ThinkTrends SOW.pdf

Solicitation No. 75F40126R00097 Think Trends Software Implementation and Support

DEPARTMENT OF HEALTH AND HUMAN SERVICES

FOOD AND DRUG ADMINISTRATION

REQUEST FOR PROPOSAL (RFP)

SOLICITATION NO. 75F40126R00097

ThinkTrends Software Implementation and Support Indefinite Delivery, Indefinite Quantity (IDIQ) Contract

Field Information Solicitation Number: 75F40126R00097 Solicitation Type: Request for Proposal (RFP) Set-Aside: Total Small Business Set-Aside NAICS Code: 541511 – Custom Computer Programming Services Small Business Size Standard: $34 Million Contract Type: Single Award IDIQ – Firm Fixed Price (FFP) with

Labor-Hour (LH) Task Orders Estimated Maximum Contract Value: $49,000,000.00 Minimum Guarantee: $2,500.00 Proposals Due: September 28, 2026, 1:00 PM EST Contracting Officer: Lilibeth Deato | lilibeth.deato@fda.hhs.gov Posting: SAM.gov

PART I – THE SCHEDULE

SECTION A – SOLICITATION/CONTRACT FORM

A.1 NOTICE OF COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL SERVICES

This is a combined synopsis/solicitation for commercial services prepared in accordance with FAR 12.202(b)(1) as implemented through the Revolutionary Federal Acquisition Regulation Overhaul (RFO) (Apr. 20, 2026), adopted via HHS FAR Class Deviation (CD) No. 2025-09, Amendment 1 (Nov. 3, 2025). This announcement constitutes the solicitation only; a separate written solicitation will not be issued. Solicitation Number 75F40126R00097 is issued as a Request for Proposal (RFP) for the ThinkTrends Software Implementation and Support Indefinite Delivery, Indefinite Quantity (IDIQ) Contract, in accordance with RFO FAR Part 12 – Acquisition of Commercial Products and Commercial Services.

A.2 NOTICE OF SET-ASIDE

This acquisition is a Total Small Business Set-Aside pursuant to FAR 19.502-2. The NAICS code is 541511 – Custom Computer Programming Services. The small business size standard is $34 million.

A.3 PROPOSAL DUE DATE

All Offerors shall submit proposals electronically via email to lilibeth.deato@fda.hhs.gov no later than September 28, 2026, by 1:00 PM EST. All electronic documents must be submitted without macros. Do NOT include .exe, .mso, or other executable file types. Submissions containing macros or executable files will be considered non-responsive with no opportunity to correct prior to award.

A.4 APPLICABLE REGULATIONS AND FAR CIRCULAR

This solicitation incorporates FAR provisions and clauses in effect through Federal Acquisition Circular (FAC) 2026-01, effective March 13, 2026. Full text of FAR provisions and clauses may be accessed at https://www.acquisition.gov/far/part-52 and https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-52.

The Department of Health and Human Services (HHS) Acquisition Regulation (HHSAR) provisions and clauses referenced in this solicitation can be found on the following websites:

• HHSAR (effective February 2, 2022): https://www.acquisition.gov/hhsar/part-352-solicitation-provisions-and-contract-clauses

• HHSAR Class Deviations: https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/index.html

• RFO HHSAR Part 352: https://www.hhs.gov/grants-contracts/contracts/contract-policies-regulations/index.html

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 BRIEF DESCRIPTION OF REQUIREMENT

The Food and Drug Administration (FDA) requires comprehensive technical expertise to support the implementation of ThinkTrends software and related human interventions across various FDA operations. This IDIQ contract aims to leverage cutting-edge Artificial Intelligence (AI) technologies to significantly improve FDA's operational efficiency, data management, and regulatory processes.

B.2 CONTRACT TYPE

This is a single-award Indefinite Delivery, Indefinite Quantity (IDIQ) contract, Firm Fixed Price (FFP) type contract vehicle, with authorized task order types of Labor-Hour (LH) and Firm-Fixed-Price (FFP), in accordance with FAR 16.504.

B.3 MINIMUM AND MAXIMUM CONTRACT VALUE

In accordance with FAR 16.504(a)(1), the Government guarantees a minimum ordering obligation of $2,500.00 (two thousand five hundred dollars) under this contract, to be satisfied by award of the initial task order. The maximum ceiling contract value shall not exceed $49,000,000.00, inclusive of all option periods.

B.4 PRICING TERMS

B.4.1 General Pricing The Contractor's pricing schedules shall contain fully burdened hourly rates inclusive of wages, indirect costs, fringe benefits, overhead, G&A costs, and profit. Rates apply at both Government and non-Government sites. (See Attachment #1 – Pricing Worksheet.)

B.4.2 Firm Fixed Price Task Orders FFP task order pricing is fixed for the period of performance and not subject to adjustment, except as a result of direct Government action or inaction causing delays. The Contractor shall comply with FAR Clause 52.232-1, Payments (APR 1984).

B.4.3 Labor Hour Task Orders Each LH task order shall contain a Not-to-Exceed (NTE) obligated ceiling price. Unit labor hour prices are fixed for the task order period of performance and not subject to adjustment except through modification. The Contractor shall not perform or be paid for work exceeding the NTE price. The Contractor shall comply with FAR 52.232-7, Payments Under Time-and-Materials and Labor-Hour Contracts (NOV 2021).

B.5 AUTHORIZED ORDERING OFFICIALS

Only FDA Office of Acquisitions & Grant Services (OAGS) Contracting Officers are authorized to place task orders under this IDIQ contract.

B.6 ORDERING PROCEDURES

When a need for services arises, the FDA will issue a Request for Task Order Proposal (RFTOP) and place individual orders in accordance with FAR 16.505. The process for awarding orders will generally be as follows:

1. The FDA OAGS Contracting Officer or Specialist will issue an RFTOP via email. The RFTOP will include at a minimum a Statement of Work (SOW), the period of performance, the anticipated task order pricing structure, reporting requirements and deliverables, and any special terms and conditions which will apply to the resulting order.

2. Within ten (10) business days of receipt of the RFTOP (unless another timeframe is specified in writing), the Contractor shall provide a proposal to the Contracting Officer. The proposal must include a brief description of the technical approach and a price build-up including labor categories, hours, extended pricing, and total price.

3. FDA will evaluate the proposal for technical acceptability and price reasonableness, considering technical approach, labor mix appropriateness, and sufficiency of level of effort. If FDA has questions or concerns, the Contracting Officer or Specialist will contact the Contractor and may request a revised proposal.

4. Once the proposal and price are determined acceptable, the Contracting Officer may issue the task order. Task orders will include the information described in FAR 16.505(a)(7). Any work undertaken by the Contractor prior to receiving a fully executed task order or written Authorization to Proceed from the Contracting Officer is undertaken at the Contractor's sole risk.

SECTION C – STATEMENT OF WORK

C.1 INTRODUCTION AND BACKGROUND

The Food and Drug Administration (FDA) is responsible for protecting the public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and by ensuring the safety of our nation's food supply, cosmetics, and products that emit radiation. The FDA also has responsibility for regulating the manufacturing, marketing, and distribution of tobacco products to protect the public health and to reduce tobacco use by minors.

The FDA conducts regular inspections of manufacturing facilities, clinical trial sites, and laboratories to verify compliance. In addition to inspections, the FDA's compliance efforts include monitoring adverse event reports, reviewing product quality complaints, and overseeing recalls when necessary.

FDA seeks to leverage the capabilities of ThinkTrends to advance the efficiency of some existing regulatory tools and systems, and to build emerging requirements into new systems to be implemented. ThinkTrends is a software with artificial intelligence capabilities for data-driven tasks and activities, already being demonstrated in some FDA tools, including FDA Adverse Events Reporting System (FAERS), Site Selection Tools, and BIMO Evaluation Support Tool

(BEST).

C.2 OBJECTIVES

The purpose of this IDIQ contract is to acquire comprehensive technical expertise to support ThinkTrends software implementation and related human interventions across FDA operations. Primary focus areas include:

• Advanced Data Management and Processing: Complex Data Migration and Integration across legacy and modern systems; Intelligent Data Cleansing using machine learning algorithms; Advanced Data Cataloging, Annotation and Labeling with AI-assisted metadata generation; Implementation of data lakes and data mesh architectures.

• Emerging Technologies Integration: Robotic Process Automation (RPA); AI Model Management with focus on explainable AI for regulatory compliance; AI-based OCR solutions achieving greater than 90% accuracy;

Blockchain for secure and transparent data sharing; edge computing for real-time data processing; Generative AI and Natural Language Processing; Large Language Models (LLMs) for automated summarization.

• Intelligent Question-Answering Systems for Reviewers: AI-powered tools to enhance reviewer efficiency by automating routine aspects of the review process; generation of initial draft responses for common regulatory queries.

• Advanced Visualization and Analysis: Interactive and AI-driven Dashboard and Visualization Support; Predictive analytics for trend analysis and risk assessment; Virtual and Augmented Reality interfaces for complex data visualization.

• Automation and Process Enhancement: Intelligent workflow automation for regulatory processes; AI-driven quality control and error detection in submissions; Automated tracking and management of regulatory commitments.

• Specific FDA System Enhancements: Next-generation OCR Capabilities for site selection tools and BEST; FAERS support with AI-powered signal detection; Advanced Digitization of PDF Adverse Event Reports to XML using Document AI Technology.

• Data-Driven Regulatory Tools and Systems: Development of AI-powered decision support systems;

Implementation of machine learning models for predicting regulatory outcomes; Creation of digital twins for simulating and optimizing regulatory processes.

• Enhanced User Experiences: Intuitive AI-assisted user interfaces; personalized dashboards; voice-activated assistants for hands-free data access.

• Comprehensive Support: Strategic ThinkTrends software license acquisitions and integration; Agile Project and Program Management; Continuous training and upskilling programs for FDA staff.

C.3 SCOPE

The FDA is embarking on an ambitious technological transformation to modernize its operations and enhance its regulatory capabilities. This initiative encompasses modernization of FDA's data infrastructure; integration of emerging technologies including AI, blockchain, and edge computing; utilization of generative AI and NLP to automate and augment review processes; advanced visualization and analysis tools; automation and process enhancement;

development of data-driven regulatory tools; user experience improvements; and comprehensive support including strategic software acquisition, agile project management, and continuous staff training.

C.4 ADMINISTRATIVE TASK REQUIREMENTS

C.4.1 Project Management The Contractor shall perform project management activities for efforts awarded as part of a task order. The Contractor shall manage cost, schedule, and quality daily throughout the period of performance.

C.4.2 IDIQ Program Management The Contractor shall provide overarching management of all task orders under this IDIQ contract, including developing, maintaining, and updating a Program Management Plan (PMP). Activities include directing and coordinating project staff; executing application developments and enhancements; managing software version control; managing user documentation; and planning transition-in and transition-out activities.

C.4.3 Task Order Management The Contractor shall provide specific management of each task order, including developing and maintaining a Task Order Management Plan (TOMP) addressing: requirements management; change control; risk management; schedule management; cost management; quality management; performance metrics; communications; and resource management including subcontractors and staff.

C.4.4 Personnel Management The Contractor shall coordinate all on-boarding and off-boarding activities. Resumes for new or replacement personnel shall be submitted to the COR for verification prior to commencing work. The Contractor shall provide the COR a minimum of thirty (30) calendar days' notice prior to any change in designated Key Personnel.

C.4.5 Meetings The Contractor shall support routine project management and status meetings, prepare and track meeting agendas, minutes, notes, issues, and action items. The Contractor shall schedule and facilitate a kickoff meeting within five (5) calendar days after contract award, and shall prepare a Kickoff Meeting Summary documenting key decisions, actions, milestones, issues, and concerns.

C.4.6 Reporting The Contractor shall immediately and proactively inform the COR, Project Manager(s), and/or designee of all issues, problems, and recommendations affecting effective accomplishment of Task Order goals.

C.4.6.1 Weekly Status Reports: The Contractor shall participate in weekly status calls with the COR and provide a written summary on the third working day following the Government-scheduled weekly meeting.

C.4.6.2 Monthly Status Reports: The Contractor shall submit monthly progress reports covering all requirements and tasks in active Task Orders. Within the first thirty (30) days after contract award, the Contractor shall propose a reporting format for Government approval.

C.4.6.3 Project Closure Reports: The Contractor shall prepare and submit a comprehensive Project Closure Report upon completion of each Task Order.

C.4.7 Transition At the conclusion of this contract, the Contractor shall facilitate transition of all work, data, and artifacts to the Government or a successor contractor, ensuring efficient transfer of information, expert knowledge, and deliverables to minimize disruption to FDA operations.

C.5 TASK AREAS

C.5.1 Digitizing PDF Adverse Event Reports to XML Using Document AI Technology The Contractor shall expand the existing ThinkTrends FAERS platform to support the core adverse event and product complaint needs of all FDA Centers by applying Document AI algorithms to digitize Adverse Event PDF files into E2B XML format for processing by the LSMV system. The Contractor shall connect to data sources across FDA Centers, retrieve PDF reports, apply a Document AI model to convert them to E2B XML files, and integrate the digitization platform with downstream systems to reduce manual data entry, improve data quality, and accelerate the regulatory review process.

C.5.2 Digitizing Document Rooms Using Document AI Technology The Contractor shall enhance Document AI capabilities to meet FDA's immediate data needs and reduce processing costs by assessing current Document Room operations, identifying process gaps, and addressing issues promptly. The Contractor shall provide an API to support integration with downstream systems and shall generate daily audit log reports to track document processing issues, identify root causes, and implement proactive mitigation strategies.

C.5.3 OCR Capabilities in Site Selection Tools The Contractor shall leverage ThinkTrends software as an OCR extraction tool for Site Selection tools, supporting AI, Intelligent Character Recognition (ICR), and Robotic Process Automation (RPA) workflows for PDF scanning and intelligent text extraction. OCR solutions must achieve greater than ninety percent (90%) accuracy.

C.5.4 OCR Capabilities in BIMO Evaluation Support Tool (BEST) The Contractor shall leverage ThinkTrends software to facilitate PDF extraction, conversion, verification, and automation of bioanalytical data used in the BEST tool — including its Audit Trail Review Module and Data Comparison Module. OCR solutions must achieve greater than ninety percent (90%) accuracy.

C.5.5 Support Adverse Event Monitoring The Contractor shall provide digitization support by converting PDF-based adverse event reports into E2B XML format for initial system ingestion, develop comprehensive audit logs to ensure data traceability, and continue ongoing incoming file conversion to feed the Adverse Event Monitoring (AEM) system.

C.5.6 Data Migration and Integration Activities The Contractor shall explore or develop APIs to support upstream and downstream system integration, ensuring seamless data exchange across platforms, and shall implement monitoring mechanisms to track API performance and connectivity for proactive issue resolution.

C.5.7 Data-Driven Regulatory Tools and Systems Support

The Contractor shall provide sustained support for the development, enhancement, and maintenance of data-driven tools and systems, including Data Integration and Interoperability; User-Centric Design; ongoing technical support; and incorporation of data analytics, visualization, and decision support capabilities.

C.5.8 ThinkTrends Software License Acquisitions The Contractor shall support the acquisition and installation of ThinkTrends software licenses on an annual basis. A dedicated task order for license acquisitions shall be maintained under this IDIQ contract given the high anticipated demand across FDA.

C.5.9 Project and Program Management for Data-Driven Activities The Contractor shall provide robust project and program management including strategic planning and governance;

integrated program oversight; stakeholder engagement and communication; agile and adaptive project execution; risk and change management; and performance monitoring and metrics.

SECTION D – PACKAGING, MARKING AND SHIPPING

All deliverables required under this contract shall be packaged, marked, and shipped in accordance with Government specifications. At a minimum, all deliverables shall be marked with the contract number and Contractor name. The Contractor shall provide the COR an electronic copy of each deliverable in a format specified by the COR. The COR will review and provide comments within ten (10) working days of receipt. The Contractor will have five (5) working days to incorporate comments and resubmit. This 10/5-day cycle will repeat until Government acceptance. All artifacts (e.g., scripts, software, source code) developed under this contract shall be provided to the COR and shall become the property of the Government.

SECTION E – INSPECTION AND ACCEPTANCE

E.1 CLAUSES INCORPORATED BY REFERENCE

For Firm-Fixed-Price (FFP) Task Orders: The Contractor must comply with paragraph (b), Inspection/Acceptance, of RFO FAR Clause 52.212-4, Terms and Conditions—Commercial Products and Commercial Services (Deviation Date) [HHS FAR CD 2025-09, Amendment 1 (Nov. 3, 2025), RFO FAR 12.205(b)(1) (Apr. 20, 2026), RFO FAR 52 (July 1, 2026)].

For Labor-Hour (LH) Task Orders: The Contractor shall comply with paragraph (b), Inspection/Acceptance, of RFO FAR clause 52.212-4, Alternate I (Deviation Date) [HHS FAR CD 2025-09, Amendment 1 (Nov. 3, 2025), RFO FAR 12.205(b)(1) (Apr. 20, 2026), RFO FAR 52 (July 1, 2026)].

E.2 INSPECTION AND ACCEPTANCE

Satisfactory performance of this contract shall be deemed to occur upon performance of the work and upon delivery and acceptance. The task order (TO) Contracting Officer's Representative (COR) will conduct inspection and acceptance of materials and services provided in each TO. If a deliverable is found by the TO COR to be sub-standard, the Contractor may be required to make alterations until the deliverable meets standard expectations. A Quality Assurance Surveillance Plan (QASP) may be included in individual TOs. Acceptance may be presumed within ten (10) business days of receipt unless otherwise indicated in writing by the TO CO or TO COR.

SECTION F – DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

The total duration of the IDIQ ordering period is five (5) years (sixty (60) months), structured as follows:

Ordering Period Duration Base Year 12 months from date of award Option Year 1 12 months following Base Year Option Year 2 12 months following Option Year 1

Option Year 3 12 months following Option Year 2 Option Year 4 12 months following Option Year 3

The total contract value, inclusive of all option periods, shall not exceed $49,000,000.00. The total duration of this contract, including exercise of all options under FAR 52.217-9, shall not exceed five (5) years and six (6) months, including any extension under FAR 52.217-8.

F.2 TASK ORDER CONSTRAINTS

• Individual task orders may not exceed five (5) years, inclusive of option periods.

• Individual task orders may not extend further than one (1) year beyond the IDIQ ordering period end date.

• Any work undertaken by the Contractor prior to receiving a fully executed task order or written Authorization to

Proceed from the Contracting Officer is undertaken at the Contractor's sole risk.

F.3 ORDERING PROCEDURES

When a need for services arises, FDA will issue a Request for Task Order Proposal (RFTOP) via email, including at a minimum a Statement of Work, period of performance, anticipated pricing structure, reporting requirements, deliverables, and applicable special terms. The Contractor shall provide a proposal within ten (10) business days unless another timeframe is specified in writing. FDA will evaluate proposals for technical acceptability and price reasonableness prior to task order award in accordance with FAR 16.505.

SECTION G – CONTRACT ADMINISTRATION DATA

G.1 GOVERNMENT CONTACTS

Role Contact Information Contracting Officer (CO) Lilibeth Deato | lilibeth.deato@fda.hhs.gov Contracting Officer's Representative (COR) To Be Determined at Award

G.2 ORDERING PROCEDURES

The Government will issue individual Task Orders under this IDIQ contract in accordance with RFO FAR 16.505 (July 1, 2026) [adopted via HHS FAR CD 2026-01, Amendment 2 (Apr. 24, 2026)]. Per FAR Clause 52.216-18(b), all task orders are subject to the terms and conditions of this contract. In the event of conflict between a task order and this contract, the contract shall control. See Section B.6 for the complete ordering process.

G.3 PRICING OF ORDERS

Proposals submitted in response to a RFTOP must use labor rates equal to or less than the established IDIQ Ordering Period labor rates. Those rates apply for the duration of the task order performance period. For task orders exceeding twelve (12) months, the Contractor may propose the applicable ordering period rate for performance after the twelve-month mark. The Contractor may propose lower rates in response to any RFTOP.

G.4 GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION

On-site FDA facility space shall be specified on a task order basis. The Contractor is responsible for all connectivity at its location. The COR will provide cloud and on-premises resources needed to implement solutions defined in the scope.

The following Government-Furnished Equipment (GFE) will be provided to Contractor staff assigned for long-term support, contingent upon a successful background investigation:

• FDA imaged laptop, docking station, standard FDA application suite, and peripheral devices

• FDA network and email accounts

• FDA site access and identity badge

• Access to shared network resources (printers, scanners, storage, FDA Intranet) as needed

• iPhone or similar communication devices, if determined necessary by the COR

G.5 BUSINESS HOURS AND COVERAGE

Work is to be performed during normal business hours (typically 8:00 AM to 5:00 PM Eastern), Monday through Friday.

Flexible hours are permitted with COR approval. Weekend and after-hours support is not generally required; however, for scheduled outages or system implementations, after-hours or weekend support may be required. Planned after-hours work must follow the FDA Change Control Board process and must be submitted a minimum of two (2) weeks in advance.

G.6 OBSERVANCE OF LEGAL HOLIDAYS

On days that the Government is closed, the Contractor shall not work on-site at FDA facilities. With prior COR approval and proper equipment and connectivity, the Contractor may work remotely. Recognized Federal holidays include:

• New Year's Day

• Martin Luther King Jr. Day

• Presidents' Day

• Memorial Day

• Juneteenth National Independence Day

• Independence Day

• Labor Day

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

For unscheduled closings (e.g., weather emergencies, power outages), the Contractor shall seek guidance from the COR.

G.7 TRAVEL

All travel shall comply with the Federal Travel Regulations (FTR). Specific travel requirements will be defined at the task order level. Travel must have prior written COR approval and shall be reimbursed in strict conformance with FAR Subpart 31.205-46.

G.8 PERSONNEL

The Contractor shall ensure all personnel are adequately trained, credentialed, and fully qualified to provide the high level of support required by this contract. Personnel shall provide the COR with contact information for use during contract execution.

G.9 KEY PERSONNEL

The Contractor shall designate all Key Personnel pursuant to HHSAR Clause 352.237-75, Key Personnel (December 2015). At least 30 days prior to diverting any specified individual to other programs or contracts, the Contractor shall notify the Contracting Officer and submit comprehensive justification for the diversion or replacement request. The Contractor shall not divert or otherwise replace any key personnel without the written consent of the Contracting Officer.

G.10 IDIQ CONTRACT ROLES AND RESPONSIBILITIES

G.10.1 Contracting Officer (CO) Authority The Contracting Officer (CO) has sole authority to enter into, administer, or terminate this IDIQ contract and any resulting task orders. The CO is the only person authorized to approve changes to any requirements under this contract.

No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this contract. The Government shall not reimburse the Contractor for any work not authorized by the CO.

G.10.2 IDIQ Contract Contracting Officer's Representative (COR) Authority The Contracting Officer may designate other Government personnel as COR to act as authorized representative for contract administration functions which do not involve changes to scope, price, schedule, or terms and conditions. The COR is responsible for: interpreting scope of task areas identified in the contract SOW; acting as a Government escalation point for potential Contractor resource conflicts across task orders; and monitoring estimated total contract value over the life of the IDIQ.

G.10.3 Task Order COR Roles and Responsibilities The Task Order COR is responsible for: monitoring the Contractor's technical progress; interpreting the Statement of Work and other technical performance requirements; performing technical evaluations, inspections, and acceptances;

assisting in resolution of technical problems; and reviewing invoices and vouchers.

G.11 INVOICING – INVOICE PROCESSING PLATFORM (IPP)

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

a) All Invoice submissions for goods and or services must be made electronically through the U.S. Department of Treasury’s Invoice Processing Platform System (IPP).http://www.ipp.gov/vendors/index.htm

b) Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b) “Content of Invoices” and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions Commercial Items included in commercial items contracts.

The IPP website address is: https://www.ipp.gov.

c)

1) The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor

2) Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 5 business days of the contract award for new contracts or date of modification for existing contracts.

3) Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

4) The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

5) If your company is already registered to use IPP, you will not be required to re- register.

d) If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

e) Invoices that include time and materials or labor hours Line Items must include supporting documentation to

(1) substantiate the number of labor hours invoiced for each labor category, and (2) substantiate material costs incurred (when applicable). Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

http://www.ipp.gov/vendors/index.htm http://www.ipp.gov/ mailto:ipp.noreply@mail.eroc.twai.gov mailto:IPPCustomerSupport@fiscal.treasury.gov

1) At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

- Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)-show rate, base and total amount;

- Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

- Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

- Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

- Fee amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

b ) Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(1) list of all invoices submitted to date under the subject award, including the following:

- invoice number, amount, & date submitted

- corresponding payment amount & date received

- total amount of all payments received to date under the subject contract or order

- and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

(END OF CLAUSE)

mailto:ERIC@fda.hhs.gov

G.12 SALARY RATE LIMITATION

Pursuant to HHSAR 352.231-70 (RFO Deviation) [HHSAR CD 2026-02 (Feb. 7, 2026)], contract funds shall not be used to pay the direct salary of an individual at a rate exceeding the Federal Executive Schedule Level II in effect on the date funding was obligated. This limitation applies to subcontractors and must be flowed down to all subcontracts.

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 SECURITY REQUIREMENTS

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

Confidentiality: [ ] Low [ ] Moderate [X] High Integrity:

[ ] Low [ ] Moderate [X] High Availability:[X] Low [ ] Moderate [ ] High Overall Risk Level: [X ] Low [] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[] No PII [X] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI.

32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information."

81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

1. Marked appropriately;

2. Disclosed to authorized personnel on a Need-To-Know basis;

3. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

4. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries. FDA personnel must also request loaner GFE from the FDA Foreign Travel program for official travel to any foreign country. Please see the FDA IS2P, Appendix T Government Furnished Equipment for Foreign Travel.

h. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor.

Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS and FDA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

i. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB

Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

j. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

k. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

l. Contract Documentation. The Contractor must use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

m. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with an encryption solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and FDA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module

Validation Program to confirm compliance with current FIPS 140 validation certificates from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the

COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/.

Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

n. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must http://csrc.nist.gov/publications/ complete the FDA non- disclosure agreement (3398 Form)], as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable FDA information security awareness, privacy, and records management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete FDA information security awareness, privacy, and records management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and FDA policies and standards.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Agency data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter,…