Targeted Dissemination of Tick and Mosquito

Please see attached synopsis, SOW, and SSJ. This is a presolicitation notice synopsis. The OAS intends to issue a firm fixed price purchase order, sole source award. This notice is not a formal Request for Quotes (RFQ), and no contract will result from this notice, nor does it commit the Government to any acquisition for these services. The OAS in Atlanta, GA requires communication services. The North American Industry Classification System (NAICS) code for this project is 541613 and PSC of R702 with a small business size standard of 150 employees. The Government intends to issue a sole source contract to Banyan Communications. Competition is being limited because Banyan Communications has already provided similar services under a previous competitive blanket purchase agreement (BPA). This work is a logical follow-on to the BPA. Point of contact is Kristopher Lemaster, email: [email protected]. All responsible sources may submit a capability statement which shall be considered by the agency. Statement of Work Procurement Request #: 1T Period of Performance: 04/10/2023 – 08/31/2023 Title: Targeted Dissemination of Tick and Mosquito Bite Prevention Materials SECTION 1 – BACKGROUND The number of reported cases of vector-borne disease are increasing in the United States. A recently released estimate suggests that each year approximately 476,000 Americans are diagnosed and treated for Lyme disease alone. Increases in the number of other tickborne diseases such as anaplasmosis and ehrlichiosis, are also occurring. Simultaneously, the emergence of new tickborne diseases such as Borrelia miyamotoi, Heartland virus disease, and others is ongoing. Outbreaks of mosquito-borne infections such as West Nile, Chikungunya, and Zika virus disease are ongoing but difficult to predict. Congress and public health officials across the nation recognize the need to inform Americans about ways they can reduce their risk in particular for harmful tickborne disease. In 2016, the 21st Century Cures Act mandated the establishment of a Tick-Borne Disease Working Group to serve as a Federal Advisory Committee to the Health and Human Services Secretary and Congress. The Working Group is responsible for reviewing ongoing research and advances and for identifying research gaps. In a 2020 Report to Congress, the Working Group recognized the urgent need for public education about tickborne diseases and recommended that the general public be educated about the regional and specific risks related to tickborne diseases. None of the diseases listed above are currently vaccine preventable. Additionally, large-scale vector-control efforts face many barriers, including cost and public acceptability. As a result, prevention of vector-borne diseases rests primarily on the public and their willingness and ability to employ personal prevention techniques consistently throughout the warm months of the year. Despite research that demonstrates the efficacy of tick- and mosquito-borne personal prevention techniques, the public does not perform these behaviors consistently. In a recent study of personal prevention techniques for tickborne disease, people reported consistently performing these behaviors between 1/3 and 2/3 of the time. High quality, targeted prevention messages that are audience-tested, strategically developed, and evaluated are key to preventing vector-borne disease. Through a previously awarded contract with Banyan Communications, the Division of Vector-Borne Diseases has recently developed tick- and mosquito-specific prevention messages, materials, and videos based on formative research and message testing with key high-risk populations. Due to delays at no fault to the vendor, the materials were unable to be promoted in conjunction with tick and mosquito season in spring and summer 2021. This contract requires the targeted dissemination and evaluation of the recently developed materials. SUBSECTION A – DEFINITIONS N/A SECTION 2 – PURPOSE Parties the Project Involves – Parties involved include the Division of Vector-Borne Diseases staff, including staff from the Bacterial Diseases Branch, Arboviral Diseases Branch, and Rickettsial Zoonoses Branch, and Banyan Communications. Overall Objectives – The purpose of the project is to disseminate tick- and mosquito-borne disease prevention materials developed. Additionally, evaluation of the number of people seeing and interacting with the materials and accessing the website, should be reported. xxxxxxxxxxxxxxxxx 04/10/2023 - 08/31/2023 General Period and Place of Performance – April 10, 2023 – August 31st, 2023. Performance Objectives or Required Results – Digital links to the final advertisements and promotions and metrics of the activities’ performance. Operating Constraints – N/A SECTION 3 – SCOPE OF WORK The purpose of the contract is to disseminate targeted tick and mosquito bite prevention materials to high-risk audiences. Additionally, metrics and evaluation of the dissemination should be reported. The Vendor will finalize creative materials developed in prior contracts based on subject matter expert feedback and review. The vendor will then manage a media dissemination plan including opportunities for paid and non-paid media placement, focusing on educational opportunities to reach target audiences. Finally, the Vendor shall provide metrics to measure the reach and impact of the media placements and social media tactics against key performance indicators SECTION 4 – TASKS TO BE PERFORMED 1.0 Project Management. The Vendor will hold a kickoff meeting no later than 10 workdays after the initial award is made to discuss plans and timelines as well as clarify roles and responsibilities, to be held virtually. Following the kickoff meeting, the Vendor shall develop a written work plan, minimally including all essential interim and final deliverables, key staff responsible for tasks (including Vendor, CDC, or other partners) and schedule of key deadlines for COR review and correction before acceptance. 2.0 Educational Awareness Materials. Based on subject matter expert feedback and comments during the clearance and review process, the vendor shall refine materials and finalize a set of interrelated materials for target audiences (including outdoor enthusiasts, parents of children, outdoor workers, dog owners, older adults, Hispanic identifying Spanish speakers, and southeasterners) that address common questions, concerns, and misperceptions related to vector-borne disease prevention. Materials including social media assets, advertisements, and videos will also need to be translated into Spanish for the Hispanic identifying audience. 2.1 Submission and Coordination. The Vendor shall transfer all materials to DVBD so they can be made available to states, local communities, and other potential users. The Vendor must ensure all original source files, talent information, and communication product/ad descriptions are submitted to the COR. All materials will be property of CDC and available in the public domain. Note: for materials to be uploaded to CDC’s server, they must meet Section 508 compliance, which means appropriately captioned and audiodescribed. 3.0 Distribution: Paid and Non-paid Media & Social Media The Vendor shall manage a comprehensive media buying plan that will integrate into and support the Communication Strategy developed in the prior contract. The Vendor shall provide CDC with written documentation outlining the media buying plan including timeline, budget allocation, and media monitoring. 3.1 Placement. The plan shall include opportunities for paid and non-paid media placement, focusing on educational opportunities to reach target audiences. The Vendor shall manage the media buying process and xxxxxxxxxxxxxxxxxxxxxxxxxxxx 04/10/2023 - 08/31/2023 make direct placement of ads and sponsorships. Media buys must include digital and traditional media targeting including outdoor enthusiasts, parents of children, outdoor workers, dog owners, older adults, Hispanic identifying Spanish speakers, and southeasterners. Social media and direct advertising will be used to reach these populations. Distribution strategies must include paid media placement and other digital and social media distribution platforms such as Facebook, Instagram, and other platforms recommended by the Vendor and approved by CDC. 3.2 Media Metric Reporting. The Vendor shall submit a media report template for CDC approval 2 weeks prior to the product placement period. Once agreed upon, the Vendor must provide email copies of the media report weekly and monthly during the period of media placement to monitor media performance and allow for adjustments and optimization to reach target audiences. 3.3 Final Evaluation Report. The Vendor shall measure the reach and impact of the media placements and social media tactics against key performance indicators. 1. Reports must feature a narrative, visuals, comparisons of data over time, and recommendations to improve and enhance content, strategies, and outreach. a. Overview of content strategy, promotional efforts, and page performance b. Current metrics following an agreed upon format: page likes, post count, comments, responses, reactions, shares, daily total reach, new organizational likes, video views, etc. c. Highest performing content and key messages d. Highest performing media (e.g., images, videos) e. Noteworthy comments f. Updates on specific tactics or special activities g. Unique findings and recommendations SECTION 5 – GOVERNMENT FURNISHED MATERIALS The Government will provide CDC subject matter-related and/or resources that will be used for the development of the digital and printed products. SECTION 6 – PERIOD OF PERFORMANCE 04/10/2023 – 08/31/2023 SECTION 7 – DELIVERABLES/REPORTING SCHEDULE xxxxxxxxxxxxxxxxxxxxxxxxxxSECTION 8 – REFERENCE MATERIALS This Statement of Work is based on previous work completed with Banyan Communications through BPA #75D30121F11584. SECTION 9 – POINT OF CONTACT INFORMATION The Point of Contact (POC) for this procurement is: Amy Ullmann Centers for Disease Control and Prevention 3156 Rampart Road Fort Collins, CO 80521 Telephone Number: 970-225-4251 E-mail Address: [email protected] Preferred method of communication: E-mail SECTION 10 – PAYMENT TERMS Payments will be delivered in accordance with media buys for tick and mosquitoes with the first payment of $TBD being made one week prior to dissemination of tickborne disease materials on May 1st, 2023. The second payment of $TBDwill be made one week prior to dissemination of mosquito-borne disease materials on June 15th, 2023. The final payment of $TBD will be made upon completion of all deliverables. SECTION 11 – MINIMUM VENDOR QUALIFICATIONS AND LEVEL OF EFFORT Vendor should have experience disseminating and evaluating educational materials to target audience groups. In addition, vendor should have knowledge of vector-borne disease and experience creating vector-borne disease educational materials. SECTION 12 – EVALUATION FACTORS 1. Technical Evaluation Vendor is to provide a discussion of their technical approach for providing the services required for this Purchase Order. Vendor must be able to assign personnel to this project with the technical expertise for providing the services required for this Purchase Order. Provide information reflecting experience of assigned staff, including a detailed resume, biography, or curriculum vitae (CV) of each candidate. This criterion will be evaluated according to the soundness, practicality, and feasibility of the Contractor’s technical approach for providing the services required for this Purchase Order. 2. Price Evaluation: A price analysis of the quote will be conducted to determine the reasonableness of the Vendor’s price. Media buys were based upon previous work in contract # plus a percentage increase based on annual increases in expenses. SECTION 13 – SPECIAL CONSIDERATIONS Electronic and Information Technology Accessibility 1. Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic xxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxx xxxxxxxxx xxxxxxxxxx and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. 2. Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.accessaboard. gov/sec508/standards htm. 3. The Section 508 accessibility standards applicable to this contract are: 1194. 205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 504 Authoring Tools 602 Support Documentation 603 Support Services In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508. In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues. 4. Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense. 5. Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative. Information Security Standard-1: Procurements Requiring Information Security and/or Physical Access Security 1. Baseline Security Requirements a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following: i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information. ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources. b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must: i. Protect the:  Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;  Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and  Availability, which means ensuring timely and reliable access to and use of information. ii. Categorize all information owned and/or collected/managed on behalf of HHS/CDC and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, CDC CPO, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:  Confidentiality: [ x ] Low [ ] Moderate [ ] High  Integrity: [ x ] Low [ ] Moderate [ ] High  Availability: [ x ] Low [ ] Moderate [ ] High  Overall Impact Level: [ x ] Low [ ] Moderate [ ] High iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/CDC regardless of location or purpose. iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/CDC Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/CDC security and/or privacy officials. c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed. d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/CDC privacy policies, and complete all the requirements below: i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc. ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII. iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.  If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60-90 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.  The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first. e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be: i. Marked appropriately; ii. Disclosed to authorized personnel on a Need-To-Know basis; iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800- 88, Guidelines for Media Sanitization. f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP. g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. h. The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations: i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records); ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act). i. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). j. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance. k. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information. l. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate. m. Standard for Encryption. The Contractor (and/or any subcontractor) must: i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information. include, but are not limited to, scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities. c. The Contractor must identify any gaps between required FedRAMP Security Control Baseline/Continuous Monitoring controls and the contractor's implementation status as documented in the Security Assessment Report and related Continuous Monitoring artifacts. In addition, the contractor must document and track all gaps for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the risks, HHS may require remediation at the contractor's expense before HHS issues an ATO. d. The Contractor (and/or any subcontractor) must mitigate security risks for which they are responsible, including those identified during A&A and continuous monitoring activities. All vulnerabilities and findings must be remediated, in accordance with timelines specified in the HHS POA&M Standard, from discovery: (1) critical vulnerabilities no later than fifteen (15) days and (2) high within thirty (30) days (3) medium within sixty (60) days and (4) low vulnerabilities no later than three hundred and sixty (360) days. In the event a vulnerability or other risk finding cannot be mitigated within the prescribed timelines above, they must be added to the designated POA&M and mitigated within the newly designated timelines. HHS will determine the risk rating of vulnerabilities using FedRAMP Baselines. CDC timelines for mitigating POA&M: a. 15 days for critical weaknesses; b. 30 days for high weaknesses; c. 60 days for medium weaknesses; and d. 360 days for low weakness. e. Revocation of a Cloud Service. HHS and CDC have the right to take action in response to the CSP's lack of compliance and/or increased level of risk. In the event the CSP fails to meet HHS and FedRAMP security and privacy requirements and/or there is an incident involving sensitive information, HHS and/or CDC may suspend or revoke an existing agency ATO (either in part or in whole) and/or cease operations. If an ATO is suspended or revoked in accordance with this provision, the CO and/or COR may direct the CSP to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor information system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. 4. Reporting and Continuous Monitoring i. Following the initial ATOs, the Contractor (and/or any subcontractor) must perform the minimum ongoing continuous monitoring activities specified below, submit required deliverables by the specified due dates, and meet with the system/service owner and other relevant stakeholders to discuss the ongoing continuous monitoring activities, findings, and other relevant matters. The CSP will work with the agency to schedule ongoing continuous monitoring activities. At a minimum, the Contractor must provide the following artifacts/deliverables on a monthly basis: Application and Host Scans (if applicable) according to CSPO ISCM guidance. ii. Perform weekly scans (at a minimum) and provide results to C/I/O/ISSO and CSPO ISCM for systems with a FIPS 199 impact level of High, HVA, or if the system contains PII, and ensure scan results are submitted in either CSV or PDF format for deliverables. iii. Operating system, database, Web application, and network vulnerability scan results; iv. Updated POA&Ms; Any updated authorization package documentation as required by the annual attestation/assessment/review or as requested by the CDC System Owner or AO, and; iv. Any configuration changes to the system and/or system components or CSP's cloud environment, that may impact HHS/CDC’s security posture. Changes to the configuration of the system, its components, or environment that may impact the security posture of the system under this contract must be approved by the agency. 5. Configuration Baseline a. The contractor must certify that applications are fully functional and operate correctly as intended on systems using HHS Minimum Security Configurations Standards Guidance. The standard installation, operation, maintenance, updates, and/or patching of software must not alter the configuration settings from the approved HHS/CDC configuration baseline. b. The contractor must use Security Content Automation Protocol (SCAP) validated tools with configuration baseline scanner capability to certify their products operate correctly with HHS and NIST defined configurations and do not alter these settings. 6. Incident Reporting a. The Contractor (and/or any subcontractor) must provide an Incident and Breach Response Plan (IRP) in accordance with HHS/CDC, OMB, and US-CERT requirements and obtain approval from the CDC. In addition, the Contractor must follow the incident response and US-CERT reporting guidance contained in the FedRAMP Incident Communications. b. The Contractor (and/or any subcontractor) must implement a program of inspection to safeguard against threats and hazards to the security, confidentiality, integrity, and availability of federal data, afford HHS access to its facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of notification. The program of inspection must include, but is not limited to: i. Conduct authenticated and unauthenticated operating system/network/ database/Web application vulnerability scans. Automated scans can be performed by HHS/CDC personnel, or agents acting on behalf of HHS/CDC using agency-operated equipment and/or specified tools. The Contractor may choose to run its own automated scans or audits, provided the scanning tools and configuration settings are compliant with NIST Security Content Automation Protocol (SCAP) standards and have been approved by the agency. The agency may request the Contractor's scanning results and, at the agency discretion, accept those in lieu of agency performed vulnerability scans. ii. In the event an incident involving sensitive information occurs, cooperate on all required activities determined by the agency to ensure an effective incident, or breach response and provide all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. In addition, the Contractor must follow the agency reporting procedures and document the steps it takes to contain and eradicate the incident, recover from the incident, and provide a post-incident report that includes at a minimum the following:  Company and point of contact name;  Contract information;  Impact classifications/threat vector;  Type of information compromised;  A summary of lessons learned; and  Explanation of the mitigation steps of exploited vulnerabilities to prevent similar incidents in the future. 7. Media Transport a. The Contractor and its employees must be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital and non-digital media (e.g., CD-ROM, tapes, etc.), mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards) follow appropriate actions such as logging and a documented chain of custody form. b. All information, devices and media must be encrypted with HHS-approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities. 8. Boundary Protection: Trusted Internet Connections (TIC) a. The contractor must ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities using cloud services is inspected by Trusted Internet Connection (TIC) processes. See attached SOW for remaining content.