Solicitation for NIHCATS IV 10_23_2023.pdf

- 1 -

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority:

2. Request for Proposal (RFP) Number:

75N98022R00015

3. Issue Date:

4. Set Aside:

[ ] No

[X] Yes See Part IV Section L

5. Title : NIH Conference, Administrative and Travel Services IV (NIHCATS IV)

6. ISSUED BY:

Office of Acquisitions Office of the Director National Institutes of Health 6701 Rockledge Drive Rockledge II- 5th Floor Bethesda, MD 20817

7. SUBMIT OFFERS TO:

See Part IV, Section L, "Instructions, Conditions, and Notices to Offerors” of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Part IV, Section L, "Instructions, Conditions, and Notices to Offerors” of this Solicitation". Offers will be valid for 240 days.

9. This solicitation requires delivery of proposals as stated in Part IV, Section L, "Instructions, Conditions, and Notices to Offerors” of this Solicitation. If proposals are required to be delivered to two different locations, the OFFICIAL POINT OF RECEIPT for determining TIMELY DELIVERY is the address provided for the OFFICE OF ACQUISITIONS.

IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors--Competitive Acquisition," LOCATED IN SECTION L.1. OF THIS SOLICITATION.

10. Offeror must be registered in the System for Award Management (SAM) at https://www.sam.gov/SAM/ prior to award of a contract.

11. FOR INFORMATION:

e-MAIL: nihcatsiv@od.nih.gov

PHONE CALLS WILL NOT BE ACCEPTED.

Chaunda Stewart Contracting Officer Office of Acquisitions https://www.sam.gov/SAM/

RFP Number : 75N98022R00015

- 2 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

SECTION M - EVALUATION FACTORS FOR AWARD

- 3 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS

INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION TO UNDERSTAND THE

TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Institutes of Health (NIH), Office of Logistics and Acquisition Operations (OLAO), through this procurement intends to award multiple Indefinite Delivery, Indefinite Quantity (IDIQ) contracts for acquiring a wide range of conference, administrative, and travel support (domestic and international) services for the NIH, the Department of Health and Human Services (HHS) Operating Divisions (OPDIVS) and on a case-by-case basis, other Federal agencies. The Contractor shall provide all the necessary services, qualified personnel, facilities, and financial capability needed to perform the services required in this Statement of Work (SOW). Through this procurement, the NIHCATS IV contracts will provide customers with improved response time and equitable and reasonable rates. The geographic scope of this requirement includes the United States and abroad.

The final contract will contain the price/cost provisions agreed upon by the Government and the Offeror. See Section J attachment folder for Labor category descriptions for this requirement. Offerors shall submit a loaded ceiling rate for ALL labor categories. No additional labor categories will be added.

ARTICLE B.2. PRICES/COSTS

a. This is a Multiple Award Indefinite Quantity contract as contemplated by FAR 16.504. The Contractor shall be reimbursed by the Government in an amount not less than a total of $250 (minimum) nor more than a total of $100,000,000 (maximum) for successful performance of this contract.

b. The costs set forth in this ARTICLE will cover the contract period January 2, 2024 through January 1, 2029.

c. The Government will compete and award Task Orders based on the work described in SECTION C of this contract.

d. Ordering procedures are described in The TASK ORDER PROCEDURE Article in SECTION G of this contract.

- 4 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. [DESCRIPTION-SPECIFICATION-WORKSTATEMENT-STATEMENT OF WORK]

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, dated April 26, 2022, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

Specific requirements will be determined at the Task Order level and are not known at this time.

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html and at: https://www.section508.gov/create/ documents, "Create Accessible Documents."

a. Technical Progress Reports- Master Contract level

In addition to the required reports set forth elsewhere in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award. [Note: Beginning May 25, 2008, the Contractor shall include the applicable PubMed Central or NIH Manuscript Submission reference number when citing publications that arise from its NIH funded research.]

For proposal preparation purposes only, it is estimated that in addition to the required electronic version(s) 0 hard copies of these reports will be required as follows:

[X] Monthly [ ] Quarterly [ ] Semi-Annually [X] Annually [ ] Annually (with a requirement for a Draft Annual Report) [ ] Final - Upon final completion of the contract [X] Final - Upon final completion of the contract (with a requirement for a Draft Final Report)

Summary of Salient Results

The Contractor will be required to prepare and submit, with the final report, a summary (not to exceed 200 words) of salient results achieved during the performance of the contract. This report will be required on or before the expiration date of the contract.

b. Other Reports/Deliverables- As required at the Task Order level http://www.hhs.gov/web/508/index.html https://www.section508.gov/create/documents https://www.section508.gov/create/documents

- 5 -

1. Source Code and Object Code

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

- 6 -

SECTION D - PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall guarantee that all required materials shall be delivered in immediate usable and acceptable condition.

- 7 -

SECTION E - INSPECTION AND ACCEPTANCE

a. The Contracting Officer or the duly authorized representative will perform inspection and acceptance of materials and services to be provided.

b. For the purpose of this SECTION, To Be Determined at the Task Order Level is the authorized representative of the Contracting Officer.

c. Inspection and acceptance will be performed at:

To Be Determined at the Task Order Level

Acceptance may be presumed unless otherwise indicated in writing by the Contracting Officer or the duly authorized representative within 30 days of receipt.

The Government reserves the right to an Inspection period of 30 calendar days, unless a different time period is stated when (the Record of Call/elsewhere in the contract). The receiving report, completed and signed by the appropriate official, constitutes acceptance and shall be acknowledged to the payment office (OFM).

d. This contract incorporates the following clause by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available.

FAR Clause 52.246-4, Inspection of Services - Fixed Price (August 1996).

FAR Clause 52.246-6, Inspection Time-and Material and Labor Hour (May 2001).

Alternate I (April 1984) is applicable to this contract.

- 8 -

SECTION F - DELIVERIES OR PERFORMANCE

ARTICLE F.1. PERIOD OF PERFORMANCE

The five (5) year Base period of performance of this contract shall be from January 2, 2024 through January 1, 2029.

ARTICLE F.2. DELIVERIES

a. Satisfactory performance of this contract shall be deemed to occur upon performance of the work described in the Statement of Work Article in SECTION C of this contract and upon delivery and acceptance by the Contracting Officer, or the duly authorized representative, of the Services specified in the Delivery Schedule which are described in SECTION C of this contract.

b. Deliveries required by the Contractor shall be made F.o.b. destination as set forth in FAR Clause 52.247-35, F.o.b. Destination, Within consignees Premises (April 1984) [and any specifications stated in SECTION D, PACKAGING AND MARKING AND SHIPPING, of this contract] to the address/addressee listed below:

c. Delivery Address

To Be Determined at the Task Order Level

d. Unless otherwise specified, deliveries shall be made to the Delivery Point specified above Mondays through Fridays (excluding Federal Holidays) between the hours of 8:30 a.m. and 5:30 p.m. EST only. Supplies or services scheduled for delivery on a Federal holiday shall be made the following day.

ARTICLE F.3. TIME OF DELIVERY

a. The Government requires delivery of To be determined at the Task Order level within days after .

b. The Contractor may propose a delivery schedule which is earlier than required above. If the Contractor does not propose a different delivery schedule, the Government's desired delivery schedule shall apply.

c. Proposed Delivery Schedule: Delivery of To be determined at the Task Order level within days after

ARTICLE F.4. CLAUSES INCORPORATED BY REFERENCE, FAR 52.252-2 (FEB 1998).

This contract incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the Contracting Officer will make its full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/?q=browsefar.

FEDERAL ACQUISITION REGULATION (48 CFR CHAPTER 1) CLAUSE:

52.242-15, Stop Work Order (August 1989)

Alternate I (April 1984) is not applicable to this contract.

52.242-17, Government Delay of Work (April 1984).

52.211-11, Liquidated Damages--Supplies, Services or Research and Development (September 2000).

"(a) If the Contractor fails to deliver the supplies or perform the services within the time specified in this contract, the Contractor shall, in place of actual damages, pay to the Government liquidated damages.

https://www.acquisition.gov/?q=browsefar

- 9 -

SECTION G - CONTRACT ADMINISTRATION DATA

ARTICLE G.1. CONTRACTING OFFICER REPRESENTATIVE (COR)

The following Contracting Officer Representative (COR) will represent the Government for the purpose of this contract:

The COR will be identified at the time of award.

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

[The alternate COR is responsible for carrying out the duties of the COR only in the event that the COR can no longer perform his/her duties as assigned.]

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

The Government may unilaterally change its COR designation.

ARTICLE G.2. KEY PERSONNEL, HHSAR 352.237-75 (December 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties. The Program Manager (PM) and Deputy Program Manager (DPM) are at the Master Contract level and serve as the primary points of contact between NIH and the contractor. However, any work completed by the PM and DPM will not be billed to the government.

(End of Clause)

The following individual(s) is/are considered to be essential to the work being performed hereunder:

Name Title

Program Manager

Deputy Program Manager

ARTICLE G.3. TASK ORDER PROCEDURE

This contract provides for the issuance of Task Orders on a negotiated basis as follows:

a. General

- 10 -

Only the Contracting Officer may issue Task Orders to the Contractor, providing specific authorization or direction to perform work within the scope of the contract and as specified in the Statement of Work. Unless specifically authorized by the Contracting Officer, the Contractor shall not commence work until a fully executed Task Order has been awarded. The Contractor may incur costs under this contract in performance of task orders and task order modifications issued in accordance with this ARTICLE.

No other costs are authorized unless otherwise specified in the contract or expressly authorized by the Contracting Officer.

b. Requesting Task Order Proposals.

The Contracting Officer or a designated individual may solicit responses to requirements from Contractors in writing. A Task Order Request for Proposals (TORFP) will be prepared and issued for each task order requirement.

Generally, the Task Order Request for Proposal (TORFP) will include but is not limited to the following:

1. Statement of Work;

2. Reporting Requirements and Deliverables;

3. Proposal Due Date and Location to Deliver Proposals;

4. Period of Performance of Task Order;

5. Anticipated type of Task Order;

6. Technical Proposal Instructions;

7. Business proposal Instructions

8. Evaluation Factors for Award

All contract clauses contained this contract shall be incorporated in the TORFP and the resultant task order.

If conflicts exist between the contract clauses and the information outlined in the task order, the contract language takes precedence over the information in the task order.

Contractors are not required to propose on all TORFPs. Those eligible Contractors that decide not to submit a proposal shall advise the Contracting Officer, in writing, of their intention not to submit a proposal on or before the closing date and time established in the TORFP. An election not to propose on a given TORFP will not negatively affect or prohibit a Contractor from competing on future TORFPs. However, it may affect the Contractor's eligibility for continuations or extensions of the resultant Task Order.

c. Competitive Ordering Process.

1. All Contractors will receive e-mail notification advising of the availability of each proposed task order requirement. All proposed task orders will incorporate all terms of this contract unless otherwise specified in the proposed task order.

2. Contractors will be provided an adequate time to prepare and submit responses based on the Contracting Officer's consideration of the estimated dollar value and complexity of proposed task order. Responses will not be considered a proposal as defined in FAR Part 15. However, the Contractor shall provide information sufficient for consideration in accordance with FAR Part 16. Each TORFP will indicate the criteria for the evaluation of proposals. The responses shall demonstrate capability for each criterion to be evaluated.

Generally, the Contractor will be asked to demonstrate the following as appropriate:

● Understanding of the requirements;

- 11 -

● Experience and capability on similar tasks;

● Technical approach, methods and procedures for satisfying the requirements with a discussion of potential problems to be encountered and proposed solutions and/or risk mitigation strategies;

● Procedures for assuring quality of work, products, and deliverables;

● Plan for managing the task order, including meeting requirements and schedules, and performance measures (if applicable);

● Staffing plan with skill levels and level of effort for each individual proposed. Generally, resumes will be required for proposed personnel (if not previously submitted);

● References to evaluate past performance; and

● Cost/Price to perform the task order.

d. Evaluation and Award of Task Order Proposals

The Government will evaluate the Task Order proposals against the requirements of the TORFP.

Specifically, the technical evaluation factors, cost/price, past performance and any other factor specifically identified in the TORFP will be used for evaluation of each proposal. In addition, the TORFP will identify the basis for selecting a Contractor for award. Generally, technical factors will be significantly more important than cost or price However, each TORFP will specify how the award decision will be made.

Upon completion of evaluations, the Contracting Officer will issue a task order to the Contractor whose proposal is most advantageous to the government

The Contracting Officer will notify the Contractor(s) of the selection decision in writing.

e. Fair Opportunity

1. In accordance with FAR 16.505(b)(1)(i), each awardee will be given a fair opportunity to be considered for each order issued exceeding the micro-purchase threshold issued under multiple delivery-order contracts or multiple task-order contracts, except:

i. The agency need for the supplies or services is so urgent that providing a fair opportunity would result in unacceptable delays.

ii. Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.

iii. The order must be issued on a sole-source basis in the interest of economy and efficiency because it is a logical follow-on to an order already issued under the contract, provided that all awardees were given a fair opportunity to be considered for the original order.

iv. It is necessary to place an order to satisfy a minimum guarantee.

2. All awardees will be given a fair opportunity to be considered in accordance with the FAR as follows:

i. For orders exceeding the micro-purchase threshold up to the simplified acquisition threshold, in accordance with FAR 16.505(b)(1)(ii);

ii. For orders exceeding the simplified acquisition threshold up to $6 Million, in accordance with 16.505(b)(1)(iii); and,

iii. For orders exceeding $6 Million, in accordance with FAR 16.505(b)(1)(iv).

a. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

- 12 -

ARTICLE G.4. INVOICE SUBMISSION

a. The Contractor shall follow the attached instructions and submission procedures specified below to meet the requirements of a "proper invoice" pursuant to FAR Subpart 32.9, Prompt Payment. The Contractor shall submit invoices to the Department of Treasury’s Invoice Processing Platform (IPP) at https:// www.ipp.gov with a copy to the Task Order COR and copy to the Task Order Contract Specialist/ Contracting Officer. See Section J for Invoice Instructions. If these invoice instructions are not followed it will delay processing of the Contractors’ invoices.

b. Inquiries regarding payment of invoices shall be directed to the designated billing office, (301) 496-6088.

ARTICLE G.5. ON-SITE CONTRACTOR ACCESS TO GOVERNMENT PROPERTY

The Contractor shall be held responsible for Government Property, regardless of dollar value, when:

● The contract requires Contractor personnel to be located on a Government site or installation;

● The property utilized by Contractor personnel is incidental to the place of performance; and,

● The property used by the Contractor remains accountable to the Government

Responsibility includes physical presence, proper use and handling, normal maintenance, and reporting loss, damage or destruction.

Responsibility for government property shared by two or more Contractors or located in space shared by two or more Contractors, shall be determined and documented by the contractors involved. In cases where the parties cannot reach agreement on shared responsibility, the matter will be referred to the NIH Property Officer for resolution.

ARTICLE G.6. POST AWARD EVALUATION OF CONTRACTOR PERFORMANCE

a. Contractor Performance Evaluations

Interim and Final evaluations of Contractor performance will be prepared on this contract in accordance with FAR Subpart 42.15. Contractor performance at the master contract level will be monitored in accordance with the Quality Assurance Surveillance Plan (QASP) in Section J. The Final performance evaluation will be prepared at the time of completion of work. In addition to the Final evaluation, Interim evaluation(s) will be prepared Annually as follows on one year after award date.

Interim and Final evaluations will be provided to the Contractor as soon as practicable after completion of the evaluation. The Contractor will be permitted thirty days to review the document and to submit additional information or a rebutting statement. If agreement cannot be reached between the parties, the matter will be referred to an individual one level above the Contracting Officer, whose decision will be final.

Copies of the evaluations, Contractor responses, and review comments, if any, will be retained as part of the contract file, and may be used to support future award decisions.

b. Electronic Access to Contractor Performance Evaluations

Contractors may access evaluations through a secure Web site for review and comment at the following address:

https://www.cpars.gov

ARTICLE G.7. GOVERNMENT PROPERTY

If this RFP will result in the acquisition or use of Government Property provided by the contracting agency or if the Contracting Officer authorizes in the preaward negotiation process, the acquisition of property (other than https://www.ipp.gov/ https://www.ipp.gov/ https://www.cpars.gov

- 13 -real property) this ARTICLE will include applicable provisions and will incorporate the HHS Publication, entitled, "HHS Contracting Guide for Contract of Government Property," which can be found at https://web.archive.org/ web/20111015044731/http:/www.hhs.gov/hhsmanuals/ .

https://web.archive.org/web/20111015044731/http:/www.hhs.gov/hhsmanuals/ https://web.archive.org/web/20111015044731/http:/www.hhs.gov/hhsmanuals/

- 14 -

SECTION H - SPECIAL CONTRACT REQUIREMENTS

ARTICLE H.1. CORONAVIRUS DISEASE 2019 (COVID-19) - HHS RECOVERY EFFORTS

“HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A—Health Resources Priorities and Allocations System.”

ARTICLE H.2. CORONAVIRUS DISEASE 2019 (COVID - 19) - ONSITE CONTRACTORS

RETURN TO PHYSICAL WORKSPACE

Coronavirus disease 2019 (COVID-19) - NIH policy may allow for voluntary or mandatory COVID-19 testing for contractor personnel. Contractor personnel who test positive for COVID-19 or who do not wish to submit to mandatory COVID-19 testing will not have access to or be permitted to work in NIH [ICs] until they have satisfied the access requirements in the NIH policy. A contractor personnel's decision to opt out of mandatory COVID-19 testing will not automatically constitute grounds for any performance delays or establish any government liability for additional costs.

The Contracting Officer may determine that an excusable delay is appropriate under applicable FAR clauses (e.g., 52.242-14 (Suspension of Work), 52.242-15 (Stop-work Order), 52.249-14 (Excusable Delays), and 52.212-4(f) (Excusable Delays)) in cases where a positive test result is recorded and contract personnel must be quarantined due to an exposure to COVID-19. However, cases where a positive test result is recorded will not establish any government liability for additional costs.

Contractors shall ensure compliance with all Federal, HHS, NIH and individual IC COVID-19 policies related to health and safety, including relevant Codes of Conduct and reporting requirements applicable to contractor personnel. The Contractor shall discuss the Code of Conduct with contractor personnel, retain signed Codes of Conduct, and confirm their signature with the Contracting Officer. Reporting requirements include: 1) Ensure open reporting of safety and health related concerns; 2) Ensure staff understand reporting of COVID-like symptoms to contract supervisors, if they have had a high-risk exposure to someone with COVID disease, or if they have tested positive for COVID-19, and that staff do not report to the workplace with symptoms or if they have tested positive for COVID-19; 3) Ensure staff are complying with the return to work plans, policies and reporting requirements and enforcing these requirements when necessary; and 4) Ensure contract supervisors inform the Contracting Officer of personnel with COVID-19 symptoms.

The Return-to-Work Guidance and Code of Conduct for On-Site Contractors (Appendix 1) are incorporated into this contract. Contractors shall ensure contract personnel are aware they are to contact their company/supervisor for guidance.

Testing conducted by the NIH Occupational Medical Service (OMS) falls within Privacy Act System of Records Notice (SORN), 09-25-0105, Administration: Health Records of Employees, Visiting Scientists and Others Who Receive Medical Care through Employees Health Unit, HHS/NIH/ORS.

Information regarding the Countermeasures Injury Compensation Program under the Health Resources and Services Administration is available at 1-855-266-2427 or http://www.hrsa.gov/cicp/.

(If your IC is not doing testing through CC OMS, the IC would they have to identify another SORN and incorporate prior to beginning any testing)

ARTICLE H.3. ACKNOWLEDGEMENT OF FEDERAL FUNDING

The Contractor shall clearly state, when issuing statements, press releases, requests for proposals, bid solicitations and other documents describing projects or programs funded in whole or in part with Federal money: (1) the percentage of the total costs of the program or project which will be financed with Federal money; (2) the dollar amount of Federal funds for the project or program; and (3) the percentage and dollar amount of the total costs of the project or program that will be financed by nongovernmental sources.

http://www.hrsa.gov/cicp/

- 15 -

ARTICLE H.4. DISSEMINATION OF FALSE OR DELIBERATELY MISLEADING INFORMATION

The Contractor shall not use contract funds to disseminate information that is deliberately false or misleading.

ARTICLE H.5. PRIVACY ACT, HHSAR 352.224-70 (December 2015)

This contract requires the Contractor to perform one or more of the following: (a) Design; (b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.

The term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).

The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in CFR 45 part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records [5 U.S.C. 552a(m)(1)]. The contract work statement:

(a) identifies the system(s) of records and the design, development, or operation work the Contractor is to perform;

and

(b) specifies the disposition to be made of such records upon completion of contract performance.

ARTICLE H.6. OMB CLEARANCE

In accordance with HHSAR 352.211-3, Paperwork Reduction Act, the Contractor shall not proceed with surveys or interviews until such time as Office of Management and Budget (OMB) Clearance for conducting interviews has been obtained by the Contracting Officer Representative (COR) and the Contracting Officer has issued written approval to proceed.

ARTICLE H.7. RESTRICTION ON PORNOGRAPHY ON COMPUTER NETWORKS

The Contractor shall not use contract funds to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography.

ARTICLE H.8. GUN CONTROL

The Contractor shall not use contract funds in whole or in part, to advocate or promote gun control.

ARTICLE H.9. OPTION PROVISION

Unless the Government exercises its option pursuant to the Option Clause set forth in SECTION I., the contract will consist only of the Base Period of the Statement of Work as defined in Sections C and F of the contract. Pursuant to FAR Clause 52.217-9, Option to Extend the Term of the Contract set forth in SECTION I. of this contract, the Government may, by unilateral contract modification, require the Contractor to perform additional options set forth in the Statement of Work and also defined in Sections C and F of the contract. If the Government exercises this option, notice must be given at least 60 days prior to the expiration date of this contract, and the rates of the contract will be increased as set forth in Section B of the contract.

ARTICLE H.10. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT

PROCUREMENTS

- 16 -

ARTICLE H.10.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

● Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

● Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

● Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

■ Confidentiality: [ ] Low [X] Moderate [ ] High

■ Integrity: [ ] Low [X] Moderate [ ] High

■ Availability: [ ] Low [X] Moderate [ ] High

■ Overall Risk Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

- 17 -

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/ NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, system/ data owner, or other security or privacy representative, it has been determined that this solicitation/ contract involves:

[X] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis ( PTA) for the information system and/ or information handled under this contract to determine whether or not a full Privacy Impact Assessment ( PIA) needs to be completed.

■ If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

■ The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term " handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323.

The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or

- 18 -

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/ sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents. NIH will specify which documents/forms will be provided to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

- 19 -

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 days of the validation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement, https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf, as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role- based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role- Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-based Training at: https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html.

c. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

http://csrc.nist.gov/publications/ http://irtsectraining.nih.gov/ https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html

- 20 -

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the Contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. In accordance with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized…