Temp Monitoring PWS final.pdf

Performance Work Statement (PWS)

Stockpile Temperature Monitoring System

(STMS)

1. Vision Statement

1.1 Background

1.1.1 Purpose

1.2 Scope

2. General Requirements

2.1 Non-Personal Services

2.2 Business Relations

2.3 Contract Administration and Management

2.3.1 Contract Management

2.3.2 Contract Administration

2.3.3 Contract Administration

2.3.4 Contract Project Management Plan

2.3.5 Kick off Meeting

2.3.6 Ongoing Progress Meetings

2.4 Subcontract Management

2.5 Travel / Temporary Duty (TDY)

3. Performance Requirements

3.1 Prepare Project Plan (Project Schedule Report and Project Plan Report)

3.2 Equipment installation and removal

3.2.1 Use only certified service personnel

3.2.2 Develop and coordinate equipment installation plan with the SNS sites

3.2.3 Remove SensaPhone equipment installed at SNS sites

3.2.4 Install monitoring equipment at identified sites

3.2.5 Configure, and test installed monitoring sensors at all sites

3.2.6 Provide data archiving by SNS cache location and container

3.3 Reporting

3.3.1 Deliver a monthly temperature monitoring report and monthly planned activity report

3.3.2 Deliver Event Status Reporting

3.3.3 Notify the COR/Designee of deviation conditions

3.4 Maintenance

3.4.1 Perform and document initial and periodic validation, calibration, and maintenance of systems at all locations

3.4.2 Repair monitoring equipment

3.5 Monitoring and Help Desk

3.5.1 Provide 24/7 phone access for response to any phone or email notifications for SNS, State, and local entities

3.5.2 Disable/Reenable Door Alarms during Product Rotation

3.5.3 Container Moves

4. Special Requirements

4.1 Security and Safety

4.1.1 Security

4.1.2 HHS FedRAMP Privacy and Security Requirements

4.1.3 Safety

4.2 Applicable Directives

4.3 Quality

4.3.1 Quality Control

4.3.2 Quality Assurance Surveillance Plan (QASP)

4.3.3 Inspection and Acceptance

4.4 Transition:

4.5 FAR 52.237-3 Continuity of Services

4.8 Data Rights: ....................................................................... Error! Bookmark not defined.

5. Deliverables

Appendix A – Site Listing

Appendix B - Locations that require additional controlled access

Appendix C- Container C Overview

APPENDIX D: Quality Agreement

1. General

2. Contractor Qualification

3. Document Control Program

4. Standard Operating Procedures

5. Training Program

6. Facility Temperature Monitoring System

7. Monthly Mean Kinetic Temperature (MKT) Reports

8. Deviation and Corrective Action Tracking

9. Incident Notification and Reporting

10. Facility Design, Equipment and Maintenance Program

11. Comprehensive Validation Program

12. Calibration

13. Contractor or Subcontractor Qualification

14. Redundant Systems

15. Change Control

16. Quality Assessment Compliance

17. Facility Inspection Notifications

18. Licensing

Performance Work Statement (PWS)

Stockpile Temperature Monitoring System (STMS)

1. Vision Statement

To replace Strategic National Stockpile’s (SNS) current temperature monitoring and alert system, which has reached its end of life, with a new system that is expandable, automated, and meets the program’s needs for regulatory compliance with the FDA's Good Manufacturing Practices (cGMP) to ensure the safety and efficacy of stored countermeasures.

1.1 Background

The Office of the Assistant Secretary for Preparedness and Response Division of the Strategic National Stockpile (SNS) is the Nation's repository for medical supplies, drugs, vaccines and other related equipment. The SNS’s stockpile exists to re-supply state and local emergency medical responders in disaster events, especially biological or chemical terrorism. The stockpile is stored at multiple locations to ensure rapid delivery to areas in need. A CHEMPACK storage site consists of one or multiple standardized purpose-built storage containers, located in a state and/or U.S. territory designated storage facility. See Appendix C for specific information on the storage containers. There are approximately 1,350 storage sites located in the U.S. and its territories. In addition to the CHEMPACK sites, SNS has other medical storage sites which are part of the National Disaster Medical System (NDMS), which also require temperature monitoring. NDMS sites are storage rooms, not containers, that require monitoring.

The current temperature and door monitoring system for CHEMPACK program consists of a SensaPhone 2050 remote monitoring unit connected to an analog telephone line along with internal container sensors and connections to the containers’ dry contacts to monitor to the door status.

The following lists the approximate number of containers at each site:

875 cache sites have a single (primary) container

375 cache sites have two containers

50 cache sites have three containers

35 cache sites have 4 containers

15 cache sites have more than 4 containers

10 NDMS cache sites do not have containers but are monitored.

The SNS currently relocates approximately 30 containers per year to various cache sites or special event locations.

The SensaPhone system has reached its end of life and must be replaced. This is essential to ensure the safety and efficacy of the countermeasures for extended storage per the Food and Drug Administration (FDA) current Good Manufacturing Practices (cGMP), and the shelf life extension program.

1.1.1 Purpose

The purpose of the acquisition is to replace SNSs current temperature monitoring system. This includes:

Remove the current system

Replace with a new wireless-based cGMP compliant temperature monitoring system

Provide operation and maintenance of the replacement system

Disseminate alarms and system reports as required.

1.2 Scope

The selected Stockpile Temperature monitoring system (STMS) will be installed in designated storage locations and undergo installation qualification, operational qualification, and report review by the COR or his/her designee. The devices’ status and monitoring functions (i.e., container door alarm, environmental conditions) shall be monitored in an automated, reliable way and on a continuous basis.

The monitoring system shall have the capability of remote monitoring and disseminating alarms 24hr/7day a week basis covering all the storage sites identified in Appendix A. The contractor shall provide recurring monitoring and maintenance reports as identified in the SOW.

The list of facility locations and numbers of containers are listed in Appendix A. Due to the confidential nature of the specific site locations, the government will provide the site-specific information once contract is awarded.

The Contractor shall remove the current system and return the removed equipment and sensors, to a location provided by the COR/Designee. The contractor will then install a new wireless system so that designated environmental temperature and door security will be monitored.

The contractor shall use wireless or radio frequencies and protocols that do not interfere in hospital or health care environments and must meet Joint Commission and FDA regulations.

For CHEMPACK cache sites, there are approximately 1963 containers that shall require internal temperature and door monitoring at approximately 1350 locations. For NDMS cache sites, there are approximately 10 locations that shall require room temperature and door monitoring.

For equipment placement, the contractor shall:

Install data collection and transmission equipment in or on the primary CHEMPACK container.

The SNS Logistics POCs, will provide a list of primary containers.

o Additional auxiliary equipment, installed in the facility, to facilitate communication between the primary container and the contractor’s communication network is authorized.

o Hardware within containers (not including sensors) shall not exceed 12.1” W, 7.2” H, 1.6” D.

Ensure each CHEMPACK container is equipped with temperature and door sensors/dry contact connection, and these sensors transmit the data collected to the data collection equipment on the primary container.

o Contractor may install a contractor provided door sensor or use the dry contact connections in the SATCO door for monitoring the door status.

o Temperature sensors shall record temperature information hourly.

o Sensors shall be able to retain a minimum of 30 days of data, and the data shall be available for upload at a future time when communication connectivity is restored.

Equip CHEMPACK sites that only have one container with two temperature sensors and one door sensor or dry contact connections.

Install data collection and transmission equipment in NDMS storage locations.

o Additional auxiliary equipment to facilitate communication between the storage location and the contractor’s communication network is authorized.

o Equip NDMS sites with two temperature sensors and one door sensor.

Contractor shall retain all sensor data collected for the life of the contract and provide a complete digital copy of the data to the SNS at contract expiration, in a format specified by the SNS.

The Contractor shall provide, install, configure, and test a Temperature/Environmental Monitoring System. The Contractor shall provide hardware and software components and deliver training services.

Prior to conducting any installation and testing, the Contractor shall provide written protocols of the Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) for the temperature monitoring system at the SNS sites in order for SNS to review and provide approval before the Contractor can execute the protocols. As protocols are executed, reports of progress and any departures from expectations can be noted and provided to the SNS. In addition, the Contractor shall conduct site assessments, develop design documentation, and provide end-of-contract transition support. The Contractor shall provide a single point of contact (Implementation Manager) to oversee the overall /Environmental System implementation.

SNS may require the system to be installed at additional locations.

The contractor shall provide all activities to maintain and repair the system when needed. Equipment will require periodic maintenance and calibration to meet cGMP regulatory compliance.

The Base Period will be funded in full upon execution of the contract. The Options are as follows:

Base Year: 12 months from contract award Option Year 1: 13-24 months from contract award Option Year 2: 25-36 months from contract award Option Year 3: 37-48 months from contract award Option Year 4: 49-60 months from contract award

2. General Requirements

This section describes the general requirements for this effort. The following sub-sections provide details of various considerations on this effort.

SNS locations and hosted CHEMPACK sites with Sensaphone telephone gateways (that use traditional landlines), and sensors are to be changed over to wireless state of the art gateways and sensors that use contractor provided communications methods. The replacement system shall be standalone and does not require the local facilities’ communications systems.

We request that solicitors use FEDRAMP authorized applications or use providers that use FEDRAMP authorized applications for this project. We request that solicitations provide FedRAMP authorized temperature monitoring applications or use providers that have FedRAMP authorized temperature monitoring applications. Private contractor-owned/contractor-operated information systems shall comply with the security requirements in section 4.1.1 Security. FedRAMP authorized providers shall comply with the security requirements in sections 4.1.1 Security, and 4.1.2 HHS FedRAMP Privacy and Security Requirements.

After the installation, the contractor shall remain under contract to conduct periodic system and hardware maintenance (e.g., software upgrades, unscheduled services/repairs to the hardware, scheduled calibrations, support scheduled container moves, provide cGMP reports, etc.)

Government users and selected Site staff must receive system generated alarms via voice, text, and, e-mail (i.e., Hi/Low temperature breaches, door openings, power failures, etc.). See Section 3.5.

The hardware must be able to record temperature and door breaches to support temporary moves, temporary power outages, etc. and generate reports once re-connected. Temperature data should be recorded every hour. Sensors should be able to retain a minimum of 30 days of data available for upload at a future time if connectivity is not active. Alert or alarm event data should also be retained for a minimum of 30 days for upload at a future time if connectivity is not active.

Contractor shall meet all Quality requirements outlined in Appendix D of this document.

2.1 Non-Personal Services

No personal services shall be performed under this contract. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor must promptly notify the Contracting Officer of this communication or action.

The Contractor must not perform any inherently governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee may state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with the contract, Contractor employees must identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government Contractors in connection with this contract, the Contractor employee must state that they have no authority to in any way change the contract and that if the other Contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

The Contractor must insure that all of its employees working on this contract are informed of the substance of this clause. Nothing in this clause limits the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this clause must be included in all subcontracts at any tier.

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the Stockpile Temperature Monitoring System (STMS) requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor must maintain continuity between the support operations between sub-contractor locations and the contractor's corporate offices.

2.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact (Project Manager) between the Government and Contractor personnel assigned to support contracts or task orders. The Contractor Project Manager will be responsible for:

Ensuring proper documentation is delivered to the SNS

Coordinating, escalating, and resolving Contractor-related project issues

Representing the Contractor in status meetings and providing timely status reports

2.3.3 Contract Administration

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure to support contract tasks

2.3.4 Contract Project Management Plan

The Contractor shall produce a Contractor Project Management Plan (CPMP) which includes the approach and timeline in execution of the contract. The CPMP shall be updated and amended as outlined in the deliverables table. The Contractor shall update and maintain the COR-approved CPMP throughout the period of performance. The CPMP shall contain a comprehensive Project Schedule including milestones and deliverable dates for the deployment of each Application at each SNS Facility.

The Project Schedule shall be broken out by facility and application

Deliverable: Contractor Project Management Plan

2.3.5 Kick off Meeting

The Contractor shall conduct a project kick-off meeting within 15 days after award to introduce the Government team to the Contractor’s overall operating plans and approach to this requirement. The Contractor shall present its draft Contractor Project Management Plan (CPMP) for review with the Government. The Contractor shall update the CPMP based on the outcomes of the kick-off meeting.

This meeting shall be virtual or held on-site.

2.3.6 Ongoing Progress Meetings

Monthly, the Contractor shall submit a Monthly Progress Report to include:

Completed activities for the reporting period

Planned activities for the next reporting period

Tracking of current issues and risks

Deliverable: Monthly Progress Report

2.4 Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Procuring Contracting Officer (PCO) or Contracting Officer Representative (COR). Cross teaming may or may not be permitted.

2.5 Travel / Temporary Duty (TDY)

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the period of performance.

Travel to other government facilities or other contractor facilities may be required and will be specified in the PWS. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government (subject to local policy procedures) and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs (subject to local policy & procedures; may reference FAR). There are specific CHEMPACK locations that require additional control access in order to gain access. These locations are addressed in Attachment C.

3. Performance Requirements

The Period of Performance (PoP) for this contract is 12 months + four option years.

As holidays vary across locations, and this system requires 24/7 coverage, the contractor is expected to provide 24/7 support. Access to installation facilities will require coordination with the COR/designee and the CHEMPACK Regional Coordinators.

3.1 Prepare Project Plan (Project Schedule Report and Project Plan Report)

Using information from the inception meeting, the Contractor shall provide a draft work plan outlining the approach, resources, outputs or products, overall project timeline and key milestones for completing installation of equipment at listed locations.

Information to complete this task will be given during the inception meeting.

Deliverables:

1. Project Plan Report This report shall include the steps in completing the replacement project. Should be delivered within 30 days of contract award. Shall include:

a) Hardware procurement plan

b) Resource management plan

c) Roles and responsibilities

d) Quality Assurance plan

e) Communication plan

f) Risk management plan

2. Project Schedule Report

The updated project schedule will be provided monthly during the replacement project. The minimum requirements of the report shall include the following:

a) Resource loaded schedule

b) Equipment orders

c) Site installations:

1) Location name

2) State

3) Site Location (name of facility/city/state)

4) Date completed

d) Contract Deliverables

3.2 Equipment installation and removal

3.2.1 Use only certified service personnel.

All installation and service personnel shall be fully certified by the manufacturer to install, program, test, and work on systems of this type, and must be either employees of the system manufacturer, or have completed a manufacturer certified training program. The contractor shall provide documentation to SNS from the manufacturer upon award and thereafter annually of all installation and service personnel that have met and maintained certification requirements.

Deliverables:

A007 Certified Service Personnel Report

3.2.2 Develop and coordinate equipment installation plan with the SNS sites

Contractor shall provide a schedule for installation which will be given to the designated SNS Logistics POC for coordination. Sites have been provided in Appendix A. Some additional sites may be added if needed.

1) Scheduling will be submitted to the designated SNS Logistics POCs for coordination.

a) Within 10 days of contract award, the contractor shall submit a schedule for the first 30 days of site visits. Thereafter, the contractor shall submit a schedule every 30 days where the first visit on the schedule is no sooner than 30 days from the date of submission.

b) Contractor shall submit an initial schedule with dates and cities per day for entire implementation with proposal.

c) Contractor shall submit site schedule to the designated SNS Logistics POCs.

d) After coordination is complete the designated SNS Logistics POCs will provide the approved listing along with contact information for the contractor to conduct installations.

2) The designated SNS Logistics POCs will confirm dates/times with Project Areas Coordinators.

a) The designated SNS Logistics POCs will resolve any scheduling conflicts with the Project Area/sites within 10 business days.

b) The designated SNS Logistics POCs will be available for any scheduling conflicts.

Performance Standards Standard: All the facilities identified for SensaPhone replacement or new installation are operationally functional by 30 September 2020.

Acceptable Quality Level (AQL): 100% of installed equipment is calibrated to meet industry and cGMP requirements and is reporting to the central monitoring application. See Appendix D for Quality requirements on qualification testing (IQ, OQ, PQ) of the temperature monitoring system prior to use.

Deliverable: A001 Installation Schedule

3.2.3 Remove SensaPhone equipment installed at SNS sites

Contractor shall remove SensaPhone hardware and return to the SNS. The Contractor shall pack and ship SensaPhone equipment to a designated location. Shipping box shall include legacy monitor and all sensors removed from the container at that site.

Performance Standard Standard: Removal of SensaPhone hardware and functional installation of new equipment is completed on the same day to prevent loss of monitoring data.

AQL: 100% of the time.

3.2.4 Install monitoring equipment at identified sites

Contractor shall provide a schedule for installation which will be given to the designated SNS Logistics POC for coordination. Sites have been provided in Appendix A. Some additional sites may be added if needed.

Performance Standards Standard: All equipment shall be installed per manufacturer’s specifications and the applicable ordinances and codes.

AQL: 100% of the time.

3.2.5 Configure, and test installed monitoring sensors at all sites

The Contractor shall configure and test installed door sensor(s), primary and back up temperature sensors at all sites for monitoring and alarm operation. See 3.4.1.

Contractor shall provide detailed wireless and/or radio frequency and protocol information used by devices to SNS Logistics POCs for coordinated wireless deployment approval with health care facilities in order to obtain written clearance from each facility manager prior to installation to ensure that equipment is not interfering with essential facility equipment.

Test Instrument Calibration Records and sensor calibration information will be required upon completion. See Appendix D

Performance Standards Standard: Contractor maintains National Institute of Standards and Technology (NIST) traceable calibration documents for each sensor installed for the life of the contract.

AQL: 100% of the time

Deliverable: A002 RF and Wireless Protocol Specifications

3.2.6 Provide data archiving by SNS cache location and container

All data related to the temperature monitoring system including, but not limited to, temperature data, maintenance records, and calibration activities shall be saved and archived for 5 years by the Contractor. Contractor shall retain all sensor data collected for the life of the contract and provide a complete digital copy of the data to the SNS at contract expiration, in a format specified by the SNS.

3.3 Reporting

3.3.1 Deliver a monthly temperature monitoring report and monthly planned activity report

The Contractor shall submit:

Monthly report of Planned activities for at least 60 days prior to planned event(s)

Report of Mean Kinetic Temperatures (MKT) for all SNS sites for the prior month. The contractor shall be responsible to report Mean Kinetic Temperature calculation in accordance with the current edition of the United States Pharmacopeia (USP) as outlined in Appendix D.

a) Standard: Contractor will provide SNS Logistics POCs a monthly report with projected activities

60 days prior to the planned event(s).

AQL: 100% of the time.

b) Standard: MKT report lists the mean Kinetic temperature for all monitored sites.

AQL: 100% of the time.

Deliverables:

A008 Monthly Planned Activities Report

A003 Mean Kinetic Temperature (MKT) Report

3.3.2 Deliver Event Status Reporting

During a natural or manmade disaster, which SNS classifies as “an event,” , the contractor shall provide a status report of temperature monitoring device connectivity. This information must be provided 2 to 4 times daily for requested locations as specified by the SNS Logistics POCs.

AQL: 100% of the time.

Deliverable: A009 CHEMPACK Container Event Report

3.3.3 Notify the COR/Designee of deviation conditions

1) A deviation is defined as a departure from standard procedures or specifications that could result in non-conforming products and or processes, or where there have been unusual or unexplained events which have the potential to impact product quality or failure to follow quality systems. At a minimum, the following are reportable deviations:

a) Failure to calibrate temperature sensor per Section 3.4.1

b) Failure to follow the contract

c) Failure to use qualified/trained technicians/personnel for a task/job

d) Failure to notify the SNS/ASPR POCs of alarms and deviations per Section 3.5.1

e) Failure to follow contractor’s established written SOPs

f) Failure to repair sensors/equipment on a timely manner per Section 3.4.3

g) Temperature exceeds 86 degrees Fahrenheit for 24 continuous hours

h) Temperature exceeds 104 degrees Fahrenheit for over 120 continuous minutes

i) Temperature is below 46 degrees Fahrenheit for over 120 continuous minutes

j) Data Loss for any reason, including but not limited to, loss of power, connectivity, hardware failure, etc.

2) In the event of a deviation, the contractor is responsible for the following:

a) Report the deviation to Quality Control (QC) Section, CHEMPACK and COR by telephone or email within 24 hours from time of discovery.

b) Resolve the deviation under the guidance of QC Section, CHEMPACK, or COR as appropriate

c) Create documentation in compliance with relevant vendor SOPs

d) Keep a record of deviation and manage trend analysis report

3) See Appendix D for additional quality-related event notifications requirements.

a) Standard: Deviations are reported to the QC, SNS Logistics POCs, COR/Designee within 24 hours

Telephone and/or email notification of deviation; Actual telephone numbers and email addresses to be provided after award

3.4 Maintenance

3.4.1 Perform and document initial and periodic validation, calibration, and maintenance of systems at all locations

The contractor shall review and check all system configurations and components. Maintenance shall include software updates, battery replacements (due to malfunction or pre-scheduled manufacturer recommendations), and annual measurements of system functionality and connection status.

1) Service will be performed according to manufacturer specifications

2) Systems shall be validated on-site using Installation Qualification (IQ) and Operational

Qualification (OQ) testing and protocols per 21 CFR 211.

3) Temperature and Sensors shall be calibrated with NIST traceable devices.

4) Software shall be validated in accordance with current FDA regulations for electronic system.

5) Validation documentation, manuals, and test results shall be maintained by contractor throughout length of contract and provided as a record of reliable system functions. Validation protocols must meet compliance with The Joint Commission, the FDA 21 CFR, and CAPA process.

6) Contractor must coordinate all site visits directly with SNS Logistics POCs.

7) Contractor will provide in a spreadsheet format a quarterly validation/calibration/preventive maintenance (scheduled) service report with due date and service completion dates by location or all locations

a) Standard: NIST traceable calibration documents are on file for each sensor installed

b) Standard: Validation documentation, manuals, and test results shall be maintained by contractor and provided as a record of reliable system functions and corrective and preventive actions.

A005 Validation/Calibration Report

A010 Scheduled Maintenance Due/Completion Date Report (Quarterly)

3.4.2 Repair monitoring equipment

1) Contractor shall provide technical support, maintenance and repairs necessary to ensure the effective operations of the installed system. Contractor support staff shall be reachable by phone 24/7.

2) Contractor shall provide 24/7 service and support of all equipment and systems to include but not limited to hardware, firmware, software, networking devices, telecommunication devices, wiring, and cables. Service shall be provided on-site if repairs cannot be completed remotely.

3) Contractor shall be responsible to provide all on-site labor, parts, materials, travel, personnel, and shipping for corrective maintenance at all locations. Contractor shall be responsible to coordinate service visits directly with SNS Logistics POCs.

4) Contractor shall send a notification of incident or service requirement within 24 hours to email addresses defined after contract award

5) Contractor shall send a Monthly Alarm and Service report by the 10th day of the month for the previous month to email addresses defined after contract award.

Performance Standards:

a) Standard: Calls answered or responded to within 15 minutes AQL: 98% of the time

b) Standard:

a. Response time: System shall be returned to operational condition within 96 business hours after Government coordination and approval

b. Uptime Rate: 99% of all locations; Uptime is defined as the time equipment and system are operational without restrictions.

Deliverables:

A006 Monthly Alert and Services Report (See 3.5.1) A011 Weekly Unresolved Alert and Services Report (See 3.5.1)

3.5 Monitoring and Help Desk

3.5.1 Provide 24/7 phone access for response to any phone or email notifications for SNS, State, and local entities.

1. Contractor shall provide staff to respond to alert notifications and questions 24/7.

2. The contractor shall be responsible for triaging and responding to all alerts/alarms that are caused by a malfunction of their hardware. However, the contractor shall notify the SNS/ASPR POCs if a facility is out of established temperature range or a door alarm has occurred within 15 minutes of incident. All other incidents will be reported within 24 hours after initial alarm.

3. The following designees will receive initial alarm notifications:

A. For a temperature, power or door alarm:

1) Site primary or alternate POC

2) The designated SNS Logistics POCs

3) The COR or designees

B. For connectivity and battery alarm:

1) The designated SNS Logistics POCs

2) The COR or designees

4. The contractor shall be responsible for investigating and identifying root cause(s) of all alerts/alarms within 24 hours when requested by the government. The contractor shall be responsible for resolving all alarms in consultation with the COR or designee, in order to minimize interruption of data collection.

5. Contractor support staff shall be reachable by phone 24/7.

6. All responses to alerts/alarms and resolutions shall be recorded and auditable.

Types of Alerts/Alarms:

Temperature exceeds 86 degrees Fahrenheit for 24 continuous hours

Temperature exceeds 104 degrees Fahrenheit for over 120 minutes

Temperature is below 46 degrees Fahrenheit for over 120 minutes

Door opened

Power failure

Connectivity failure (to include Telecommunications/Network/Hardware/Software Issues)

Battery failure

A. A Monthly Alerts and Services Report (A006) will be supplied to represent issues addressed during that month. This report should include all incidents, alarms and service reports from the previous month. This report is due on the 10th business day of the month. This report shall be emailed in pdf form to addressees which will be provided upon contract award. Additional emails if necessary, will be added.

This report shall include the following:

1) Site

2) Container Number (as applicable)

3) Issue

4) Date of Alert or Service Required (Work order initiated)

5) Open or Closed (Status)

6) Date Issue Resolved

7) Actions performed to resolve the issue or why issue is still open. Estimated time for completion.

B. A Weekly Unresolved Alert and Services Report will be supplied to identify any current unresolved alerts and services. This report should include all current open incidents, alarms and service reports. This report is due weekly. This report shall be emailed to addressees which will be provided upon contract award. Additional emails, if necessary, will be added.

This report shall include the following:

1) Site

2) Container Number (as applicable)

3) Issue

4) Date of Alert or Service Required (Work Order Initiated)

5) Actions performed to resolve the issue or why issue is still open. Estimated time for completion.

Performance Standards

a) Standard: Calls answered or responded to within 15 minutes AQL: 98% of the time

b) Standard: Calls no more than 15 minutes on hold AQL: 90% of the time

c) Standard: No more than four (4) validated complaints per quarter AQL: 75% of the time

d) Standard: Notify the Designees via phone, text, and email within 15 minutes of an alert/ alarm.

SNS Logistics POCs will provide the name of the designees upon award.

AQL: 99% of the time

A006 Monthly Alert and Services Report A011 Weekly Unresolved Alert and Services Report

3.5.2 Disable/Reenable Door Alarms during Product Rotation

Contractor shall coordinate with SNS Logistics POCs concerning planned daily/weekly container door openings where the door alarm will be disabled and then reenabled during product rotation by SNS personnel or onsite local staff. Contractor will provide Scheduled Door Opening report daily to indicate alerts of doors that have been opened during the coordinated period of time.

Performance Standards Standard: Submit daily/weekly Scheduled Door Opening Report as coordinated with SNS Logistics POCs AQL: 98% of time

Deliverable:

A004 Scheduled Door Opening Report

3.5.3 Container Moves

There are three special types of container moves: Special events, Emergency, and Planned moves. All container moves will be determined, initiated, and carried out by SNS. For all of these moves, coordination with SNS Logistics POCs will be needed. Due to the specific need, there may be some locations where maintenance support is required for ensuring connectivity, power connection, and device configuration. As sensors should record data for 30 days, they should report all data once reconnected. SNS will notify the contractor to reconnect the container once it reaches its destination as needed. Once the container has arrived and been connected at the final destination, the contractor shall notify the COR or designee.

Contactor will be responsible for travel to sites as necessary upon coordination with SNS Logistics POC.

SNS Logistics POCs shall direct contractor to disable specific locations, cache sites, containers, or sensors that need to be disabled permanently or temporarily.

4. Special Requirements

This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

4.1 Security and Safety

This section describes the security and safety for this effort. The following sub-sections provide details of various considerations on this effort.

4.1.1 Security

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

"contract), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix B, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [] Low [ ] Moderate [ X ] High

Integrity: [] Low [X] Moderate [ ] High

Availability: [X] Low [ ] Moderate [ ] High

Overall Risk Level: [] Low [ ] Moderate [X] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Examples of PII include, but are not limited to the following: social security number, date and place of birth, mothers maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information. The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling refers to "any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information. 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and ASPR policies. Unauthorized disclosure of information will be subject to the HHS/ASPR sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents [ASPR specify which documents/forms will be provided to contractor] to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR [ASPR-provided delivery date].

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keyshttp://csrc.nist.gov/publications/. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the OpDiv non-disclosure agreement. [OpDiv inserted information/link should be cited here], as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) The Contractor shall assist the OpDiv Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv

SOP or designee with completing a PIA for the system or information within 90 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the OpDiv SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under…