Internal Control Management Software

Added:
Apr 28, 2017 2:55 pm Request for Information - FDA_RFI-17-1181159

Request for Information (RFI) Instructions - Internal Controls Management Software and Licenses
Background:
This Sources Sought Request for Information (RFI) is for information, planning and market research purposes only and shall not be construed as either a solicitation or obligation on the part of the Food and Drug Administration or its Centers. The purpose of this RFI is to help the FDA identify software providers to assist in the management of its internal controls as required by the federal Managers Financial Integrity Act (FMFIA) and OMB Circular A-123 and and their small business size standard. FDA will use this market research information to assess the market's capability to successfully meet FDA's Management Internal Software Control Requirements.
FDA welcomes responses from all interested businesses. FDA does not intend to make a selection decision or award a contract on the basis

of responses nor otherwise pay for the preparation of any information submitted or FDA's use of such information. Acknowledgment of receipt of responses will not be made, no questions will be answered, nor will respondents be notified of the outcome of the FDA's review of the information received. Additionally, the FDA does not intend to hold discussions concerning this RFI with any interested parties. However, FDA reserves the right to contact vendors if additional information is required.
General Instructions:
A complete response to the RFI should include answers to all of the questions below. Please note that a respondent's failure to provide a complete response to a question will be interpreted to mean that it does not understand the question and does not demonstrate the capability to provide services required. Responses should demonstrate capability, not merely affirm the respondent's capability (e.g.: The response must go beyond the statement that, "XYZ company can provide training support.").
The RFI responses should be submitted via email to Karen Conroy @ Karen.Conroy@fda.hhs.gov by 6;00pm May 17, 2017 (Not required to email other point of contact of there is an auto-reply email.) E-Mail is the only acceptable method of delivery for this sources sought notice.
Questions:
1. On the FACE PAGE of your response, please provide the following:
a. Organization name
b. DUNS number
c. Organization's website
d. Contact Name
e. Contact Telephone
f. Contact E-mail address
g. Size designation and type (i.e. Small Business, etc)
h. Number of employees in your organization
i. Your organization's current and gross revenue
2. Please provide documentation of the size of your business. If you are classified as a small business, Historically Underutilized Business Zone small business, Service Disabled Veteran Owned Small Business, Woman-Owned Small Business and/or SBA 8(a) certified small business, please provide a capability statement in addition to the other information for acquisition strategy determination. Additionally, please demonstrate your firm's capability to meet the requirements of FAR 52.219-14, Limitations on Subcontracting.
3. What CFD Software can you provide to fulfill FDA's requirement? Are you the developer of this software or an authorized reseller?
4. Do any gaps exist in the Draft Statement of Works? If so, what are they? What changes, additions, updates, and clarifications would you suggest? [NOTE: See SOW for notes.]
5. By responding to this RFI, the vendor gives consent to the Government to share their responses with Contractors assisting with the development of and performing requirements analysis for this requirement. Vendors who will not give consent to the Government to share their responses with Contractors may result in the Government's inability to determine their capabilities and will be deemed as not capable of performing this requirement. Will you give consent to the Government to share your responses with Contractors assisting with the development of and performing requirements analysis for this requirement?
Request for Information Draft 1181159
Statement of Work Internal Control Management Software

Version Date: 03/24/2017
1. Background
The U.S. Food and Drug Administration (FDA) Office of Finance (OFM) is currently in the process of acquiring a COTS software to assist FDA in the management of its internal controls as required by the Federal Mangers Financial Integrity Act (FMFIA) and OMB Circular A-123. This software will allow more effective collaboration between OFM and all FDA Centers and Offices in the cataloging, and annual assessment of FDAs internal controls.
2. Objective
To obtain initial Control Management software and required associated license for software use; to support the FDA in the management of FDA's internal controls. The software is to allow for two user roles full (administrative) users, or equal, and casual (non-administrative/general) end users, or equal. Additionally, this will include obtaining a copy of the software for FDA's evaluation of the software's compliance and compatibility on FDA's network; implementation/installation support services and training, Full (Administrative) user training, Casual (Non-Administrative/General end user training, and software maintenance to include telephone support and software updates.
3. Requirements
3.1 Software Requirements/Salient Characteristics
The salient functional characteristics of the Control Management software, shall consist of the following:
• Compatible with Windows 7 Operating System
• Web-based user interface
• Allow installation within the FDA environment to meet security requirements.
• Compatible with Windows Internet Explorer 11, Google Chrome, Mozilla Firefox internet browsers
• Compatible with FDA standard COTS office productivity software (Microsoft Word, Excel; Adobe Acrobat/PDFs)
• Provides ability for collaboration between various workgroups
o Allows for review and sign-off/certification of submitted information and documentation
o Maintains a record/audit log of changes and communications between users
• Provides the ability to develop and manage the annual assessment/audit programs.
• The software allows customization of input forms and fields as needed to support reporting requirements and established processes
• Provides ability to create and export reports and data.
3.2 Software Evaluation
The purchase of this software is contingent on the evaluation and acceptance by FDA's Office of Information Management and Technology (OIMT) and addition to the Master Approved Technologies (MAT) list. Prior to award, OIMT must evaluate the software and verify the software meets FDA standards for addition to the MAT list. The vendor will provide the necessary materials, to include an evaluation copy and required technical documentation, as required to allow for OIMT's review. If the software is not accepted by OIMT and is not added to the MAT list, then the software cannot be accepted for this award.
3.2 Required Users/Licenses
The software is to allow access for 10 full (administrative) users, or equal, and 100 casual (non-administrative/general) end users, or equal. The vendor will provide the required licenses to allow access for these users.
4. Additional Requirements
Implementation, Training, and Support
• The vendor shall provide onsite training at the OFBA Offices located in Silver Spring, Maryland
• Training shall cover accessing and operating the software, including all major analytical functions and workflows, and include question and answer sessions
• The training shall be scheduled on a date mutually agreeable to the vendor and the DCCO point of contact
• Software Installation and Implementation
o Provide assistance in the software installation, and implementation of the software user interface to meet DCCO requirements for the collection, reporting, and management of information.
• Full (Administrative) User Training
o Provide training to Administrative Users to maintain and modify the user interface.
• Casual (Non-Administrative/General End Users) User Training
o Provide Non-Administrative End Users training on software functionality and use.
• Software Installation - Vendor (On-Site at OFBA Offices located in Silver Spring, Maryland or Remote)
o Assist DCCO Administrative Users with software installation on the FDA Network.
• Vendor Travel Costs for Software Implementation and Training (as required).
• Software Maintenance and Support
o For the duration of the contract, the vendor is to provide software maintenance, at a minimum to include telephone software support, and software updates.
5. Deliverables
Item Quantity
Internal Control Software 1
Required Licenses, Quantity as required to allow access for specified User quantities As Required
Software Evaluation Copy to include required materials for evaluation 1
Internal Control Software - Full User, or equal (Administrative Users) 10
Internal Control Software - Casual User, or equal (Non-Administrative/General End Users) 100
Software Installation and Implementation, To include vendor travel As Required
Full (Administrative) User Training; To include vendor travel As Required
Casual (Non-Administrative/General End Users) User Training; To include vendor travel As Required
Software Maintenance and Support, at a minimum to include telephone software support, and software updates and patches as required Per Year
Software Maintenance and Support, at a minimum to include telephone software support, and software updates and patches as required OY 1
Software Maintenance and Support, at a minimum to include telephone software support, and software updates and patches as required OY 2
Software Maintenance and Support, at a minimum to include telephone software support, and software updates and patches as required OY 3
Software Maintenance and Support, at a minimum to include telephone software support, and software updates and patches as required OY 4
Please provide part numbers for specific products.
6. Place of Performance/Delivery
The contractor shall deliver all software and licenses to the designated COR within 30 days of award.
Food & Drug Administration
8455 Colesville Road,
Silver Spring, MD
7. Period of Performance
The Base period of performance shall begin on the date of award and continue for 12 months.
In addition, there will be 4 option years for continued maintenance and software updates.
Base year plus 4 options years.
8 .Security Compliance
1. Prior to the contractor removing any media from an FDA facility, the contractor shall ensure that all media has been wiped of FDA data to the approval of the FDA CISO.
2. Pursuant to Federal and HHS Information Security Program Policies, the contractor and any subcontractor performing under this task order shall comply with the following requirements:
a. Federal Information Security Management Act of 2002 (FISMA), Title III, E-Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002); http://csrc.nist.gov/policies/FISMA-final.pdf.
b. Information Type
i. Administrative, Management and Support Information:
• Information Management
• Lifecycle/Change Management
• Record Retention
• Budget and Finance
• Reporting and Information
ii. Mission Based Information
• Consumer Health and Safety
iii. Security Categories and Levels
• Confidentiality: Moderate
• Integrity: Moderate
• Availability Level: Low
• Overall: Moderate
3. Confidential Treatment of Sensitive Information
a. The Contractor shall guarantee strict confidentiality of the information/data that it is provided by the Government during the performance of the task order. The Government has determined that the information/data that the Contractor will be provided during the performance of the task order is of a sensitive nature.
b. Disclosure of the information/data, in whole or in part, by the Contractor can only be made after the Contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the Contractor shall obtain a written determination from the Contracting Officer.
9. Inspection and Acceptance Criteria
The Contracting Officer (CO) or duly authorized representative shall perform inspection and acceptance of products. The performance criteria for these products shall be timely delivery and closure of all activities and deliverables listed within Section 2 of this SOW and within the established Period of Performance.
10. Contract Order Type
The government anticipates awarding a firm-fixed price order.
11.508 Standard Requirements
Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) standards apply to this order.
Section 508 Standards Requirement
Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase
electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to
ensure that federal employees with disabilities have access to, and use of, the information and data they
need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the
ability to access government information and services.
There are three regulations addressing the requirements detailed in Section 508. The Section 508
technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the
Access Board's Web site at http://www.access-board.gov. The second regulation issued to implement
Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions
of Electronic and Information Technology (EIT) comply with the Access Board's standards. The entire
FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at
http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at
http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).
Regardless of format, all Web content or communications materials produced for publication on or
delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508
standards to allow federal employees and members of the public with disabilities to access information
that is comparable to information provided to persons without disabilities. All contractors (including
subcontractors) or consultants responsible for preparing or posting content intended for use on an HHSfunded
or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and
where applicable, those set forth in the referenced policy or standards documents below. Remediation of
any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the
SOW, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable
content or communications material.
Unless an agency exception to this requirement exists, the Contractor must conform to applicable Section
508 standards and must apply best practices associated with Section 508 compliance during the
application design, development, and testing phases. The Contractor shall utilize FDA approved tools to
verify the compliance with the Section 508 standards and ensure the delivery of the fully compliant
products.
The following Section 508 section applies:
1194.21 Software applications and operating systems
1194.31 Functional performance criteria
1194.41 Information, documentation, and support
12. Order of Precedence
The Contractor shall following the terms and conditions of this order. Should the Contractor include any additional terms and conditions resulting in conflicts between this document and the Contractor's document, the Order of Precedence shall be as specified in FAR Clause 52.212-4, dated May 2015. Any additional terms and conditions shall not be prohibited by applicable laws and regulations.
13. Provisions and Clauses Draft
The following clauses apply to this solicitation. When just the clause reference and title are listed, the clause is incorporated by reference. The full text of the FAR can be found here: http://farsite.hill.af.mil/

52.203-99, Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements (DEVIATION 2015-02)
(a) The Contractor shall not require employees or subcontractors seeking to report
fraud, waste, or abuse to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.
(b) The contractor shall notify employees that the prohibitions and restrictions of any internal confidentiality agreements covered by this clause are no longer in effect.
(c) The prohibition in paragraph (a) of this clause does not contravene requirements applicable to Standard Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.
(d)(1) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Resolution Appropriations Act, 2015 (Pub. L. 113-235), use of funds appropriated (or otherwise made available) under that or any other Act may be prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.
(2) The Government may seek any available remedies in the event the Contractor fails to comply with the provisions of this clause. (End of clause)
Health and Human Services Acquisition Regulation (HHSAR) Clauses can be viewed in full text at:
http://www.hhs.gov/policies/hhsar/subpart352.html#Subpart352.1--InstructionsforUsingProvisionsandClauses
Clause Clause Title Date
352.224-71 Confidential Information Dec 2015
Special Notice and Agreement regarding Software EULA/TOS
Computer software and services are often subject to license agreements, referred to as End User License Agreements (EULA), Terms of Service (TOS), or other similar legal instruments or agreements. Many of these agreements contain indemnification clauses that are inconsistent with Federal law and unenforceable, but which could create a violation of the Anti-Deficiency Act (31 U.S.C. 1341) if agreed to by the Government.
Therefore, by submitting a quotation the offeror shall agree that the inclusion of any Limitation of Liability, Indemnification, and any other clauses that conflict with Federal law or regulation in any EULA or TOS are NULL AND VOID. The offeror agrees that any EULA/TOS clauses conflicting with Federal law or regulation and are not agreed to by the Government if included with the submission of a quotation. Additionally, by submission of the quotation the offeror must agree to the inclusion of FAR 52.232-39 Unenforceability of Unauthorized Obligations in any resulting contract or order, if awarded.
52.252-2 Clauses Incorporated by Reference (Feb. 1998)
52.212-4 - Contract Terms and Conditions -- Commercial Items (May 2015)
52.212-5 - Contract Terms and Conditions Required to Implement Statutes or Executive Orders --
Commercial Items (May 2016)
52.217-8 - Option to Extend Services (Nov 1999)
52.217-9 Option to Extend the Term of the Contract (Mar 2000)
52.227-14 - Rights in Data - General. (May 2014)
52.227-19 - Commercial Computer Software License (Dec 2007)
52.232-39 - Unenforceability of Unauthorized Obligations (Jun 2013)
52.232-40 - Providing Accelerated Payment to Small Business Subcontractors (Dec 2013)
The below Health and Human Services Acquisition Regulation (HHSAR) Clauses apply. HHSAR
Clauses can be viewed in full text at: http://www.hhs.gov/grants/contracts/contract-policiesregulations/
14.Certificate of Maintainability
At such time as the services of the Contractor are terminated, expire contractually or are otherwise not extended, or upon request by the Contracting Officer at any time, the Contractor shall issue, within five (5) working days, a "Certificate of Maintainability" for any or all equipment acquired and/or maintained under this contract.
The certificate shall state that preventive maintenance in accordance with the specifications of the Original Equipment Manufacturer (OEM) has been performed and that the equipment is performing in accordance with the OEM's specifications such that the OEM (or the OEM's successor in interest) would commit that it would assume maintenance of the equipment without billing any one-time charges (including but not limited to repair or inspection charges) if such maintenance were assumed effective the day after the Contractor's performance ceases. The Contractor is responsible for bearing all costs associated with obtaining such certification at no separate charge to the Government.
Should the Contractor fail to issue the required Certificate of Maintainability in accordance with this clause, or should any equipment fail to perform in accordance with the certification, the Contractor shall be liable to the Government for any reasonable costs incurred by the Government for the purpose of bringing the equipment up to the required OEM maintenance level.
If equipment is acquired under this contract, without maintenance of such equipment being concurrently acquired under the contract, the Contractor shall issue a Certificate of Maintainability for such equipment at the time of delivery for each piece of equipment. The certificate shall state that the equipment is in such condition that the OEM (or the OEM's successor in interest) would commit that it would assume maintenance of the equipment without billing any charges to the Government. All charges required obtaining the requisite performance of the equipment, up to the later of the time the equipment is accepted by the Government or the warranty expires, shall be borne by the Contractor. The time the equipment is accepted by the Government is the date that the Government determines that the equipment has passed acceptance testing, not the effective date of acceptance. The fact that the equipment may have been acquired with a warranty does not relieve the Contractor of its obligations under this clause.
15. FDA Three-Way Invoicing Instructions
[To Be Provided]
16. Authorized Contractor
The Contractor shall be the software Original Equipment Manufacturer (OEM) or an authorized reseller/servicing agent of the software OEM.
The Quoter shall notify the Contract Specialist / Contracting Officer immediately if this requirement is registered by a reseller with the Original Equipment Manufacturer (OEM).