Solicitation_HT942726RE005_2026.06.08.pdf

HT942726RE005

This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in FAR subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation;

proposals are being requested, and a written solicitation will not be issued. The solicitation number is HT942726RE005. The solicitation is issued as a Request for Proposal (RFP).

Provisions and clauses in effect through Federal Acquisition Circular (FAC) 2026-01 are provisions. The clauses may be accessed in full text at these addresses:

https://www.acquisition.gov/content/regulations. The NAICS code is 513210 (Software Publishers), with a small business size of $47.0M. This requirement is being solicited competitively as a 100% total small business set-aside in accordance with FAR 12, Acquisition of Commercial Products and Services and FAR 13, Simplified Acquisition Procedures.

The Defense Health Agency Contracting Activity (DHACA) is issuing this RFP on behalf of the Enterprise Information Technology (eIT) Project Management Office (eIT PMO). This requirement is for Electronic Common Technical Document (eCTD) Software License, Maintenance, Technical Support Services, and Training for eCTD Publishing and Reviewing Software Products and Modules.

Solicitation Issue Date: 08 Jun 2026

Questions Due Date/Local Time: 11 Jun 2026, 04:00 PM Easter Daylight Time (This is the correct due date/time. Please note that this due date/time conflicts with the information listed on page 107 of the solicitation.)

Offer Due Date/Local Time: 06 Jul 2026, 4:00 PM Eastern Daylight Time

NOTE: Please be aware of the System for Award Management (SAM) and Cybersecurity Maturity Model Certification (CMMC) requirements for this solicitation. Do not wait to initiate these processes.

Solicitation/Contract Form eCTD Software Licenses, Maintenance, Technical Support Services, and Training for eCTD Publishing and Reviewing Software Products and Modules

Product Service Code: 7B22

Supplies or Services & Prices or Costs Additional Information/Notes

Item Supplies / Services Quantity Unit Unit Price Amount

Software Licenses/Subscription (Base Year). Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Annual Software Maintenance Support (Base Year). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Technical Support (Base Year).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Training (Base Year). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Travel (Base Year). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

FDA Mandated Submission Template.

Contractor shall provide product in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

FDA Mandated Submission Template Annual Maintenance (Base Year).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

FDA Mandated Submission Template Technical Support. Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Service Contract Reporting (Base Year). See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 1 Software Licenses/Subscription (Option Year 1). Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 1 Annual Software Maintenance Support (Option Year 1). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 1 Technical Support (Option Year 1).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 1 Training (Option Year 1).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 1 Travel (Option Year 1). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 1 Service Contract Reporting (Option Year 1). See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 2 Software Licenses/Subscription (Option Year 2). Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 2 Annual Software Maintenance Support (Option Year 2). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 2 Technical Support (Option Year 2).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 2 Training (Option Year 2).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 2 Travel (Option Year 2). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 2 Service Contract Reporting (Option Year 2). See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 3 Software Licenses/Subscription (Option Year 3). Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 3 Annual Software Maintenance Support (Option Year 3). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 3 Technical Support (Option Year 3).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Period 3 Training (Option Year 3).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 3 Travel (Option Year 3). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 3 Service Contract Reporting (Option Year 3). See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 Software Licenses/Subscription (Option Year 4). Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 Annual Software Maintenance Support (Option Year 4). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 Technical Support (Option Year 4).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 Training (Option Year 4).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 4 Travel (Option Year 4). Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Period 4 FDA Mandated Submission Template (anticipate FDA release of new mandated template version).

Contractor shall provide product in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 FDA Mandated Submission Template Technical Support (anticipated new FDA mandated template version will require additional configuration).

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 4 Service Contract Reporting (Option Year 4). See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 5 Software Licenses/Subscription (6M Ext). Six-month extension IAW FAR 217-8. Contractor shall supply software licenses in accordance with the PWS and Contractor's proposal.

Company Part Number: TBD Product Service Code: 7B22 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 5 Annual Software Maintenance Support (6M Ext). Six-month extension IAW FAR 217-8. Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 5 Technical Support (6M Ext).

Six-month extension IAW FAR 217-8.

Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Option Line Item

Option Period 5 Training (6M Ext). Six-month extension IAW FAR 217-8. Contractor shall provide services in accordance with the PWS and Contractor's proposal.

Product Service Code: U012 Pricing Arrangement: Cost No Fee

1 Job

Option Line Item

Option Period 5 Travel (6M Ext). Six-month extension IAW FAR 217-8. Contractor shall provide services in accordance with the PWS and Contractor's proposal.

1 Job

Product Service Code: U012 Pricing Arrangement: Cost No Fee

Option Line Item

Option Period 5 Service Contract Reporting (6M Ext). Six-month extension IAW FAR 217-8. See Service Contract Reporting (SCR) Clause for more information.

Product Service Code: DH10 Pricing Arrangement: Firm Fixed Price

1 Job

Description/Specifications/Statement of Work

PART 1

1. GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Electronic Common Technical Document (eCTD) software license and templates, maintenance, technical support services, and training for eCTD publishing and reviewing software products and modules.

1.2 Description of services/introduction:

The Contractor shall provide commercial off-the-shelf (COTS) eCTD publishing and reviewing software licenses, non-personal services necessary to perform eCTD software license, maintenance, technical support services, and training for eCTD publishing and reviewing software products and modules as defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services. The Contractor shall perform to the standards described in this PWS.

1.3 Background:

The eCTD Publisher System is intended for use by eIT PMO customers/user base for preparation and lifecycle maintenance of electronic regulatory submissions originating from the Army Office of the Surgeon General (OTSG) sponsored investigational product development. The critical function of the system is the ability to generate electronic regulatory submissions. In addition, the system shall have the ability to automate workflow steps required to manage preparation of electronic submissions for submission to regulatory agencies (e.g., the U.S. Food and Drug Administration [FDA]).

1.4 Objectives:

The eCTD publishing system shall be used for:

-Preparation and lifecycle maintenance of electronic regulatory submissions -Greater efficiency within regulatory submissions by reducing manual publishing steps, minimizing rework, and decreasing submission preparation timelines -A higher level of compliance with applicable regulations through system validation, standardized templates, and automated validation checks The eCTD publishing system shall have the ability to:

-Scale to support increases in the number of electronic regulatory submissions resulting from expanding clinical trial activities, including multiple concurrent preparation and review activities, without degradation of system performance -Provide seamless access to third parties (e.g., external regulatory reviewers, CROs, etc.)

-Integrate the eCTD publishing system with other key Defense Health Agency (DHA) systems (e.g., Open Text - Content Server)

1.5 Scope:

The eIT PMO needs to acquire software licenses and maintenance for twelve (12) eCTD Publisher user accounts and up to fifty (50) named eCTD reviewer accounts. Additional services required are FDA-mandated submission templates, technical support services for resolving application problems, training services for both the eCTD publishing and reviewing users, FDA-validated software installation support and scripts, and non-personal services to support regulatory questions by eCTD publishers.

1.6 Period of Performance:

The anticipated period of performance of this contract is 15 July 2026 through 14 January 2032. There will also be four (4) one-year renewable options and a six (6) month extension to be exercised at the discretion of the Government (total potential of a five-and-one-half-year (5.5 year) contract).

-Base Period: 15 July 2026 - 14 July 2027 -Option Period 1: 15 July 2027 - 14 July 2028 -Option Period 2: 15 July 2028 - 14 July 2029 -Option Period 3: 15 July 2029 - 14 July 2030 -Option Period 4: 15 July 2030 - 14 July 2031 -6-month extension: 15 July 2031 - 14 Jan 2032 The Contract Specialist will notify the Contractor of the intent to exercise an option year 90 calendar days before the option is to be exercised.

1.7 Administrative specifications:

Place of performance: The work shall be performed remotely.

1.7.1 Recognized Federal holidays:

Contractor is not required to perform on the following holidays:

New Year's Day Labor Day Martin Luther King Jr.'s Birthday Columbus Day President's Day Veteran's Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.2 Hours of operation:

The Contractor is responsible for conducting business Monday through Friday, except for federal holidays. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

1.7.3 Emergency Services:

On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Contractor travel:

(Reimbursable) Travel cost estimate for in-person trainings or for technical consulting support held at Fort Detrick to fully support end users and administrators. See PWS Sections 5.3 (Task 3: Training Consulting and Technical Support Services) 5.4 (Task 4: Travel).

1.9 Other Direct Costs (ODC): The Government intends to utilize "Plugged" Not-to-Exceed (NTE) amount for all ODCs listed.

1.10 Quality

1.10.1 Quality Control (QC):

The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor's QC program is how the work complies with stated requirements. A Quality Control Plan (QCP) (Deliverable 1) will initially be submitted NLT thirty (30) calendar days after contract award (DACA). After acceptance of the QCP, the Contractor shall receive the CO's acceptance in writing of any proposed change to the QC system.

1.10.2 Quality assurance (QA):

The Government will evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor Personnel

1.11.1 Data rights:

The Government will have unlimited data rights to all products modified or support provided to COTS systems.

1.12 Reporting

1.12.1 Service Contract Reporting (SCR):

Service contractor reporting of information is required in the System for Award Management (SAM) for:

-Contract Awards, no IDVs -Contract Awards include purchase orders, delivery/task orders, BPA calls, and definitive contracts -Service Contracts, i.e., any PSC that starts with a letter excluding utility PSCs (S110, S111, S112, S114, and S119) -All cost-reimbursement, time-and-materials, and labor-hour service contracts with an estimated total value > $150,000 and base date signed is between 10/1/13 and 9/30/18.

-Fixed Price Contracts: If the contract's base date signed AND base effective date is between 10/01/2013-09/30/2014, the total contract value must be >= $2.5M -Fixed Price Contracts: If the contract's base date signed AND base effective date is between 10/01/2014-09/30/2015, the total contract value must be >= $1M -Fixed Price Contracts: If the contract's base date signed AND base effective date is between 10/01/2015-09/30/2018, the total contract value must be >= $500,000

Steps for Submitting a Service Contract Report (SCR)

1. Go to www.sam.gov and log in.

2. Select Entity Registrations and then select Service Contract Reporting.

3. SAM displays your entities which have service contracts and meet the reporting criteria. Select View by entity to see the service contracts for each entity.

4. Next, select Add for the service contract against which you want to create a Service Contract Report. Each service contract which meets the FAR Subpart

4.1703 reporting thresholds is displayed.

5. You will be taken to the Complete Service Contract Report page. SAM displays the contract details and allows you to report. You are required to enter the following information:

-Total Amount Invoiced: Total dollar amount invoiced for services performed during the previous Government fiscal year under the contract (this amount should include the prime and any subcontract amount).

-Prime Contractor Hours Expended: Prime contractor direct labor hours expended on the services performed during the previous Government fiscal year. The amount you enter is automatically divided by 2,080 hours to calculate a Full Time Employee (FTE) equivalent, displayed under the Prime Contractor Hours Expended as Prime Contractor FTEs.

6. Report any required Tier 1 subcontractor information by selecting the Add Tier 1 Subcontract Information button.

7. When you are ready to submit the report, select Submit. This saves your report and returns you to the Select Service Contract page where you can create other SCRs or edit an existing SCR.

1.12.2 Non-Disclosure Agreement (NDA):

All Contractor personnel who obtain and/or will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) (Deliverable 2) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all assigned staff (including all other personnel performing on contract/task order) execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. The NDA shall be executed no later than the first day of employment and is to be renewed upon exercising a contract option period. Assignment of staff who have not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally-signed NDAs of individual employees and provide copy to the COR.

1.12.3 Government's COR:

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notify both the CO and Contractor of any deficiencies; coordinate availability of Government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

-Provide the COR and contract specialist with a monthly status report (Deliverable 3) via email submitted by the 5th calendar day of each month. This report shall address each element of the QASP for ease of COR evaluation and will include status of all work in progress, as well as track work which has been requested by eIT PMO, but which has not yet been performed. The monthly report shall include cost estimates for any such work.

-Provide the COR a monthly project burn report (Deliverable 4) including funds remaining on each CLIN, estimates for outstanding invoices (for work that has been performed but not yet invoiced), and estimates for outstanding invoices. Provide this report via email submitted by the 5th calendar day of each month.

-Provide ad-hoc reporting completely and accurately if additional information is requested or more explanation is needed.

-Perform data analyses and ad hoc reporting to support the eIT PMO management activities such as briefing materials, reports, taskers, memos, procedures, etc.

-All vendor-supplied documents must be converted to eIT PMO approved template/format prior to delivery/demonstration to the customer.

1.12.4 Post award conference/periodic progress meetings:

The Contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart

42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.13 Contractor Identification

1.13.1 Contractor personnel performing services in a Contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All Contractor personnel shall identify themselves as Contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition & Sustainment (DAD A&S)/Head of the Contracting Activity (DHACA) has business dealings. The Contractor shall:

-Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is Contractor support personnel -Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD A&S understands that the person is Contractor support personnel -Include a title block in all emails that states the fact that the person is Contractor support personnel -Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD A&S/DHACA understands that the person is Contractor support personnel

1.13.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

1.13.3 Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.14 Contractor Access to Health Affairs (HA)/DHA Network(s): RESERVED

1.15 Personal Security

1.15.1 The Contractor shall comply with DoD 8570.01-M, "Information Assurance Workforce Improvement Program, CH4" November 10, 2015 as amended;

8500.01, "Cybersecurity", dated March 14, 2014; DoD Manual (DoDM) 6025.18, "Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs", dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 "HIPAA Privacy Rule Compliance in DoD Health Care Programs", dated March 13, 2019; and DoDM 5200.02 "Procedures for the DoD Personnel Security Program (PSP)," incorporation change three (3), effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.15.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.15.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Controlled Unclassified Information (CUI).

1.15.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a Contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing-off on any access request.

PART 2

2. DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/ INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer's Representative (COR): An individual, including a contracting officer's technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: A contract under which the personnel rendering the services are not subject, either by the contract's terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government's consideration in development of the Government's plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CONUS Continental United States (excludes Alaska and Hawaii) CO Contracting Officer(s) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CS Contract Specialist CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DA Days After DACA Days After Contract Award DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DoW Department of War DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate

IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology NLT No Later Than OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SAS Statistical Analysis System SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

PART 3

3. GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1 Services:

The Government:

XXWill NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below:

3.2 Facilities:

The Government:

XXWill NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

3.3 Utilities:

The Government:

XXWill NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.4 Equipment:

The Government:

XXWill NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application:

The Contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the Contractor's responsibilities regarding GFP can be found at the following website: https:// dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office's responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/ task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the Contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key Contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, Contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the Contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The Contractor shall report, on a semi-annual basis, 100% inventories, reconciliations, and final disposition of GFP provided by the Government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance.

3.5 Materials:

The Government:

XXWill NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

PART 4

4. CONTRACTOR FURNISHED ITEMS

4.1 Services:

The Contractor:

Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

XXWILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below:

See PART 5.0 Specific Tasks

4.2 General:

The Contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: n/a

4.4 Materials: n/a

4.5 Equipment: n/a

4.6 Facilities: n/a

PART 5

5. SPECIFIC TASKS

5.1 Task 1: Software Maintenance

(FFP) The Contractor shall provide software licenses and maintenance for the licenses and templates listed below:

-Twelve (12) eCTD Publishing User Licenses -Fifty (50) named eCTD Reviewing User Licenses (concurrent users) -eCTD FDA Template Licensing shall also include:

-The ability to perform hyperlinking within the publishing application -The ability to do submission validation -Validation Test scripts for the initial version and future versions of both eCTD Publishing software and eCTD Reviewing software

5.2 Task 2: Consulting and Technical Support Services

(Reimbursable) Consulting and Technical Support services requested shall include:

Standard eCTD Software Project Management:

The Contractor shall work collaboratively with the eIT PMO staff on remediation of network security vulnerabilities discovered during evaluation testing to achieve a secure software installation which is required to maintain the software on a Department of War (DoW) network. The Contractor shall provide necessary support and communication to schedule and provide all services.

Technical and Regulatory Services:

The Contractor shall provide technical support for installation, upgrades, and validation support for all software maintained under this contract on an as-needed basis. Technical support services are required for but not limited to:

-Project Management -Regulatory Services -Installation of eCTD software products -Pre-installation and installation testing -Validation support - scripts included -eCTD Software Upgrade Support Installation, Testing, Configuration, Migration, Validation, etc.:

The Contractor shall work collaboratively with eIT PMO staff on the installation, configuration, upgrades and data migration of eCTD software products, modules, and data into two (2) computing environments (test and production) in a data center or in a cloud environment. This will include the development/modification of installation instructions to allow the products to function within the parameters specified for DoW installations.

The Contractor shall provide technical support and documentation for testing and validation of the products. Documents to be generated, authored/updated, and provided shall include the following on an as needed basis:

a. Master Validation Plan (MVP)

b. Design Specifications

c. Validation Test Plan for Installation Qualification (IQ) based on vendor provided templates

d. Validation source book for Installation Qualification (IQ)/Operational Qualification (OQ)/Performance Qualification (PQ)

e. Modification of standard IQ test scripts for eIT PMO installation

f. System Configuration guide

g. Work instructions and process flow

h. Documents should be provided in Microsoft Word format and be updated for the software version that is being supported

5.3 Task 3: Training Consulting and Technical Support Services The Contractor shall:

-Provide a list of training courses offered (private onsite or online) with associated costs for eCTD products. The training is to be scheduled on an as-needed basis, at a mutually agreed time. The cost should be priced per class.

-Provide descriptions and complete pricing to include estimated billable hours for available training options (course trainings, tailored training, and/or mentoring) to allow eIT PMO to compare and select from courses, vendor-provided training, or mentoring in advance -Provide training that includes any new functionality, refresher training, and new modules that become available or are required -Accommodate request for training or mentoring within 30 calendar days after notification from the Government -Provide remote mentoring for the development, programming and configuration and deployment of the eCTD product -Provide certified implementation experts to conduct mentoring. The mentoring provided should be a combination of custom training in conjunction with hands on environment specific consulting.

The Contractor shall provide a list of training courses available with costs and cost of all training materials. Training courses shall include but may not be limited to:

-Standard eCTD Publisher Training -Advanced eCTD Publisher Training -Administrator Training -eCTD Reviewer Training -Training materials shipping expense (if required) -Daily / Ad hoc training with daily rate

The Government intends to utilize a "Plugged" Not-to-Exceed (NTE) amount for all Training ODCs - See ODC Matrix Below. This plugged value is inclusive of all items outlined in this PWS Section.

ODC Matrix: Base Period & All Option Periods

Contract Period Training ODC Plugged Values Base Period $8,000.00 Option Period 1 (OP1) $8,240.00 Option Period 2 (OP2) $8,487.20 Option Period 3 (OP3) $8,741.82 Option Period 4 (OP4) $9,004.07 52.217-8 (6-month period) $4,637.10

The Government will request training based on frequency and need and will coordinate with the Contractor when training requirements are required. Basic training requirements are outlined in PWS Section 5.3 (Task 3), and the contractor is required to provide basic training pricing (if not separately priced elsewhere), and these prices will be utilized to request training and fund it as required throughout the life of this contract.

5.4 Task 4: Travel

The Government intends to utilize a "Plugged" Not-to-Exceed (NTE) amount for all Travel ODCs - See ODC Matrix Below. This plugged value is inclusive of all travel related to items outlined in PWS Section 5.3 (Task 3: Training Consulting and Technical Support Services).

ODC Matrix: Base Period & All Option Periods

Contract Period Travel ODC Plugged Values Base Period $3,000.00 Option Period 1 (OP1) $3,000.00 Option Period 2 (OP2) $3,000.00 Option Period 3 (OP3) $3,000.00 Option Period 4 (OP4) $3,000.00 52.217-8 (6-month period) $1,500.00

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Travel costs shall be incurred and billed in accordance with FAR Part 31. All travel requires Government prior approval/authorization. Costs for these expenses will be reviewed, certified and approved by the COR in advance. Contractor shall submit travel requests with estimated costs to the COR NLT fifteen (15) calendar days prior to travel. All travel and transportation shall utilize commercial sources and carriers provided the method used for the appropriate geographical area results in reasonable charges to the government. The Government will not pay for business class or first-class travel. Lodging and meals shall be reimbursed in accordance with regulations defined in FAR PART 31.

PART 6

6. INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The TIER 2 levels and position sensitivity designation for positions under this contract is (Requirement must be checked in order to be a requirement for this

PWS):

6.2.1 TIER II: Non-critical sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1 Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the Contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The Contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the Contractor for execution.

6.3.2 Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training:

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements: n/a

6.4.2 User requirements: All Contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoW IT or Covered Contractor IS: n/a

6.5.1 The Contractor shall mitigate supply chain risk to the Government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoW IT:

All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic Government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoW-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoW RMF or equivalent DoW Component PIT system accreditation decision that is current within three years within five (5) business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The Contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The Contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The Contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 "Ports, Protocols, and Services Management (PPSM)."

6.6.5 The Contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 "Identity Authentication for Information Systems" prior to granting access.

6.6.6 The Contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, "Public Key Infrastructure (PKI) and Public Key (PK) Enabling."

6.6.7 The Contractor will be responsible for compliance with the Joint Force Head Quarters - Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The Contractor shall support reciprocity, by providing all directed…