A01 EGS Sources Sought.docx

Subject: Management of the Electronic Grants System (EGS) sponsored by the Congressionally Directed Medical Research Program’s (CDMRP)

THIS IS NOT A REQUEST FOR PROPOSALS (RFP) OR A REQUEST FOR QUOTATIONS (RFQ); IT IS STRICTLY A REQUEST FOR INFORMATION (RFI). NEITHER UNSOLICITED PROPOSALS NOR ANY OTHER KINDS OF OFFERS WILL BE CONSIDERED IN RESPONSE TO THIS RFI. NO CONTRACT WILL BE AWARDED PURSUANT TO THIS ANNOUNCEMENT.

1.0 DISCLAIMER: This RFI is issued solely for information and planning purposes and does not constitute a solicitation. Neither unsolicited proposals nor any other kind of offers will be considered in response to this RFI. Responses to this notice are not offers and will not be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI. All information received in response to this RFI that is marked Proprietary will be handled accordingly. Responses to the RFI will not be returned. At this time, questions concerning the composition and requirements for a future RFP will not be entertained.

2.0 SUBJECT: To award a contract for management of the Electronic Grants System (EGS) sponsored by the Congressionally Directed Medical Research Program’s (CDMRP). To support the tasks identified below requires an experienced and cohesive team of junior and senior level Information Technology and Information Management Personnel to include project managers, application developers, engineers and database administrators who can demonstrate a comprehensive understanding of the requirements to perform tasks and produce acceptable deliverables within required timelines while meeting cost, schedule, and performance requirements. The Government reserves the right to include support for other Federal agencies in the utilization of EGS. These efforts may be in conjunction with changes directed by United States Army Futures Command or a separate task. The Contractor shall provide all necessary qualified personnel to support each of the selected organizations in Attachment 1.

3.0 BACKGROUND: The Medical Research and Development Command is a Direct Reporting Unit (DRU) to Army Futures Command. EGS is a Government-owned, contractor-operated mission-support business system designed to address core functions of biomedical research portfolio and awards management needs for CDMRP and other organizations. It stores biomedical research proposal and award data and files including contracting, regulatory, administrative, and other relevant information. EGS has many functional components designed to automate administrative processes including proposal management, awards management, program management, and program evaluation. A number of system-to-system interfaces facilitate interactions and data transfers with external systems owned and operated by contractors and other agencies. It supports a number of electronic workflows, including progress report reviews, award negotiations, regulatory review and approval, product management, and website data management. EGS currently supports 442 users and contains 138,000 proposal records, 18,925 award records. On an annual basis, an average of 7,423 new proposals are created, 5,090active awards are managed and 950 new awards are initiated. EGS is a web-based application supported by a database back-end. The primary technologies utilized by EGS are VMWare ESC, Linus OS, Java-JDK + Oracle RDBMS, and Apache Tomcat-outputting HTML, XML, CSV, XLS, and static files.

4.0 RESPOSE INSTURCTIONS:

Respondents should address the following in their submission:

· Name and address of company.

· Any small business designation as certified by the Small Business Administration and applicable certification.

· A thorough description of experience in managing support requirements of this nature.

· Demonstrate experience in managing the Electronic Grants System (EGS) sponsored by the Congressionally Directed Medical Research Program’s (CDMRP).

· Past performance for the same and/or similar projects of the same size and complexity.

· Any business arrangements that you have with other firms that would enhance your ability to provide the outlined effort, to include key personnel.

5.0 CONTACT INFORMATION: Any and all questions related to this RFI shall be directed to Jared D. Acre at jared.d.acre.civ@mail.mil. All information regarding responses to section 4 or any other proprietary information relative to this RFI shall be submitted via email to jared.d.acre.civ@mail.mil. No later than 4:00 PM (EST) on 5 December 2019.

Attachment 1:

Management of the Electronic Grants System (EGS) sponsored by the Congressionally Directed Medical Research Program’s (CDMRP)

SECTION 1.0: GENERAL INFORMATION

1.1 Purpose

To award a contract for management of the Electronic Grants System (EGS) sponsored by the Congressionally Directed Medical Research Program’s (CDMRP).

To support the tasks identified below requires an experienced and cohesive team of junior and senior level Information Technology and Information Management Personnel to include project managers, application developers, engineers and database administrators who can demonstrate a comprehensive understanding of the requirements to perform tasks and produce acceptable deliverables within required timelines while meeting cost, schedule, and performance requirements.

The Government reserves the right to include support for other Federal agencies in the utilization of EGS. These efforts may be in conjunction with changes directed by United States Army Futures Command or a separate task. The Contractor shall provide all necessary qualified personnel to support each of the selected organizations.

1.2 Background

The Medical Research and Development Command is a Direct Reporting Unit (DRU) to Army Futures Command.

EGS is a Government-owned, contractor-operated mission-support business system designed to address core functions of biomedical research portfolio and awards management needs for CDMRP and other organizations. It stores biomedical research proposal and award data and files including contracting, regulatory, administrative, and other relevant information. EGS has many functional components designed to automate administrative processes including proposal management, awards management, program management, and program evaluation. A number of system-to-system interfaces facilitate interactions and data transfers with external systems owned and operated by contractors and other agencies. It supports a number of electronic workflows, including progress report reviews, award negotiations, regulatory review and approval, product management, and website data management. EGS currently supports 442 users and contains 138,000 proposal records, 18,925 award records. On an annual basis, an average of 7,423 new proposals are created, 5,090 active awards are managed and 950 new awards are initiated.

EGS is a web-based application supported by a database back-end. The primary technologies utilized by EGS are VMWare ESC, Linus OS, Java-JDK + Oracle RDBMS, and Apache Tomcat-outputting HTML, XML, CSV, XLS, and static files.

1.3 Period of Performance

The anticipated period of performance of this contract is the effective date of contract award for 12 months. There will also be four option periods to be exercised at the discretion of the Government (total potential of a five year contract).

1.4. Key Personnel

Key Personnel will be identified at least one full time onsite project manager/technical lead for Objective 1 and at least two senior developers in support of Objective 2 and 3. Substitutions of proposed Key Personnel shall not be allowed for a period of six months after award, except under extreme circumstances. Any substitution or replacement of Key Personnel shall have qualifications equal to or greater than the individuals proposed. For temporary and/or permanent replacement of Key Personnel, the Contractor shall provide a resume for each individual to the Contracting Officer’s Representative (COR) and a written justification from the Contractor for the proposed individual. Resumes shall be provided at least one week (or as mutually agreed upon) prior to making any personnel changes. The government reserves the right to pre-approve any replacement or substitutions of Key Personnel. Contractor personnel must submit necessary information to start the clearance review process prior to reporting for performance.

1.4 CDMRP Hours of Operation

The CDMRP operates on a Monday through Friday work schedule. Overtime is only permitted when preapproved by the Contracting Officer. Overtime typically occurs during business travel. Normal hours of operation are 7:30 AM to 5:30 PM. staggered work schedules are allowed. Telework and alternate work schedules may be considered. Working outside normal hours on site for purposes of system maintenance and deployments are allowed with prior approval from the COR.

1.5 Contract Kick-Off Meeting

The Contractor shall contact the COR to set up a contract kick-off meeting with the COR and other designated staff, within 7 business days after the start date of the contract.

1.6 Contract Description

The Government intends on awarding a requirements contract with Firm Fixed Price and Cost CLINS.

1.7 Travel

Travel may be required to perform tasks in Section 4.0 below. The COR is the travel order approval authority as designated in writing by the Contracting Officer. All travel requirements including plans, agenda, itinerary, or dates shall be pre-approved by the COR and is on a strictly cost reimbursable basis. The Contractor shall be authorized travel expenses consistent with the substantive provisions of the JTR and the limitation of funds specified in the task order. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs, subject to local policy and procedures.

1.8 Non-Personal Services

This award identifies services that are strictly non-personal in nature.

1.9 Severable / Non-Severable Services

This award identifies services that are severable in nature.

1.10 Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

1.11 Organizational Conflict of Interest (OCI) Category

OCI is categorized into three broad categories, as defined in Attachment 1, for purposes of identifying, avoiding or mitigating against OCIs in accordance with FAR Subpart 9.5. If the Offeror/Contractor believes that a real or apparent OCI may exist as a result of an award, the Contractor shall also submit an OCI Mitigation Plan with its proposal as outlined in Attachment 1.

Contractor participation in more than one of these areas may give rise to an unfair competitive advantage resulting from access to advance acquisition planning, source selection sensitive or proprietary information. Furthermore, Contractor participation in more than one area may give rise to a real or apparent loss of Contractor impartiality and objectivity where its advisory or planning assistance in one area potentially affects its present or future participation in another area.

The purpose of this categorization is to accomplish the following three objectives: (1) to inform prospective Offerors that CDMRP presumes that award of a contract or order in the subject category will give rise to real or apparent OCI’s with respect to requirements in the other two categories and or may give rise to a CCI in the same category; (2) to assist current Contractors and prospective Offerors in developing their own business strategies regarding participation in CDMRP requirements and in identifying and, where possible, avoiding or mitigating against OCIs; and (3) to ensure that all current Contractors and prospective Offerors are afforded the maximum practicable opportunity to compete for all CDMRP requirements consistent with the restrictions required under FAR Subpart 9.5 and sound business practices.

For purposes of identifying and/or mitigating against OCIs, CDMRP will examine all its services requirements and acquisitions regardless of the cognizant contracting activity (e.g., USAMRAA, GSA, other agency Multiple Award Schedules, etc.) or the type of contract vehicle used (e.g., FSS order, Fair Opportunity competitive order under Multiple Award ID/IQ Contracts, competitively negotiated awards under FAR Part 15, etc.).

Each CDMRP services solicitation will therefore be designated as falling within one of the three above defined categories. The work called for under this contract / order has been determined by CDMRP to fall within the following OCI category:

Category 2: Program and/or Administrative Support

SECTION 2.0: GOVERNMENT-FURNISHED PROPERTY AND SERVICES

2.1 General Information

The Government will provide the facilities, equipment and materials listed here.

2.2 Government-Furnished Property

The Government will provide office space at the Government site designated in the task/delivery order. The Government will also make available a personal computer, telephone, fax machine, copying and scanning machine, printer, and supplies necessary for on-site personnel to perform the work on-site. If the employee is a teleworker, the Government will provide required Government furnished equipment, but telephone, internet connectivity, and other equipment will not be provided and shall be the sole responsibility of the contractor’s employee. Contractor shall identify computer specifications ideal for application development (processing speed, memory etc.). All work shall be conducted on Government owned servers which are hosted at the Fort Detrick Network Enterprise Center (NEC). Alternate strategies for application development and maintenance from off-site may be proposed within the limits allowable based on need to access Government network resources and equipment.

2.3 Government-Furnished Services

The Government will provide custodial, utility, pest control, telephone, refuse collection, and postage (Government related materials only) services for Government provided space.

All Government Furnished Property that is taken offsite shall be added to the contract as GFP.

2.4 Government-Mandated Training

All Government mandated training (partially noted in Section 3.0 below) is required for all individuals who are physically located at Fort Detrick or require network access, including Contractors. All Government mandated training will be Government furnished and shall be completed online or on-site during duty hours and in accordance with established timelines.

2.5 Government-Furnished Software

The Government will provide application development tools to include: Atlassian; a set of tools for bug tracking, agile development, revision control, collaboration and code reviews. In addition, SVN for code repository and Jenkins for Continuous Integration. Developers also currently utilize Java JDK, Mozilla Firefox, Microsoft Visio, Ultra Compare, Ultra Edit, Tableau, Balsamiq Mockups and Adobe Air. Other DoD approved software may be provided based on need. The Government will not provide software to be installed on non Government Furnished Equipment (GFE) or required for contract performance monitoring.

SECTION 3.0: CONTRACTOR REQUIREMENTS

3.1 Contractor Personnel Minimum Requirements

3.1.1 The Contractor shall have a signed letter of commitment from the proposed Key Personnel employees in response to this solicitation and must be available to begin work at the CDMRP provided facility (as outlined in section 2.2 above).

3.1.2 The Contractor shall accomplish the assigned work by employing and utilizing qualified personnel with skills, and when required, training, and experience. The Contractor shall match personnel skills to the work or task. The Contractor shall ensure the labor categories as defined in the Labor Categories and Descriptions labor rates, and man-hours utilized in the performance of each task order issued hereunder will be the minimum necessary to accomplish the task. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract and task orders as well as performance monitoring of contract activities. The Contractor must be able to provide ad hoc expertise as needed in various areas of IM/IT expertise to support EGS to include but not limited to requirements, design, security and data base administration.

3.1.3 All Contractor personnel requiring access to a Government information system who are proposed on this contract shall be designated as ADP III at a minimum as defined by Department of Defense Regulation 5200.2R (for reference, review http://www.dtic.mil/whs/directives/corres/pdf/52002r_0187/p52002r.pdf). Each employee must also be a United States citizen. This is necessary so the contract employee may be granted access to the Fort Detrick domain. The CDMRP shall initiate the process with the appropriate personnel at Fort Detrick for the successful Offeror’s employees to obtain a National Agency Clearance and Inquiries (NACI). If Contractor personnel are unable to receive a favorable NACI and/or be a United States citizen, that individual may not be employed under this contract.

3.1.4 All Contractor employees, including sub-Contractor employees, requiring access to Army Installations, facilities or controlled access areas shall complete AT Level I training within (30) calendar days after contract start date. The Contractor shall submit certificates of completion for each affected Contractor employee and sub-Contractor employee to the COR and CDMRP Training Officer within five (5) calendar days after completion of training by all employees and sub-contracting personnel. AT Level I awareness training is available at https://jko.jten.mil/courses/atl1/launch.html. .

3.1.5 The Contractor and all associated sub-Contractor employees shall comply with applicable installation, facility, area commander installation and facility access and local security policies and procedures. The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Security Office. The Contractor workforce must comply with all personnel identity verification requirements as directed by DoD, Headquarters Department of the Army (HQDA), and local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

3.1.6 All Contractor employees with access to a Government information system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services and must successfully complete the Cyber Awareness Challenge training prior to access to the information system and then annually thereafter.

The CDMRP Training Officer will register Contractor employees and will be responsible for tracking and uploading all training certificates into ATCTS.

3.1.7 All Contractor employees and associated sub-Contractor employees with access to a Government information system must complete Level I Operations Security (OPSEC) training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training thereafter.

3.1.8 All Contractor employees and associated sub-Contractor employees with access to a Government information system must complete the DoD Information Assurance (IA) Awareness training within 30 calendar days of their reporting for duty before issuance of network access and annually thereafter. All Contractor employees must comply with DoD and Army training requirements outlined in DoDD 8570.02, DoD 8570.01-M and AR 25- 2.

3.1.9 All Contractor employees and associated sub-Contractor employees with access to a Government information system must complete the initial Health Insurance Portability and Accountability Act (HIPAA) and Privacy Act Security Training before being granted access to the network. The Contractor and sub-Contractor employees shall then complete this training annually thereafter.

3.1.10 Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the Contractor employees supporting these functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. All full-time personnel supporting Task 4.3 on this contract are required to perform these functions at the Government provided facility. Personnel who are required to have Privileged level access to perform their duties must have the IAT Level 1 commercial certifications listed below at time of hire. In order to meet IAT Level 1 requirements, the proposed personnel must have one of the following CompTIA CE certifications to meet the Baseline Certification requirements: A+, Network+, or Security+ certification. Personnel proposed must also enroll in the continuing education program for those commercial certifications required in the IA Baseline Certification. Proposed personnel are also required to have a Computing Environment (CE) commercial certification (list of certifications that fulfill this requirement is extensive but most commercial certifications suffice). Note that the same IA Baseline Certification cannot fulfill the CE certification requirement. Costs for these certifications shall be the responsibility of the Contractor. However, if Government regulations change during the period of performance of this contract, the Government will be financially responsible for the costs for the Contractors’ personnel to comply with the new regulations.

SECTION 4.0: PERFORMANCE OBJECTIVES

The CDMRP requests Contractor to provide junior and senior level system developers, administrators, engineers and project management personnel to complete the following tasks which shall be detailed further in the task order performance work statement:

4.1 (Objective 1) Project Management The Contractor shall provide project management and administration services for EGS, overseeing major aspects of its development, enhancements, operations and technical support activities listed below.

Key Task 4.1.1 Project Management for EGS

4.1.1.1 The Contractor shall provide project management and administration services for EGS, overseeing development, enhancements, operations and technical support activities including the following: Project planning, timeline development, allocating Contractor resources to perform needed activities.

4.1.1.2 Supervise and track the Contractor’s team to ensure cost, schedule and performance requirements.

4.1.1.3 Oversee day to day operations and program support activities including notifying users and coordinating as necessary with external entities for server maintenance schedules, operating system changes and upgrades.

4.1.1.4 Document system level issues and provide a quarterly report outlining the steps taken and time to resolution. In addition, provide real time tracking of errors/issues and status of resolution.

4.1.1.5 Coordinate activities including development, quality control, testing, and deployments. Ensure software development quality controls based on industry and Government standards and expectations of the client

4.1.1.6 Work with Federal Program Manager (PM) and Business Systems Administrator (BSA) to discuss priorities, requirements, configuration control and risk management plans.

4.1.1.7 Document Agency specific requirements and process flow diagrams.

4.1.1.8 Document Agency-specific meeting discussions and provide to the COR or PM within 10 business days following the meeting conclusion.

Key Task 4.1.2: Requirements Gathering and Documentation

4.1.2.1 Communicate between application development teams and local customers

4.1.2.2 Define specifications for complex software programming applications

4.1.2.3 Resolve complex issues relating to business requirements and objectives

4.1.2.4 Analyze, develop and implement testing procedures, programming and documentation

4.1.2.5 Design and maintain process and software workflows and documentation

4.1.2.6 Develop system design, process flows and necessary technical architectural documents. Attend regularly-scheduled meetings with the COR or PM, other Contractors and Government organizations as requested by the COR or PM

4.1.2.7 Document meeting discussions and provide to the COR or PM within 10 business days following the meeting conclusion (deadline extensions must be pre-approved by the COR or PM).

4.2 (Objective 2) Research Program Support

The Contractor shall provide program support services to each research program or portfolio currently managed in EGS, any new programs/portfolios and user communities as needed to facilitate system use to include setup, re-configuration as needed, data and file manipulation such as transfers, exports and imports to meet program milestones and deliverables from other Contractors and organizations.

Key Task 4.2.1 Program Support

4.2.2 Provide day to day Program Evaluation support for use of EGS in execution DoD research programs and portfolios.

4.2.2.2 Establish and modify existing program setup as needed to meet evolving requirements.

4.2.2.3 Develop custom and standardized reports as requested to support individual programs, user communities and groups or ad hoc projects.

4.2.2.4 Support data requests from internal stakeholders as well as to support rapid requests from higher levels (i.e. Congress, USAMRMC, Defense Health Agency, DoD, Army, MEDCOM).

4.2.3 Provide Portfolio Analysis Support

4.2.4 Coordinate with CDMRP Data Managers for requests, quality control and consolidation as needed.

4.2.4.1 Provide support for exports of EGS data for import into other systems and in response to data requests from external sources.

4.2.4.2 Support activities related to migration of external user groups from other systems into EGS to include analysis of requirements, planning, and migration of data.

4.3 (Objective 3) Operations and Maintenance–

The Contractor shall provide all day to day system operations and maintenance support services to ensure system is operational.

Key Task 4.3.1. Provide Operations and Maintenance Services

4.3.1.1 Provide day to day system operations and maintenance support services.

4.3.1.2 Monitor system performance to identify inefficiencies and make recommendations for improvements.

4.3.1.3 Make the necessary changes to the EGS application and/or database to fix errors, defects and issues.

4.3.1.4 Ensure proper DoD IM/IT security procedures and protocols are followed and report any security concerns to the COR/PM/BSM.

4.3.1.5 Communicate and coordinate with System Administrators at DoD hosting facilities as well as with CDMRP IT and IA staff to meet new and or changing regulations and guidelines.

4.3.1.6 Monitor and ensure functionality of existing and new system to system interfaces and views, resolve issues and coordinate with stakeholders as needed. Update, install and test as needed DoD approved third party plugins and software.

Key Task 4.3.2 Provide Technical Support

4.3.2.1 Provide technical support services to include troubleshooting user reported errors and issues. Track and maintain records of user-reported errors/issues and status of resolution, keeping user informed as needed.

4.3.2.2 Create and maintain end-user accounts.

4.3.2.3 Assist Government and other staff (other contractors) who are responsible for EGS activities including maintenance of operating system, servers, software updates and security requirements as well as data management, user support personnel.

4.4 (Objective 4) System Development and Enhancements-

The Contractor shall provide system development and enhancement support services.

Key Task 4.4.1 Provide system development support services.

4.4.1.1 Analyze the Government’s requirements for new or enhanced system functions and features in order to plan, design, develop and implement such functions.

4.4.1.2 Provide timelines and milestones that describe how new or enhanced system functions and features shall be developed.

4.4.1.3 Write application code and make the necessary database changes, test, integrate and evaluate new or enhanced system functions and features. Utilize industry best practices for application development methodologies.

4.4.1.4 Monitor the performance of new or enhanced features; make any necessary changes to adjust for defects, errors and performance issues. Document new or enhanced system functions and features in a system design document.

Key Task 4.4.2. Application Testing and Quality Control

4.4.2.1. Provide automated and manual testing of system functionality

4.4.2.2 Design and develop test procedures (manual and scripted) based on software requirements, standards and usability

4.4.2.3 Prepare test case and test plan documentation; execute tests (manually and automated), analyze testing results and manage test script library and re-use; communicate/coordinate with application development team as needed.

Key Task 4.4.3. Integration services

4.4.3.1 Provide for integration of commercial or custom developed modules, plugins and other application components by 3rd party vendors and other contractors.

4.4.3.2 Communicate between application development teams and local customers.

4.4.3.3 Define system specifications, input/output processes and hardware/software compatibility.

4.4.3.4 Create technical documentations and present for internal and external use.

4.4.3.5 Provide support for code integration activities and perform branch integration.

4.4.3.6 Provide overall execution and upgrades of integrated interfaces and assist clients in testing of integrated interfaces.

SECTION 5.0: QUALITY ASSURANCE SURVEILLANCE PLAN (QASP):

5.1 The COR shall inspect the services performed by the Contractor by reviewing work products on a random sampling basis and by obtaining regular customer feedback.

5.2 The Contractor shall contact the COR to set up quarterly evaluation meetings to discuss the status of the contract, deliverables, contract performance and results of the QASP evaluation. Prior to meeting, the CDMRP contract manager will coordinate schedules for Government staff (Contracting Officer, Contract Specialist, COR and CDMRP personnel) to receive input for the evaluation of the performance of the Contractor.

5.3 Specific QASP surveillance items shall be negotiated for the base and at the task order level. A QASP (Attachment 3) is provided with the minimum requirements and additional items shall be added per the task order performance work statement.

SECTION 6.0: DELIVERABLES

6.1 Delivery Address

All deliverables shall be submitted to the COR and/or Task Order COR (TOCOR) designated in the COR/TOCOR appointment letter.

6.2 Method of Delivery:

Electronic copies shall be delivered using Microsoft Office suite of tools (for example, MS Word, MS Excel, MS PowerPoint) or in Adobe PDF format, unless otherwise specified by the COR or PM. Electronic submission shall be made via email, unless otherwise agreed to by the COR or PM.

6.3 Deliverables

6.3.1 Confidentiality Agreement (Deliverable 1)

For each task order awarded under the resulting contract, the Contractor shall sign the CDMRP Confidentiality Agreement (Attachment 4) and ensure that all staff including all employees, sub- Contractors, and consultants assigned to or performing under the task order execute, sign, and adhere to the terms of the Non-Disclosure Statement. Assignment of key staff who has not executed this statement or failure to adhere to this statement may constitute default on the part of the Contractor.

6.3.2 Quarterly Status Reports (Deliverable 2)

The Contractor shall submit a Quarterly Report for the base level of effort and each task order issued under this contract. The format and details to be included shall be determined upon discussions with the COR and/or Task Order COR but should include cost schedule and performance metrics as related to specific developments, enhancements and other operational activities. The report shall include progress, status, and any problems/issues encountered as applicable to each task order. This report does not replace reporting on Fixed Fee as required by FAR 52.216-8. The Contractor shall require and incorporate input from sub-Contractors where there are critical or significant tasks related to the prime contract. Critical or significant tasks shall be defined by mutual agreement between the Government and the Contractor. The format for the report shall be agreed upon by the Government and Contractor. Additional reporting requirements will be identified at the task order level. 6.3.3 Incoming Transition Plan (Applicable at the Base Contract Level).The successful Offeror shall provide an incoming transition plan (ITP) for 60 calendar days incoming transition from contract to contract. Transition plan is required upon submission of the base contract proposal. The plan shall initially be submitted with the Offeror’s proposal and updated after award. The Offeror shall coordinate with the Government in planning and implementing a complete transition to the Offeror’s support model. The Government will designate a transition period for the successful Offeror to coordinate and work with the existing Contractor.

The transition plan may include the following tasks:

· Obtaining Ft. Detrick ID and Common Access Card (CAC) for appropriate personnel

· Scheduling and completing Government required training and certification in accordance with the AT/ OPSEC requirements in accordance with Section 3 of the performance work statement.

· Orientation phase and program to introduce Government personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes

· Coordination with Government representatives, review, evaluation, and transition of incumbent support services

· Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance.

6.3.4 Outgoing Transition Plan (Applicable at the Task Order Level)

6.3.4.1 The Contractor shall provide an Outgoing Transition Plan for the 60 calendar days prior to contract end when work is being transitioned from this active contract to a follow-on contract/order or Government entity (Deliverable #3). This transition may be to a Government entity, another Contractor, or to the existing Contractor under a new contract/order.

6.3.4.2 In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management.

The transition plan may include the following tasks:

· Ensuring continuity of services

· Coordination with Government representatives

· Transition of historic data to new Contractor system including a list of current incumbent

· Contractor personnel

· Transfer of any Contractor purchased Government owned assets (if applicable)

· Transfer of GFE and GFI and GFE inventory management assistance

· Coordination with the Government to account for Government keys, ID/access cards, and any security codes (if applicable).

· Developing SOPs if not already available for EGS administration activities.

6.3.5 Contractor Manpower Reporting (CMR)

Accounting for Contract Services: This requirement is to be completed on an individual task order basis. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor will report ALL Contractor manpower (including sub-Contractor manpower) required for performance of this contract. The Contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil. The required information includes (1) Contract Number; (2) Delivery Order Number (if applicable); (3) Task Order Number (if applicable); (4) Requiring Activity Unit Identification Code (UIC); (5) Command; (6) Contractor Contact Information; (7) Federal Service Code (FSC); (8) Direct Labor Hours; (9) Direct Labor Dollars; and (10) Location. In the event the Contracting Officer Representative (COR)/Contracting Officers’ Technical Representative (COTR) has not entered their data requirements first, the Contractor must also enter the COR/COTR required data with the exception of fund cite, obligations, and disbursement data. The CMRA helpdesk can be reached at 703/695-5103 or 703/695-5058 for any technical questions. The helpdesk can also be contacted via email: contractormanpower@hqda.army.mil. As part of its quote or offer, the Contractor shall also provide the estimated total cost (if any) incurred to comply with this reporting requirement. The reporting period will be the period of performance not to exceed 12 months ending 30 September of each Government fiscal year and must be reported by 15 November of each calendar year. The Contractor shall provide verification of CMR submission to the COR (Deliverable #4).

SECTION 7.0: SECURITY REQUIREMENTS

7.1 Information Security

Establish appropriate administrative, technical, and physical safeguards to protect any and all Government data. Ensure the confidentiality, integrity, and availability of Government data in compliance with all applicable laws and regulations, including data breach reporting and response requirements, in accordance with DFAR Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference DoDD 5400.11, “DoD Privacy Program,” May 8, 2007, and DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007. The contractor shall also comply with federal laws relating to freedom of information and records management.

7.1.1 Health Insurance Portability and Accountability Act (HIPAA) Comply with all requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), as implemented by the HIPAA Privacy and Security Rules codified at 45 C.F.R. Parts 160 and 164, and as further implemented within the Military Health System (MHS) by DoD 6025.18-R, "DoD Health Information Privacy Regulation," January 24, 2003, and DoD 8580.02-R, “DoD Health Information Security Regulation, July 12, 2007. Comply with all applicable HIPAA-related rules and regulations as they are published and as further defined by later-occurring Government requirements and DoD guidance, including current and forthcoming DoD guidance implementing applicable HIPAA amendments under the American Recovery and Reinvestment Act of 2009 (ARRA). Any rules and regulations that are published, and/or requirements that are defined after the award date of this contract, and that require expenditure of additional Contractor resources for compliance, may be considered “changes” and will be subject to the “changes” clause under the contract.

7.1.2 PII/HIPAA Breach Response

DoD 5400.11-R, “DoD Privacy Program,” May 14, 2007, defines a breach as the “actual or possible loss of control, unauthorized disclosure, or unauthorized access of personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected.” Within one hour of discovery, the breach must be reported to the US Computer Emergency Readiness Team (US CERT) at https://forms.us-cert.gov/report/ and to the TMA Privacy Office at PrivacyOfficerMail@tma.osd.mil as well as the USAMRDC IA and CDMRP IA.

Adhere to the reporting and response requirements set forth in the Office of the Secretary of Defense (OSD) Memorandum 1504-07, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” June 5, 2009; DoD 5400.11-R, and applicable TMA Privacy Office guidance, including current and forthcoming DoD guidance on ARRA breach notification requirements, available at: http://www.tricare.mil/tmaprivacy/breach.cfm.

7.1.3 Privacy Impact Assessment (PIA)

Provide for the completion of a Privacy Impact Assessment (PIA) for any applicable systems that collect, maintain, use or disseminate personally identifiable information (PII) or protected health information (PHI) about members of the public, federal personnel, contractors, or in some cases foreign nationals.

To begin the PIA process, Contractors are responsible for the completion of the PIA Determination Checklist. This Checklist provides basic system information to the TMA Privacy Office and ensures that the appropriate decision concerning PIA requirements is made. The Checklist can be downloaded from http://www.tricare.mil/tmaprivacy/downloads/PIADC.121008.pdf.

Contractors are responsible for the employment of practices that satisfy the requirements and regulations of: Section 208 of E-Government (E-Gov) Act of 2002, (Pub. L. 107-347); DoDI 5400.16, “DoD Privacy Impact Assessment (PIA) Guidance,” February 12, 2009; and, Office of Management and Budget (OMB) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002,” September 26, 2003. When completing a PIA, the Contractor is responsible for using the DoD-approved PIA Template, DD Form 2930, available at http://www.dtic.mil/whs/directives/infomgt/forms/eforms/dd2930.pdf.

Completed PIA Determination Checklists and DD Form 2930s will be sent to the TMA Privacy Office at piamail@tma.osd.mil.

7.1.4 Privacy Act and HIPAA Training

Ensure that all staff including subcontractors and consultants comply with the training requirements of the Privacy Act of 1974 (5 U.S.C. 552a) and Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191). The training requirements are mandated by OSD Memorandum 15041-07, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information;” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003; and the TMA Workforce Training Policy Memorandum, dated May 28, 2008, on the subject, “Workforce Training Policy Pursuant to the Department of Defense Privacy Act Regulations and the Department of Defense Health Insurance Portability and Accountability Act Privacy and Security Regulations.”

Ensure that the annual Privacy Act and HIPAA training is completed by all staff assigned to or performing on this task order contract, including subcontractors and consultants. All required Privacy Act and HIPAA training will be conducted online through Military Health System Learn (MHS Learn) at https://mhslearn.csd.disa.mil to meet the above requirements. Ensure all employees and subcontractors supply a certificate of Privacy Act and HIPAA training completion to the Contracting Officer Representative (COR) within 30 days of being assigned to task order contract and on an annual basis based on the trainee’s birth month thereafter.

7.1.5 Records Management

When creating and maintaining official government records, comply with all federal requirements established by 44 United States Code (USC), 41 USC, Department of Defense (DOD) Administrative Instruction No. 15 (DOD AI-15), “Records Management, Administrative Procedures and Records Disposition Schedules,” and Chapter 2 of the TRICARE Operations Manual.

7.1.6 Freedom of Information Act (FOIA) Office

TRICARE Freedom of Information Act Service Center procedures require a written request under FOIA to be addressed to the Freedom of Information Officer, USAMRAA. The request shall describe the desired record as completely as possible to facilitate its retrieval from files and to reduce search fees which may be borne by the requestor. No more than ten working days shall elapse after a request has been received by the Freedom of Information Officer before notification is sent that the request has been granted or denied. The administrative time limit for responding to FOIA requests does not begin until the request is received by USAMRAA.

In response to requests received by contractors for the release of information, unclassified information, documents and forms which were previously provided to the public as part of routine services shall continue to be made available in accordance with previously established criteria.

All other requests from the public for release of USAMRDC records and, specifically, all requests that reference the Freedom of Information Act shall be immediately forwarded to USAMRAA, ATTENTION: Freedom of Information Officer, for appropriate action. The contractor shall process requests by individuals for access to records about themselves under the Privacy Act procedures when those procedures are more advantageous to the requestor.