate, manage, report, and deliver the services and capabilities detailed in the contract. The Contractor shall provide sufficient personnel supervision and quality control measures to ensure that required services are performed in accordance with contracted deliverables, milestones, performance standards, and specifications. Project Management will ensure EPLC is followed and deliverables are met within the project management plan’s specifications and timeline. PM would facilitate and run the requirements gathering and status meetings and they will lead the effort to mitigate and risks that are presented. PM will communicate and set expectations with stakeholders based on the tool limitations and the level of effort that will be required for customization and they will also act as the main liaison between the vendor team and any government groups that they will need to with to accomplish the project. The Contractor shall also develop and maintain all required EPLC documentation and project documentation identified in the contract deliverables.

Representative activities include:

· Contract administration and staffing.

· Develop and maintain the Program/Project Management Plans, including Transition, Integration, Quality, schedule, deliverable, and cost components and subsidiary plans (e.g., Risk Management, Communications, etc.).

· Develop and maintain the Work Breakdown Structure/Project Schedule.

· Hold Kick off meeting within one week of contract award. Contractor shall work with COR to establish this.

· Develop and maintain PPA and PMP. Both documents will be negotiated within the first 30 days after award and presented to the COR and ITPM with a milestone schedule for execution.

· Mange activities to stay on budget.

· Lead and/or participate in Project briefings, meetings, and other interactions with multiple government points of contact for specific tasks regarding project progress, issues, and concerns as directed by the COR. These meetings are estimated to be for one hour, once a week (or as directed by the COR). It is estimated that during the beginning of the contract, these meetings will occur twice a week.

· Provide documentation of risks and known issues and plans to mitigate identified risks and known issues.

· Contractor staff shall participate in developing the content for the following documents. The FDA will provide resources to manage the documents identified below and maintain them in the FDA configuration management tool. Document include: Project Process Agreement, Work Breakdown Structure (WBS), Release Schedule, Migration Plan, Risk Management Plan, Training Plan, Training Manual, Implementation/Integration Plan, Operations and Maintenance Charter, Master Test Plan, Test scripts and test data, Logical/Physical Data Model and Data Dictionary, User Manual, System Architecture Document, System Error Codes, Installation Guide, Known Issues List and Bug List, Quality Management Plan.

· Ensure work is performed within the boundaries of the FDA EPLC structure and stage gate review system (See Appendix A).

· Maintain a well-organized, comprehensive repository of all contract documentation in an FDA-approved document repository or elsewhere as directed by the COR.

· The Contractor shall provide a Monthly Status Report which will include: Progress description for each task for the period covered, product/deliverable completion, existing and potential issues/problems, problems and corrective actions taken (including discussion of the adverse or favorable impact on the task and suggested resolutions as appropriate), projected work activities to be accomplished during the next period, Government actions required.

· Project Schedule: The Contractor shall maintain a project schedule. The Contractor shall update the schedule as necessary.

· Execution of Issue Escalation Procedures. The Contractor shall communicate issues related to any impediment to progress toward the deliverables defined in this Statement of Work. The Contractor shall follow escalation procedures consistent with the line of command in OIMT. If Contractor requires clarification on activities being requested during performance, Contractor shall contact the FDA Contracting Officer.

· Contractor shall report any issue that affects cost/scope/schedule immediately to the Office of Acquisition and Grants (OAGS) Contracting Officer. The Contractor is obligated to escalate issues for resolution before impact on cost or schedule baseline. The Contractor shall use the escalation procedure for all clarifications of FDA project management direction under this SOW.

· Upon discovery of an issue, the Contractor shall provide progress reports, as requested, to the FDA COR and OAGS Contracting Officer until the issue is resolved.

· The Contractor shall submit a Final Deliverables Report upon completion of all components of the contract. The Contractor shall maintain up-to-date records of all work results, developments, and accomplishments for the preparation of the report. The Final Deliverables Report shall include descriptions of all documentation, processes, techniques, models, studies, code and procedures developed under this task order.

Service Level Agreements / Problem Resolution

The Contractor shall follow FDA procedures (COR to provide at contract award) to address issues with the EMu software and to schedule Emergency Software Releases, if and when needed. The Contractor will provide PM and Technical resources who shall be working with the FDA Center IT Leads, Project Manager or the COR for problem resolution. To address general questions, requests for FDA information, documentation questions, enhancement requests posed by the Government, the contractor shall have a designated support desk / help desk available while the Government is open and operational. The FDA will use FDA internal tools, such as JIRA/HPSM (currently) and ServiceNow (in future) to track and monitor contractor response times.

The table below shows the Service Level Agreements the contractor is expected to meet:

For this level, acknowledgment notification is required, as well as a status of the issue, the action that is being taken to resolve the issue, and the ETA

NA

Note: Business day is any day the Government is open and operational.

Deliverables

All deliverables listed below are to be delivered to the COR or designee at the frequency/due dates specified. The Contractor shall provide an electronic copy of all deliverables to the FDA PM, or COR or designee. All deliverables shall be provided in their native format (e.g., MS Project, Visio, Excel, PowerPoint, ERwin, etc.) in addition to PDF, if requested.

The COR and/or Designees will review and provide comments back on deliverables within ten (10) working days of receipt. The Contractor will have five (5) working days to incorporate the FDA’s comments and resubmit to the COR. This 10/5 day review cycle will repeat until Government acceptance of a deliverable.

NOTE: If the due date of a deliverable occurs on a weekend or a Government holiday, the due date is automatically extended to the following government business day.

The following table is a summary of the deliverables required under this award. The frequency provided below is an estimate only and will be negotiated upon contract award between the COR and the Contractor.

Project Schedule

Submit draft with the proposal, finalized version within one month of award

COR/COR Designee

Kickoff Meeting

Within 7 days of award

COR

Project Process Agreement

Within 30 days of award

Work Breakdown Structure(WBS)

Project Management Plan

COR

Release Schedule

To be negotiated by ITPM as part of PMP

COR

Implementation/Integration Plan

COR

Logical/Physical Data Model and Data Dictionary

COR

Monthly Status Reports

Monthly

COR

Training Plan

90 days after award

COR

Training Manual

1 week after successful completion of UAT

COR

User Manual

2 weeks prior to training

COR

Job Aid

2 weeks prior to training

COR

Risk Management Plan

COR

Master Test Plan

90 days after award

COR

Test Scripts

One month before UAT

COR

Version Description Document

COR

Operations and Maintenance Manual

3 Months before end of period of performance

COR

System Error Codes

COR

System Architecture Document

COR

Physical and Logical ERWIN models

COR

Known Issues and Bug List

For every release/upgrade

COR

Server setup and software installation

Within 90 days of contract

COR

Data migration To Be Negotiated with IT PM and Business Owner but to include 3 databases – up to 120 fields and up to 100,000 records.

COR

Migration Plan

6 months after award

COR

Status report Bi-weekly one day prior to the bi-weekly status meeting.

COR

Meeting Minutes, Action items

Bi-weekly, within one day of Status meeting

COR

Project close out

508 Standards Requirements

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase information and communication technologies (ICT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of information and communication technology (ICT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal

Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below.

Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section 508 standards and must apply best practices associated with Section 508 compliance during the application design, development, and testing phases. The Contractor shall utilize FDA approved tools to verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant products.

The following Section 508 standards apply to this Statement of Requirements:

· E101.2 - Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

· E203 - Access to Functionality (Appendix A, Application and Scoping Requirements)

· E204 - Functional Performance Criteria (Appendix A, Application and Scoping Requirements)

· E205 - Electronic Content (Appendix A, Application and Scoping Requirements)

· E207 – Software (Appendix A, Application and Scoping Requirements)

· 302 - Functional Performance Criteria (Appendix C, Application and Scoping Requirements)

· Chapter 5 - Software, to include all WCAG 2.0 A and AA standards (Appendix C, Functional Performance Criteria and Technical Requirements)

· Chapter 6 - Support Documentation and Services (Appendix C, Functional Performance Criteria and Technical Requirements)

· 602 - Support Documentation (Appendix C, Functional Performance Criteria and Technical Requirements)

· 603 - Support Services (Appendix C, Functional Performance Criteria and Technical Requirements)

Security and Privacy Requirements

The Contractor personnel performing work under this contract shall satisfy all requirements for appropriate security eligibility in dealing with access to sensitive information and information systems, per the terms of the contract.

The Contractor shall ensure that the application or system developed complies with OMB, HHS, and FDA policies regarding authentication for internal users utilizing PIV cards and SSO methods. OMB’s memorandum that mandates the use of the PIV card can be found at: http://www.hhs.gov/ocio/policy/implementation_of_hspd-12.html.

To implement guidance provided in the OMB Memorandum 11-11, it is HHS policy that:

· Effective immediately, all new HHS systems under development and subject to the Federal Information Security Management Act (FISMA) prior to being made operational must be enabled to use PIV credentials in accordance with National Institute of Standards and Technology (NIST) guidelines.

· Effective at the beginning of the first quarter of FY 2012, all current FISMA Inventory Systems must be modified to use PIV Credentials. System owners must provide their conformance status and modernizations plans to the OCIO by the end of the fourth quarter of FY 2011.

· Effective immediately, new procurements for HHS services and products involving facility or system access control must be in accordance with HSPD-12 policy and the Federal Acquisition Regulation. To ensure government-wide interoperability, OMB Memorandum 06-18 “Acquisition of Products and Services for Implementation of HSPD-12” requires agencies including HHS to acquire products and services that are approved as compliant with Federal policy, standards, and supporting technical specifications. Ref: ELMS Base Contract SOW, Sec. 4.14 for additional information

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

2) Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

a. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

3) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

4) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII Complete this section using the information obtained from the Security and Privacy Checklist in Appendix A, parts A and B.

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800- 171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.See Appendix D for baseline deliverables.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non- public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or

COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FDA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FDA SMC /Incident Response Team (IRT) teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.” The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by FISMA as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user…