SOW_SOL.pdf

Center for Tobacco Products

COMBINED SYNOPSIS/SOLICITATION

RFQ Number: 75F40126Q00323 Online Subscription Access

To E-Cigarette and Tobacco Related Information

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation will not be issued.

The solicitation is issued as a request for quotation (RFP).

The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular.

This requirement is not being set-aside for small business.

Submission deadline: Responses shall be submitted electronically via email to the Contract Specialist, (see below) by September 2, 2026 at 2:00 PM Eastern Time (ET).

FDA Point of Contact: Nakita Archibald, Contract Specialist

PH: 703-796-7104

Email: Nakita.Archibald@fda.hhs.gov mailto:Nakita.Archibald@fda.hhs.gov

Solicitation Number: 75F40126Q00323 ECig Intelligence, Tobacco Intelligence

1. Background

The Family Smoking Prevention and Tobacco Control Act granted the U.S. Food and Drug Administration (FDA) the authority to regulate the manufacture, marketing, and distribution of tobacco products to reduce harm caused by tobacco and protect public health. FDA’s Center for Tobacco Products (CTP) oversees the implementation of the Family Smoking Prevention and Tobacco Control Act. Some of the Agency’s responsibilities under the law include setting performance standards, reviewing premarket applications for new and modified risk tobacco products, requiring new warning labels, and establishing and enforcing advertising and promotion restrictions. On August 8, 2016, the U.S. Food and Drug Administration finalized a rule that extends its regulatory authority to all tobacco products, including e-cigarettes, cigars, and hookah and pipe tobacco, as part of its goal to improve public health. Effective April 14th 2022 Congress amended the Family Smoking Prevention and Tobacco Control Act to extend FDA’s authority to regulate synthetic nicotine1.

2. Objectives

The objective of this requirement is to effectively regulate the rapidly changing marketplace for all tobacco products on the U.S. market as required by the law, CTP relies on comprehensive knowledge of and access to sales, marketing, and relevant policy data for emerging tobacco products, including nicotine pouches, heated tobacco products, and electronic nicotine delivery systems (ENDS) from both the U.S. and international markets to make informed regulatory decisions.

3. Scope of Work

The contractor shall provide CTP licenses for at minimum 10 users to access platforms with e-cigarette and nicotine pouch information with the following salient functional characteristics:

3.1 Global Tobacco Product Database - Detailed comprehensive data on key global tobacco product markets published monthly, including but not limited to:

3.1.1 Key performance indicators around the world

3.1.2 Incidence rates and usage rates, solus vs. dual, daily vs. occasional

3.1.3 Comparison with smoking rates

3.1.4 Market size, comparison between markets and regions, growth

3.1.5 Form-factor usage, closed vs open system

3.1.6 Pricing, online and offline, between key form-factors

3.1.7 Distribution channel, online, offline retail, independent vape shop

3.1.8 Key brand and penetration rates, and contact details

1 Text - H.R.2471 - 117th Congress (2021-2022): Consolidated Appropriations Act, 2022 | Congress.gov | Library of Congress https://www.congress.gov/bill/117th-congress/house-bill/2471/text https://www.congress.gov/bill/117th-congress/house-bill/2471/text

3.1.9 Consistent comprehensive methodology allowing cross-comparison between markets

3.1.10 Market information on the technical features of products when available, such as those found in Tamarind Media’s E-Cig Intelligence’s and Tobacco Intelligence's trackers.

3.1.11 Tobacco landscape changes: including information regarding novel product entrance onto the tobacco landscape.

3.2 Tobacco Regulatory Trackers

3.2.1 Europe - Detailed trackers on EU Tobacco Products Directive (TPD) implementation in all 28 EU member states:

3.2.1.1 Map-based TPD implementation overview (key provisions and timing);

split into key policy areas: tax, sales/distribution, public place usage, product, and marketing.

3.2.1.2 Compliance: notification guide for products under TPD

3.2.1.3 Compliance: Product and Packaging/Labeling

3.2.1.4 Advertising and Marketing restrictions

3.2.1.5 Public place usage

3.2.1.6 New law status: progress to implementation of TPD

3.2.1.7 Stakeholder database: key contacts for regulatory compliance in each market

3.2.2 U.S./International – U.S. State by state regulatory coverage of all key enacted legislation and bills affecting the tobacco sector, and international tracking of regulation covering following policy areas:

3.2.2.1 Tax

3.2.2.2 Sales and distribution channels

3.2.2.3 Public place usage

3.2.2.4 Product restrictions

3.2.2.5 Marketing and advertising

3.3 Global Tobacco Market Trackers and Data

3.3.1 Downloadable excel spreadsheets with detailed brand competitor analysis and price benchmarking in each of key markets

3.3.2 Data sets accompanying Market Reports containing market dynamics, market size, consumption patterns, competitor benchmarking and pricing, vape shop, online and retail distribution patterns.

3.3.3 Comprehensive methodology allowing comparison between tobacco markets across countries

3.4 Tobacco Regulatory Reports and Data

3.4.1 In-depth analysis of global tobacco regulatory landscape for individual country markets, including comprehensive coverage of all relevant regulatory and legal restrictions and compliance requirements in each major global market.

3.4.2 Detailed analysis of compliance requirements and legal obligations in each market

3.4.3 Independent non-partisan analysis of the regulatory burden for key stakeholders

3.4.4 Ability to download all reports in PDF files.

3.5 Tobacco Market Reports

3.5.1 Tobacco market analysis reports: market dynamics, market size, consumption patterns, competitor benchmarking and pricing, vape shop, online and retail distribution patterns

3.5.2 Detailed downloadable excel spreadsheets with detailed brand competitor analysis and price benchmarking

3.5.3 Ability to download all reports in PDF files

3.6 Tobacco product-related media Library

3.6.1 Comprehensive database of vape shop branding, merchandising and marketing

3.6.2 Offline vape store visit data and images

3.7 Tobacco product related news analysis / other

3.7.1 Key analysis of professionally relevant news affecting tobacco markets or related regulatory landscape

3.7.2 Key-Holder database: Key-Holder database is to include information on relevant organizations (to include manufacturers, importers, etc.) in the tobacco marketplace. Contact information to include website, email, phone and address details when applicable.

3.7.3 Events database

3.7.4 Detailed search functionality

3.7.5 Any information on tobacco product characteristics of devices such as those found in Tamarind Media’s ECigIntelligence’s hardware tracker

3.7.5 Any future tools that will be published by the platform.

3.7.6 Ability to download all tobacco related news and associated reports in PDF files

3.8 Dedicated Account Manager

3.8.1 Customer relationship manager to contact for all inquires and issues which arise during the subscription

3.8.2 Confirmation of reception of any communication from FDA within 24-hours from being received and will try to resolve in as short a timescale as possible

3.9 Access to the analysis team to answer questions or get further information on published content on the platform, to be channeled through the Dedicated Account Manager

3.10 Regular Scheduled Conference Call - pre-arranged conference call with analyst team to discuss an agreed agenda of topics regarding research published on the platform

3.10.1 The contractor shall provide up to 12 conference calls when needed/requested by FDA.

3.11 24-hour Access to the platform for registered FDA users

3.12 Monthly usage- monthly report from an Account Management team regarding usage of the platform by FDA users

3.13 U.S. Regulatory Alerts: weekday daily email alerts to live changes to regulatory landscape for U.S. states, counties and city regions

3.14 The contractor shall provide at least one training session to introduce product components and platform features, including but not limited to trackers, databases, methodologies used to create those trackers and databases, as well as tobacco regulatory and industry reports as highlighted in the scope of work.

3.14.1 Invitees to trainings may extend beyond the current users of the database.

3.14.2 The contractor shall provide additional training sessions if/when the contractor makes methodological changes to their data/reporting.

4. Access Specifications

4.1 Kickoff Meeting - Within five (5) calendar days after award, the Contractor shall meet with the Government via teleconference to discuss the process for gaining access to the website.

4.2 Access shall be provided through different user account names and passwords. Any CTP staff with a username and password will have access 24 hours a day from any computer with Internet service and an Internet browser.

4.3 The web site shall provide unlimited access to a unique business and regulatory intelligence service covering all geographies and most aspects of the global ENDS marketplace.

4.4 The web site shall provide data and information from a wide range of sources, some of which are not public. By gathering information and data from public and non-public sources and delivering it in a usable form, use of the web site shall provide CTP with one source for authoritative data and information, resulting in more efficient and less resource-intensive access.

4.5 The contractor shall further compile and organize its content, so the data and information are readily usable by CTP

4.6 The contractor shall provide daily weekday email summaries of changes to the regulatory landscape in the U.S., the EU 28-member states, and European Institutions

5. Deliverables

The contractor shall provide the delineated deliverables as shown in the scope of work section 3 above and the deliverables table in 6.1 below.

Table 6.1 Deliverables

Task DELIVERABLES DUE DATE FORMAT 1 Kickoff Meeting 5 days after award Teleconference 2 Provide user account names and passwords

Within 5 days after Kickoff Meeting Electronically

3 Regularly Scheduled Conference calls

Set up within 10 days of kickoff meeting.

Teleconference

4 Training Set up within 10 days of meeting kick off

Teleconference

6. Place and Time of Performance

The subscription services shall be available via 24-hour unrestricted remote access.

7. Contract Type:

Firm-Fixed Price

8. Period of Performance:

The anticipated period of performance will be as follows:

Base Year: 09/14/2026 – 09/13/2027

OY 1 – 09/14/2027 - 09/13/2028

OY 2 – 09/14/2028 – 09/13/2029

OY 3 – 09/14/2029 – 09/13/2030

OY 4 – 09/14/2030 – 09/13/2031

9. Authorized Reseller/servicing agent

The Contractor shall be the software Original Equipment Manufacturer (OEM) or an authorized reseller/servicing agent of the software OEM.

The Contractor shall notify the Contract Specialist / Contracting Officer immediately if this requirement is registered by a reseller with the OEM.

10. Government Points of Contact

Contracting Officer (CO) Entered at the time of award

Contract Specialist (CS) Nakita Archibald Food and Drug Administration Email: Nakita.Archibald@fda.hhs.gov

PH: 301-796-7104

Contracting Officer Representative (COR) Entered at the time of award

11. Contracting Officer’s Authority

The Contracting Officer (CO) is the sole person authorized to make or approve any changes in any of the requirements of this order and notwithstanding any provisions contained elsewhere in the order, the said authority remains solely with the CO. In the event the Contractor makes any changes at the direction of any person other than the CO, the change shall be considered to have been made without authority and no adjustment will be made in the delivery order terms and conditions, including price. The CO shall be the only individual authorized to accept nonconforming work, waive any requirement of the order and modify any term or condition of the order. The CO is the only individual who can legally obligate Government funds.

12. Contracting Officer’s Representative (COR) Authority

The Contracting Officer’s Representative (COR) or Project Officer is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the order price, terms or conditions. The COR/Project Officer is responsible for the technical aspects of the project and serves as technical liaison with the contractor and is responsible for the final inspection and acceptance, and such other responsibilities as may be specified in the order.

13. Conflicts of Interest (COI)

The Contractor or Offeror warrants that, to the best of its knowledge and belief, and except as otherwise disclosed to the Contracting Officer, it does not have any actual, potential, or apparent conflict of interests pertaining to the subject contract, as defined in FAR Subpart

9.5 and HHS and FDA policies, for its organization, employees, or subcontractors working or proposed to be working under this contract.

The Contractor or Offeror agrees that, if after award, it discovers a conflict of interest with respect to this contract, it shall make an immediate and full disclosure in writing to the FDA Contracting Officer for this contract.

The Government reserves the right to exercise any remedy available at law or equity, including termination of the contract for cause or convenience, should the Government determine remedial action is necessary to address any actual, potential, or apparent conflict of interest.

14. Inspection and Acceptance

Inspection and acceptance will be at destination by the COR or assigned TPOC in accordance with FAR clause 52.212-4(a). In accordance with FAR 52.212-4(a), the Government has the right either to reject or to require correction of nonconforming supplies and services.

Supplies are nonconforming when they are defective in material or workmanship or are otherwise not in conformity with agreement requirements. Services are nonconforming when they are not in conformity with the agreement requirements. The Government may reject nonconforming supplies and services with or without disposition instructions.

15. Invoicing and Payment Instructions

FDA Electronic Invoicing and Payment Requirements Invoice Processing Platform (IPP) (Jan 2022)

a. All Invoice submissions for goods and or services must be made electronically through the U.S. Department of Treasury's Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.htm

b. Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), "Content of Invoices" and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov

c. The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP http://www.ipp.gov/vendors/index.htm registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award for new contracts or date of modification for existing contracts.

Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131. The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

If your company is already registered to use IPP, you will not be required to re-register.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

d. Invoices that include time and materials or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable).

e. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts. At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

- Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)-show rate, base and total amount;

- Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

- Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

- Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

- Fee - amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

f. Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

g. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

h. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

i. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

j. The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

k. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301- 827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

16. Order of Precedence

The Contractor shall follow the terms and conditions of this contract. Should the Contractor include any additional terms and conditions resulting in conflicts between this document and the Contractor’s document, the Order of Precedence shall be as specified in FAR Clause 52.212-4. The Contractor shall not auto-renew any subscriptions, licenses, maintenances and services not authorized under this contract. Any auto-renewals are at the risk of the Contractor, and the Government will not reimburse the Contractor.

In the event of any inconsistencies between any licensing agreement incorporated into this order as an attachment and the FAR and HHSAR Clauses incorporated into this order, the

FAR or HHSAR Clauses shall take precedence.

17. Clauses

17.1 FAR Clauses

52.252-2 Clauses Incorporated by Reference. (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

Revolutionary FAR Overhaul | Acquisition.GOV (End of Clause)

52.252-6 Authorized Deviations in Clauses (Nov 2020) (a)The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter

1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b)The use in this solicitation or contract of any HHSAR Deviation (48 CFR 3) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

(End of clauses)

52.217-9 – Option to Extend the Term of the Contract. (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor any time before the contract expires; provided that the Government gives the Contractor a preliminary written notice of its intent to extend any time before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years.

(End of clause)

52.202-1 Definitions (Jun 2020) 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.212-4 Contract Terms and Conditions – Commercial Products and Commercial Services (Nov 2025) (RFO Deviation) 52.203-17 Contractor Employee Whistleblower Rights (Nov 2023) 52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) 52.222-90 Addressing DEI Discrimination by Federal Contractors (Apr 2026) (FAR Deviation) 52.224-3 Privacy Training (Jan 2017) 52.227-14 Rights in Data – General (May 2014) 52.227-17 Rights in Data -- Special Works (Dec 2007) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013) https://www.acquisition.gov/far-overhaul

17.2 HHSAR Clauses

This contract incorporates one or more HHSAR clauses by reference, with the same force and effect as if they were given in full text. The full text of the HHSAR clauses may be accessed electronically at this address: https://www.acquisition.gov

352.203-70 Anti-Lobbying (Jun 2026) (RFO Deviation) Pursuant to the HHS annual appropriations acts, except for normal and recognized executive-legislative relationships, the Contractor shall[must] not use any HHS contract funds for:

(a) Publicity or propaganda purposes;

(b) The preparation, distribution, or use of any kit, pamphlet, booklet, publication, electronic communication, radio, television, or video presentation designed to support or defeat the enactment of legislation before the Congress or any State or local legislature or legislative body, except in presentation to the Congress or any state or local legislature itself; or designed to support or defeat any proposed or pending regulation, administrative action, or order issued by the executive branch of any state or local government, except in presentation to the executive branch of any state or local government itself; or

(c) Payment of salary or expenses of the Contractor, or any agent acting for the Contractor, related to any activity designed to influence the enactment of legislation, appropriations, regulation, administrative action, or Executive order proposed or pending before the Congress or any state government, state legislature or local legislature or legislative body, other than for normal and recognized executive-legislative relationships or participation by an agency or officer of a state, local, or tribal government in policymaking and administrative processes within the executive branch of that government.

(d) The prohibitions in subsections[paragraphs] (a), (b), and (c) above shall [of this clause] include any activity to advocate or promote any proposed, pending, or future federal, state, or local tax increase, or any proposed, pending, or future requirement for, or restriction on, any legal consumer product, including its sale or marketing, including, but not limited to, the advocacy or promotion of gun control.

(End of clause)

352.204-73 CONTRACTOR PERSONNEL SECURITY AND AGENCY ACCESS

(FEB 2024) (DEVIATION)

(a) Definitions. As used in this clause— Agency access means access to HHS facilities, sensitive information, information systems or other HHS resources.

Applicant means a contractor employee for whom the Contractor applies for an HHS identification card.

Contractor employee means a prime contractor and subcontractor employee who requires agency access to perform work under an HHS contract.

https://www.acquisition.gov/

Identification card (or "ID card") means a government issued or accepted identification card such as a Personal Identity Verification (PIV) card, a PIV-Interoperable (PIV-I) card from an authorized PIV-1 issuer, or a non-PIV card issued by HHS, or a nonPIV card issued by another Federal agency and approved by HHS. PIV and PIV-1 cards have physical and electronic attributes that other (non-PIV) ID cards do not have.

Issuing office means the HHS entity that issues identification cards to contractor employees.

Local security servicing organization means the HHS entity that provides security services to the HHS organization sponsoring the contract.

(b) Risk and sensitivity level designations. For contracts requiring access to HHS facilities, sensitive information, information systems or other HHS resources, contractor employees will be required to complete background investigations, identity proofing, and government identification card application procedures to determine suitability for access. HHS will assign a risk and sensitivity level designation to the overall contract and/or to contractor employee positions by category, group or individual. The risk and sensitivity level designations will be the basis for determining the level of personnel security processing required for contractor employees. The position sensitivity designation levels that apply will be identified in the contract. The following risk and sensitivity level designations and associated level of processing are required, and each level includes the prior levels—

(1) Low risk level: National Agency Check with Written Inquiries (NACI);

(2) Moderate risk level: Minimum Background Investigation (MBI); and

(3) High risk level: Background Investigation.

(c) Security clearances. Contractor employees may also be required to obtain security clearances (i.e., Confidential, Secret, or Top Secret). National Security work designated "special sensitive," "critical sensitive," or "non-critical sensitive," will determine the level of clearance required for contractor employees. Personnel security clearances for national security contracts in HHS will be processed according to the HHS Personnel Security and Suitability Program, HHS Instruction 731-1, and the Department of Defense National Industrial Security Program Operating Manual (NISPOM).

(d) Pre-screening of contractor employees. The Contractor must pre-screen individuals designated for employment under any HHS contract by verifying minimal suitability requirements to ensure that only candidates that appear to meet such requirements are considered for contract employment, and to mitigate the burden on the Government of conducting background investigations on objectionable applicants. The Contractor must exercise due diligence in pre-screening all employees prior to submission to HHS for agency access. HHS may decline to grant agency access to a contractor employee for reasons including, but not limited to—

(1) Conviction of a felony, a crime of violence, or a misdemeanor involving moral turpitude;

(2) Falsification of information entered on forms or of other documents submitted;

(3) Improper conduct including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct adverse to the Government regardless of whether the conduct is directly related to the contract; and

(4) Any behavior judged to pose a potential threat to HHS facilities, sensitive information, information systems or other resources.

(e) Citizenship status. The Contractor must monitor a non-citizen’s continued authorization for employment in the United States. The Contractor must provide documentation to the Contracting Officer or the Contracting Officer's Representative (COR) during the background investigation process that validates that the E-Verify requirement has been met for each contractor employee.

(f) Background investigation and adjudication. A contractor employee must have a favorable adjudication of background investigation before HHS will issue an ID card to the contractor employee granting access to HHS facilities, sensitive information, information systems or other HHS resources. HHS may accept favorable adjudications of background investigations from other Federal agencies when applicants have held PIV cards issued by those agencies with no break in service. HHS may also accept PIV-I (Interoperable) cards issued by an authorized PIV-1 issuer as evidence of identity. A favorable adjudication does not preclude HHS from initiating a new investigation when deemed necessary. At a minimum, the FBI National Criminal History Check (fingerprint check) must be favorably completed before an HHS identification card can be issued. Each Contractor must use the Office of Personnel Management's (OPM) e-QIP system, or successor system identified by HHS, to complete any required investigative forms.

Instructions for obtaining fingerprints will be provided by the COR or Contracting Officer. The HHS Assistant Secretary for Administration, Program Support Center (PSC), or authorized HHS designee, is responsible for adjudicating the suitability of contractor employees.

(g) Agency access denied. Upon contract award, HHS will initiate the agency access procedure for all contractor employees requiring access to HHS facilities, sensitive information, controlled unclassified information, information systems, and other HHS resources for contract performance. HHS may deny agency access to any individual about whom an adverse suitability determination is made. Failure to submit the required security information or to truthfully answer all questions shall constitute grounds for denial of access. The Contractor must not provide agency access to contractor employees until the COR or Contracting Officer provides notice of approval, which is authorized only by the PSC, or authorized HHS designee. Where a proposed contractor employee is denied agency access by the Government or, if for any reason a proposed application is withdrawn by the Contractor during the agency access process, the additional costs and administrative burden for conducting additional background investigations caused by a lack of effective prescreening or planning on the part of the Contractor may be considered as part of the Contractor's overall performance evaluation.

(h) Identification card application process. The COR will be the HHS ID card Sponsor and point of contact for the Contractor's application for an HHS ID card. The COR shall review and approve the HHS ID card application before an ID card is issued to the applicant. An applicant may be issued either a Personal Identity Verification (PIV) card that meets the standards of Homeland Presidential Security Directive (HSPD-12), or an applicant may be issued a non-PIV card.

Generally, a non-PIV card will be issued for contracts that expire in six months or less, including option periods. The COR may request the issuing office to waive the six-month eligibility requirement when it is in HHS interest for contract performance. The following applies—

(1) PIV card. The applicant must complete an HHS on-line application for a PIV card;

(2) Non-PIV card. The applicant must complete and submit a hard copy of the necessary form(s) to be provided to Contractor by COR/Sponsor) to the COR/Sponsor; and

(3) Regardless of the type of card to be issued (PIV or non-PIV), the applicant must appear in person to provide two forms of identity source documents in original form to HHS. The identity source documents must come from the list of acceptable documents included in Form F-9, OMB No. 1115-0136, Employment Eligibility Verification. At least one document must be a valid State or Federal government-issued picture identification. For a PIV card, the applicant may be required to appear in-person a second time for enrollment and activation.

(i) Identification card custody and control. The Contractor is responsible for the custody and control of all forms of government identification issued by HHS to contractor employees for access to HHS facilities, sensitive information, information systems and other HHS resources.

The Contractor shall:

(1) Provide a listing of personnel for whom an identification (ID) card is requested to the COR who will provide a copy of the listing to the card issuing office. This may include Contractor and subcontractor personnel. Follow issuing office directions for submittal of an application package(s).

(2) While visiting or performing work on an HHS facility, as specified by the issuing office or COR, ensure that contractor employees prominently display their ID card.

(3) Immediately notify the COR or, if the COR is unavailable, the Contracting Officer when a contractor employee’s status changes and no longer requires agency access (e.g., employee’s transfer, completion of a project, retirement, removal from work on the contract, or termination of employment) that may affect the employee’s eligibility for access to the facility, sensitive information, or resources.

(4) Promptly deliver to the issuing office: (a) all ID cards assigned to an employee who no longer requires access to the facility; and (b) all expired ID cards within five (5) days of their expiration or all cards at time of contract termination, whichever occurs first.

(5) Immediately report any lost or stolen ID cards to the issuing office and follow its instructions.

(i) The Contractor is responsible for maintaining and safeguarding the HHS ID card upon issuance to the contractor employee. The Contractor must ensure that contractor employees comply with HHS requirements concerning the renewal, loss, theft, or damage of an ID card.

The Contractor must immediately notify the COR or, if the COR is unavailable, the Contracting Officer when an ID card is lost, stolen or damaged.

(ii) Failure to comply with the requirements for custody and control of HHS ID cards may result in withholding final payment or contract termination based on the potential for serious harm caused by inappropriate access to HHS facilities, sensitive information, information systems or other HHS resources.

(iii) Specific actions and activities are required in certain events—

(A) Renewal. A contractor employee's HHS issued ID card is valid for a maximum of three years or until the contract expiration date (including option periods), whichever occurs first. The renewal process should begin six weeks before the PIV card expiration date. If a PIV card is not renewed before it expires, the contractor employee will be required to sign-in daily for facility access and may have limited access to information systems and other resources.

(B) Lost/stolen. Immediately upon detection, the Contractor or contractor employee must report a lost or stolen HHS ID card to the COR, or if the COR is unavailable, the Contracting Officer, the issuing office, or the local servicing security organization. The Contractor must submit an incident report within 48 hours, through the COR or, if the COR is unavailable, the Contracting Officer, the issuing office, or the local security servicing organization describing the circumstances of the loss or theft. The Contractor must also report a lost or stolen PIV card through the HHS on-line registration system. If the loss or theft is reported by the Contractor to the local police, a copy of the police report must be provided to the COR or Contracting Officer.

From the date of notification to HHS, the Contractor must wait three days before getting a replacement ID card. During the 3-day wait period, the contractor employee must sign in daily for facility access.

(C) Replacement. An ID card will be replaced if it is damaged, contains incorrect data, or is lost or stolen for more than 3 days, provided there is a continuing need for agency access to perform work under the contract.

(D) Surrender of ID cards. Upon notification that routine access to HHS facilities, sensitive information, information systems or other HHS resources is no longer required, the Contractor must surrender the HHS issued ID card to the COR, or if the COR is unavailable, the Contracting Officer, the issuing office, or the local security servicing organization in accordance with agency procedures.

(j) Flow down of clause. The Contractor is required to include this clause in any subcontracts at any tier that require the subcontractor or subcontractor's employees to have access to HHS facilities, sensitive information, information systems or other resources.

(End of clause)

352.208-70 Printing and Duplication (Feb 2026) (RFO Deviation)

(a) Unless otherwise specified in this contract, no printing by the Contractor or any subcontractor is authorized under this contract. All printing required must be performed by the Government Printing Office except as authorized by the Contracting Officer. The Contractor must submit camera-ready copies to the Contracting Officer's Representative (COR). The terms “printing” and “duplicating/copying” are defined in the Government Printing and Binding Regulations of the Joint Committee on Printing.

(b) If necessary for performance of the contract, the Contractor may duplicate or copy less than 5,000 production units of only one page, or less than 25,000 production units in aggregate of multiple pages for the use of a department or agency. A production unit is defined as one sheet, size 8.5 x 11 inches, one side only, and one color. The pages may not exceed a maximum image size of 10 3⁄4 by 14 1⁄4 inches. This page limit applies to each printing requirement and not for all printing requirements under the entire contract.

(c) Approval for all printing, as well as duplicating/copying in excess of the stated limits, shall[must] be obtained from the COR who will consult with the designated publishing services office and provide direction to the contractor. The cost of any unauthorized printing or duplicating/copying under this contract will be considered an unallowable cost for which the Contractor will not be reimbursed.

(End of clause)

352.227-71 Rights in Data – Supplement – Exceptional Circumstances (Jun 2026) (Deviation) RIGHTS IN DATA – SUPPLEMENT – EXCEPTIONAL CIRCUMSTANCES (JUN 2026) (RFO DEVIATION)

(a) Applicability.

(1) FAR 52.227-14, Rights in Data-General, including any specified Alternates, applies to this contract.

(2) In addition to the requirements of FAR 52.227-14, this clause sets forth additional requirements that apply to data subject to the executed Determination of Exceptional Circumstances (DEC) that is identified in the contract and incorporated by reference.

(b) Publication review and delay of public disclosure. To ensure that information concerning possible inventions made under this contract is not prematurely published thereby adversely affecting the ability to obtain patent protection on such inventions, the Contractor must—

(1) Provide the Contracting Officer a copy of any publication or other public disclosure relating to the work performed under this contract at least 30 days in advance of the disclosure; and

(2) Upon the Contracting Officer's request, agree to delay the public disclosure of such data or publication of a specified paper for a reasonable time specified by the Contracting Officer, not to exceed 6 months, to allow for the filing of domestic and international patent applications in accordance with clause 352.227-70, Patent Rights – Supplement – Exceptional Circumstances.

(c) Data on Material(s). Proprietary data on material(s) provided to the Contractor under or through this contract must be used only for the purpose for which they were provided, including screening, evaluation, or optimization, and for no other purpose.

(d) Confidentiality.

(1) The Contractor must—

(i) Take all reasonable precautions to maintain Confidential Information as confidential, but no less than the steps Contractor takes to secure its own confidential information; and

(ii) Maintain Confidential Information as confidential unless specifically authorized otherwise in writing by the Contracting Officer.

(2) Confidential Information does not include confidential information.

(e) Subcontracts. The Contractor must include the substance of this clause, including this paragraph (e), in all subcontracts where a subcontractor may generate, access, or use DEC-covered data.

(End of clause)

352.227-72 Publications and Publicity (Jun 2026) (RFO Deviation)

(a) Unless otherwise specified in this contract, the Contractor may publish the results of its work under this contract. The Contractor must promptly send a copy of each article submitted for publication to the Contracting Officer's Representative.

(b) Unless authorized in writing by the Contracting Officer, the Contractor must not display the HHS logo [or seal,] including Division logos [or seals,] on any publications.

(c) The Contractor must not reference the product(s) or service(s) awarded under this contract in commercial advertising, as defined in FAR 31.205-1, in any manner which states or implies HHS approval or endorsement of the product(s) or service(s) provided.

(d) The contractor must include [the substance of] this clause, including this paragraph (d), in all subcontracts where the subcontractor may propose publishing the results of its work under a subcontract.

(End of clause)

352.232-71 Electronic Submission of Payment Requests (Apr 2026) (RFO Deviation)

(a) Definitions. As used in this clause— Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

(End of Clause)

352.239-71 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY RESOURCES (Feb 2024) (RFO Deviation)

(a) Definitions. As used in this clause— Information technology has the same meaning in FAR 2.101.

Information and communication technology (ICT) also means information technology (see FAR

2.101 for definitions).

Information system security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.

(b) Responsibilities. The Contractor shall be responsible for information technology security for all systems connected to a Department of Health and Human Services (HHS) network or operated by the Contractor for HHS, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor has physical or other system access to HHS information that directly supports the mission of HHS. Examples of tasks that require security provisions include—

(1) Hosting of HHS e-Government sites or other information technology operations;

(2) Acquisition, transmission, or analysis of data owned by HHS with significant replacement cost should the contractor's copy be corrupted; and

(3) Access to HHS general support systems/major applications at a level beyond that granted the general public, e.g., bypassing a firewall.

(c) Information system security plan. The Contractor shall develop, provide, implement, and maintain an Information System Security Plan. HHS information system and platform information technology systems must have a security plan that provides an overview of the security requirements for the system and describes the security controls in place or the plan for meeting those requirements. Generally, this plan shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of information system resources developed, processed, or used under this contract. The security plan should include implementation status, responsible entities, resources, and estimated completion dates.

Security plans may also include, but are not limited to, a compiled list of system characteristics or qualities required for system registration, and key security-related documents such as a risk assessment, privacy impact assessment (PIA), system interconnection agreements, contingency plan, security configurations, configuration management plan, incident response plan, and the system privacy plan, as determined by the Contracting Officer’s Representative. The plan shall address the specific contract requirements regarding information systems or related support or services included in the contract, to include the PWS or SOW. The Contractor's Information System Security Plan shall comply with applicable Federal Laws that include, but are not limited to, 40 U.S.C. 11331, the Federal Information Security Modernization Act (FISMA) of 2014 and the E-Government Act of 2002. The plan shall meet information technology security requirements in accordance with Federal and HHS policies and procedures, and as amended during the term of this contract, and include, but are not limited to the following:

(1) OMB Circular A-130, Managing Information as a Strategic Resource;

(2) National Institute of Standards and Technology (NIST) Guidelines;

(3) Federal Information Processing Standard (FIPS) 200; and

(4) HHS Cybersecurity Program related to HHS information (including HHS sensitive information and information systems security and privacy), as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, the Cyber Security Checklist and Cyber Security Infographic at https://www.hhs.gov/hipaa/for- professionals/security/guidance/cybersecurity/index.html, which provides HHS procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards and guidance for protecting HHS information, information systems (see 302.101, Definitions), information technology, and ICT, security and privacy, and adhering to personnel security requirements when accessing HHS information or information systems.

(d) Submittal of plan. Within 60 days after contract award, the Contractor shall submit the Information System Security Plan to the Contracting Officer for review and approval.

(e) Authority to Operate (ATO). As required by current HHS policy, the Contractor shall submit written proof of information technology security accreditation with a valid ATO to the Contracting Officer. Such written proof may be furnished either by the Contractor or by a third party. Accreditation shall be in accordance with HHS policy available from the Contracting Officer upon request.