UPGRADE Questions and Answers

Participation in the Proposers’ Day is not a requirement for submission of a solution summary, proposal, or selection for funding.

Yes! Slides can be found on the UPGRADE webpage or https://arpa-h.gov/sites/default/files/2024-06/UPGRADE%20Proposers%20Day%20PDF.pdf . A recording of Proposers’ Day (PD) is also available on the program webpage and on YouTube.

Thank you for your interest, but unfortunately we have exceeded capacity as we only have a limited amount of sidebar slots as noted in the Proposer Day Special Notice (ARPA-H-SN-24-109)

ARPA-H will not be publishing a list of Proposers Day attendees. Performers can sign up and view other performers looking to team through the UPGRADE Teaming Site (https://arpa-h.gov/research-and-funding/programs/upgrade/teaming). As stated in the Proposer Day Special Notice (ARPA-H-SN-24-109), specific content, communications, networking, and team formation are the sole responsibility of the participants. ARPA-H UPGRADE cannot assist in forming teams.

Yes, ARPA-H has a Mission Office Innovative Solutions Openings (ISOs), that can be found at https://arpa-h.gov/research-and-funding/mission-office-iso.

As stated in the Master Announcement Instruction, ARPA-H-MAI-24-01, Section 2.1 "All responsible sources capable of satisfying the Government’s needs may submit a proposal to a Module Announcement. Specifically, universities, non-profit organizations, small businesses and other than small businesses are eligible and encouraged to propose to Module Announcements." See additional details in Section 2.1.1 regarding FFRDC and Government Entity participation. The UPGRADE program anticipates teaming will be necessary to accomplish the UPGRADE goals and metrics. See section F of the final UPGRADE module announcement for additional details. 

No, proposer's are not required to submit a Solution Summary in advance of a proposal. However, proposers are strongly encouraged to submit a Solution Summary in advance of a proposal as it is a mechanism for potential proposers to obtain feedback prior to investing resources for a full proposal. ARPA-H will review Solution Summaries and respond in writing encouraging or discouraging the submission of a full proposal. Proposer's are able to submit a proposal regardless of the feedback received.

Given the issues with the availability of the ARPA-H Solutions portal today, ARPA-H will be extending the deadline for UPGRADE Solution Summary submission by 48 hours, with a new deadline of 10 pm ET on Wednesday, July 24.  Amendment 2 to the UPGRADE MAI will be available on SAM.gov reflecting this deadline extension.

Solution Summaries provide a synopsis of the proposed approach from a technical and budgetary persepective. The intent of the Solution Summary is to provide guidance on strategies that are within the scope of the program and that are likely to achieve program goals. Appendix A of the final UPGRADE module announcement contains content and formatting guidance along with a template document to utilize.

Proposals fully describe the technical approach, teaming, budget, etc. The final UPGRADE module announcement contains template documents to be utilized in the proposal submissions process, (see Attachment 1, Other Transaction Bundle).

In the interest of fairness to all proposers, the UPGRADE team is unable to schedule any related calls or meetings. Specific questions may be submitted in accordance with Section S of the final UPGRADE Module Announcement. Any questions submitted, and their respective answers may be published on the Q&A page, removing any proprietary information. The UPGRADE team can also address any proposer specific questions directly with the proposer throught the ARPA-H Solutions platform. Submitting a Solution Summary is also a mechanism to receive feedback on your proposed approach.

Organizations may be a part of multiple teams on multiple proposals. There are no limits, but proposers are requested to consider the most effective way for them to bring their expertise to the program.

Proposals will be evaluated in accordance with Section 4 of the Master Announcement Instruction, ARPA-H-MAI-24-01.

The ARPA-H UPGRADE team is able to give feedback to Solution Summaries on what is in scope, and provide guidance on what sections may be most relevant to assist in proposal preparation. 

Yes, with the caveat that we will not be funding identical efforts submitted under different proposals (i.e. funding twice for the same work). 

Proposals will be viewed on the merits of each proposed TA and the Government may select all, some or none of the TA's proposed that best meet the overall program needs (see Section 1.4 of the MAI, ARPA-H-24-01 for additional details). 

Other Transaction Agreements will be awarded to the prime entity that submits the proposal. This can be a single entity or a consortium of organizations that have legally formed an overarching entity. Ultimately, it is the prime's responsibility to establish the organizational structure of the team. 

Yes - See Section O of the UPGRADE final Module Announcement and Appendix A, Solution Summary Template. 

No, there is not a requirement for participation of a non-traditional performer. Per Section 2.1 of the MAI, ARPA-H-MAI- 24-01 Amendment 1 "All responsible sources capable of satisfying the Government’s needs may submit a proposal to a Module Announcement. Specifically, universities, non-profit organizations, small businesses and other than small businesses are eligible and encouraged to propose to Module Announcements." 

Yes, if the submissions are using different approaches then they can be standalone, separate submissions.  

Please refer to the ARPA-H_MAI_24-01-05_Appendix A Solution Summary template for BOE pricing instructions.  

Proposers can remove the "Appendix A" header when submitting their Solution Summaries. Formatting within the rest of the document can also be changed as long as 1" margins is preserved.  

12-point Arial or Times New Roman is an acceptable alternative to Avenir Next LT Pro Light font.

Per ARPA-H-MAI-24-01-05 Section I.1.b "All proposed research is expected to be unclassified." Solution Summaries and/or Proposals shall not include classified or Controlled Unclassified (CUI) content.

Solution Summaries should reflect unique approaches to UPGRADE objectives, therefore you should not submit duplicative solution summaries that highlight your contribution as an individual and a as team.  

No, the Software Component Technical Plan is not included in the proposal page count. An amendment to the MAI will be posted to clarify this.  

Please review ARPA-H-MAI-24-01-05, specifically Section L.1 which states, "Proposals selected for award negotiations will result in an award under an Other Transaction (OT) type contract agreement." Please note that the UPGRADE Moduluar Announcement allows for only one award instrument, and that is OTs.

The amount of travel is expected to be specific to each performer's proposed effort. An NTE travel amount will not be provided.

The Task Description Document (TDD) is its own separate attachment provided with the Other Transaction Bundle (Volume 1) and may be attached separately, as it does not count against the technical proposal page limit.

Per ARPA-H-MAI-24-01-05 Attachment 1 OT Bundle Volume 1 Administrative & National Policy Req. Section 2 "ORGANIZATIONAL CONFLICT OF INTEREST AFFIRMATIONS AND DISCLOSURE" Performer and Subawardee or consultant must review and answer all 3 questions truthfully. Per the instructions if answsered "Yes" additional documentation would be required to be submitted with the proposal. 

As stated in the Master Announcement Instruction, ARPA-H-MAI-24-01, section 3, Application and Submission Information, a Model Agreement will be provided to those Proposers that receive a notification of selection for a potential award. At that point, a Proposer would be required to submit a Stage 2, Volume 2 submission inclusive of a Proce/Cost proposal, agreement certification, and a model agreement (if requesting changes). 

Per ARPA-H-MAI-24-01-05, Section L, Award Information it states award negotiations will result in an award under an Other Transaction (OT). Use of an OT will allow for streamlined practices to be employed, such as milestone-driven performance, intended to reduce time and effort on award administration tasks and permit Performers to focus on the research effort. Payable milestones allow for payment under the OT Agreement when there is successful completion of the milestone accomplishments agreed to in the Milestone Plan. Either during the Stage 2 Volume 2 OT bundle provided by ARPA-H with the Selection Notification Letter or during Negotiations, Proposers will be asked to include a detailed list of payment milestones (Milestone Plan). Each Milestone must include the following:
• Milestone description
• Completion/Exit criteria (to include identifying all associated data deliverables excluding those specifically providing project status)
• Due Date
• Payment/funding schedule (to include, if resource share is proposed, awardee and Government share amounts)
• For each data deliverable, identify the proposed Government data rights (keeping in mind how each data deliverable will need to be used by the Government given the goals and objectives of the proposed project).
It is noted that, at a minimum, milestones should relate directly to the accomplishment of program technical metrics as defined in the module announcement and/or the proposer’s proposal. Agreement type, expenditure or fixed-price based, will be subject to negotiation by the Agreements Officer. 

Yes, these letters of support should be included with the proposal submission. These letters can be included as an attachment to the Technical & Management volume and do not count against the page limit. An amendment to ARPA-H-MAI-24-01-05 will be issued to clarify this.

Arial, Times New Roman, or Avenir Next LT Pro Light are acceptable fonts for full proposals, to include tables and/or graphics.

Per the Volume 1, Technical and Management template: "Only one resume, per key personnel, per TA should be provided, in addition to a resume for the technical lead of the overall effort.". Thus, if the proposer is proposing to 1 TA, they should submit 2 resumes (2 TAs = 3 resumes; 3 TAs = 4 resumes; 4 TAs = 5 resumes).

The Stage 1, Volume 1 Basis of Estimate Template requests total price per TA, per cost element, per year. The BOE template is also requesting a Level of Effort breakout which highlights labor hours and fully burdened rates per labor category proposed. All Stage 1, Volume 1 proposals will be evaluated against evaluation criteria 1 through 3 as stated in ARPA-H-MAI-24-01, Section 4.

Yes, the HHS salary cap applies to all proposals submitted to the UPGRADE Module Announcement.

FedRAMP certification is not in scope for the UPGRADE program.

Yes! As per ARPA-H-MAI-24-01-05 UPGRADE, Amendment 6, the Solutions Portal now accepts individual zip files up to 100 MB each. For submission >100 MB, multiple zip files are allowed.

Yes, this table is linking the UPGRADE goals and technical challenges to the proposed innovation and evidence. The first column is referencing the sections of the UPGRADE module announcement that are related to the technical challenges and innovation proposed within a proposer's solution/proposal. 

Multiple awards are anticipated. However, the number of awards selected will depend on the quality of the proposals received and the availability of funds. Proposers are encouraged to propose a realistic, justifiable, comprehensive, and reasonable budget that aligns with their proposed solution. Proposals selected for award negotiations will result in an award for an Other Transaction. See Section 1.4 of the MAI, ARPA-H-MAI-24-01 for additional information on award information. Also see Section O of the final UPGRADE Module Announcement for the applicable modular categories. 

The ARPA-H UPGRADE program will emphasize creating and leveraging open-source technology and architectures. Intellectual Property rights asserted by proposers are strongly encouraged to be aligned with open-source regimes. For Other Transaction Agreements, IP will be subject to negotiations between the proposer and ARPA-H. ARPA-H seeks to ensure IP restrictions do not impede the application of breakthrough technologies to the people who can benefit from these technologies. See Section I.3. of the final UPGRADE MAI for more information on Intellectual Property.

As stated in UPGRADE MAI, Section O, Proposal Content and Format, the various module categories having varying page limits. Your total proposal value is the sum of all TAs you are proposing as a single submission. Proposers should choose a module category commensurate with the proposed technical solution. 

Material costs should be included in the budgets for Phase 1 and 2 if applicable to the proposed technical solution. Proposers are encouraged to propose a realistic, justifiable, comprehensive, and reasonable budget that aligns with their proposed solution.

If a Stage 1 proposal is selected for a potential award, a selection letter will be provided to the proposer notifying them of the selection. Within the email, the Stage 2, Volume 2 bundle of attachments will be provided along with a submission due date for the Stage 2, Volume 2 submission. The time frame for the Stage 2, Volume 2 submission can vary between module announcements. 

All Intellectual Property (IP) should be disclosed at the time of proposal submission. IP assertions should be provided using in the Attachment 1, Volume 1: Admin & National Policy Requirements template document . Additionally, proposed IP assertions will be factored into the evaluation of proposal submission in accordance with the evaluation criteria stated in Section 4.2 of ARPA-H-MAI-24-01. IP Assertions will be a topic of negotiation with each selected performer. 

The ARPA-H UPGRADE program will emphasize creating and leveraging open-source technology and architectures. Intellectual Property rights asserted by proposers are strongly encouraged to be aligned with open-source regimes. A key goal of the project is to seed the establishment of a sustainable open-source ecosystem for automated vulnerability detection and remediation.  

Per Amendment 1 to the UPGRADE MAI, the assumed start date for pricing should be March 1, 2025.

The module budget limit pertains to the sum of Phase I and Phase II (Option 1) pricing.  

Yes.

The price proposal submitted in the Stage 2, Volume 2 proposal submission, if a Proposer receives a Selection Notification Letter should align with the BOE submitted under the Stage 1, Volume 1 proposal submission. There is room for refinement but it should be representative and commensurate with the scope proposed in the Tech & Management section of the Stage 1, Volume 1 proposal submission. 

If the proposer has a current negotiated indirect cost rate(s) with a Federal agency, that rate may be used when proposing to an ARPA-H effort, but should be adjusted to exclude IR&D expenses. 

Proposer's should propose a profit objective that is commensurate with the research effort from a technical risk/management perspective. Profit should be proposed consistent with the organization's policies and accounting practices. 

While teaming is not required, it is strongly recommended that proposers seek out the strongest possible team member for each of the technical areas (TAs). This will ensure that all program goals are met. We have created a teaming page (https://arpa-h.gov/research-and-funding/programs/upgrade/teaming) where prospective performers can share their profiles and learn about other interested parties. Note: The UPGRADE team will not suggest or direct teaming. 

Once awarded, teaming changes may be allowed at ARPA-H's discretion and in response to new or different needs arising from the program's progress. Requests will be dealt with on a case-by-case basis, and any proposed teaming changes would be submitted to the Government team (UPGRADE Program Manager and Agreements Officer) for consideration.

Proposers refers to proposed teams, organized by the prime proposer. If the proposing team is interested in proposing to more than one TA, then there should be one proposal submissions. Organizations can be on multiple teams, and the same team can submit more than one proposal if the technical solutions are separate and distinct. 

The UPGRADE Teaming Site is publicly available as a resource to all potential proposers. Potential proposers can freely contact anyone on the teaming site. No ARPA-H permission is needed. 

ARPA-H encourages partnering across all TAs where it is appropriate. Performers or Teams can sign up and view the teams through the UPGRADE Teaming Page. Partnerships may include hospitals, organizations, researchers, academic institutions, manufacturers, and industry. Specific content, communications, networking, and team formation are the sole responsibility of the participants. The ARPA-H UPGRADE team cannot assist in forming teams.

Yes, hospitals can participate in the ARPA-H UPGRADE program. We are looking for hospitals to be partners in the Teaming process, as they will be integral to TA1. Hospitals can sign up through the UPGRADE Teaming site, where they can view and partner with other performers. 

Yes, TA3 and TA4 performers will be studying the corpus of emulated devices created by TA2 performers as identified by TA1 performers.  The expected collaboration between the TAs is enumerated in the UPGRADE MAI, Section F, Program Structure and Integration.

Proposers shall identify their proposed team composition in their final proposal.

ARPA-H will not be serving as the System Coordinator/Integrator across all the TAs, as that is primarily a TA1 task. ARPA-H's role is to establish program objectives, fund promising approaches, and evaluate performance against established metrics. The inter-TA collaboration is enumerated in Section F, Program Structure and Integration of the UPGRADE MAI.

The intent is for TA1 performers to team with a hospital. ARPA-H is actively pursuing various hospitals and pointing them to the teaming page as well. As stated in the Proposers' Day Special Notice (ARPA-H-SN-24-109), specific content, communications, networking, and team formation are the sole responsibility of the participants. ARPA-H UPGRADE cannot assist in forming teams.

As stated in the UPGRADE module announcement, "Multiple awards are anticipated for TA1 to ensure applicability of platforms to different hospitals. To foster a diversity of solutions, multiple performers are expected to be selected for TA2, TA3, and TA4. Collaboration between multiple types of organizations, academic institutions, and commercial companies is highly encouraged." It is anticipated that many Proposers will have teams that cross multiple TAs, but this is not a requirement. 

The solution summary and proposal should be submitted by the prime organization who will be contracting with ARPA-H and leading the team's effort. Other entities on the team will be subcontractors to this prime organization; all subcontracting shall be managed by the prime organization.  

Proposers are encouraged to present the strongest team that address the objectives of the TA(s) they are proposing.  ARPA-H will not be presecriptive in required specific expertise in each TA. Specific content, communications, networking, and team formation are the sole responsibility of the participants. The ARPA-H UPGRADE team cannot assist in forming teams.

ARPA-H does not have a preference. Proposers are encouraged to concentrate on their specific TA strengths rather than attempt to cover the breadth of disciplines necessary across the UPGRADE program.

Proposers do not need to address all of the TAs in their proposals.  ARPA-H expects proposers will submit solutions to single TAs or any combination of TAs, depending on the strengths and background of their team. Once awarded, all teams will be expected to collaborate with the other teams within and across the TAs.  

Please review ARPA-H-MAI-24-01 MAI Section 2.1.2 regarding Non-U.S. Organizations.

Proposer's may submit a proposal which addresses any TA singly or any combination of TA 1, TA2, TA3, and/or TA4. However, a proposal should address the TA (or TAs) in their entirety. 

Please see Section 2.1 of the Master Announcement Instructions (ARPA-H-MAI-24-01, Amendment 1), which specifically addresses FFRDC participation. 

Yes, and as stated within the UPGRADE module announcement, progression to Phase II will depend on performance against the metrics (in Phase I) and milestones. If the metrics do not have significance in a specific case, the proposing teams can offer their own metrics and explain how these metrics show a quantitative improvement compared to the current best practices.

Discovery and remediation of vulnerabilities in devices and systems currently deployed in hospitals is in scope for this program. However, direct analysis of ongoing attacks is not considered in scope for this program. 

UPGRADE’s aim is to secure complex and unique hospital networks that contain a plethora medical devices, traditional IT and OT assets, etc. Hospitals are the focus but knowledge gathered through this research will likely be beneficial and applicable across other industries.   

We cannot direct or prescribe solutions, but will be looking for the most effective solutions. ARPA-H is looking for novel and revolutionary solutions to cybersecurity challenges within healthcare, and this may involve a number of different approaches, including known technologies and results from existing and future studies. 

ARPA-H is looking for novel and revolutionary solutions to cybersecurity challenges within healthcare, and this may involve a number of different approaches. We anticipate multiple awards in each TA, to foster a diversity of solutions. 

TA2 is focused on the creation of Cyber Digital Twins.

Yes.

While medical devices are the primary focus of UPGRADE, all software and networks present in a hospital are considered in scope.

Working with manufacturers and obtaining permissions will be integral to TA2. TA2 Performers may need to collaborate with manufacturers for permissions and access to resources. 

TA1 will certainly need to develop custom software, but the use of COTS equipment is not precluded.

It is anticipated that  there will be multiple awards in each TA, including TA2 for emulators. Some emulators may include patient simulators in order to test the TA3 and TA4 components effectively. 

The goal of the program is to ensure that hospitals can protect themselves and patients from cyber threats. Protecting patient data and information from cyber threats is within the scope of this program.

Existing and new research are both in scope for the UPGRADE program.

"Available artifacts" may include either or both, ex. open source code in closed source applications.

No, the physical behavior of a device does not need to be emulated.  The focus of the UPGRADE program is on software vulnerabilities.  

TA2 performers will be developing emulators that are representative of the different devices and systems in a hospital setting, but 100% emulation of all devices and systems is not required.  

The tools and techniques developed by the UPGRADE program, if successful, are expected to revolutionize the way that the healthcare industry approaches cybersecurity.

Proposers shall identify in their proposal the vulnerability classes they will address and why these are the best representation of vulnerabilities present in real world medical devices and networks. 

Both options may be acceptable, and Proposers are encouraged to find the most effective solution that works for the TAs to which they propose. Please refer to the Section E of the ARPA-H UPGRADE Modular Announcement for information and requirements of the Technical Areas.

ARPA-H is interested in systems that prioritize the incorporation of existing manufacturer supplied patches and recommended configurations to secure a hospital but will also look into creative solutions to address the remaining risk unaddressed by manufacturers or industry best practices.

Proposals need not include technologies that are already in development and/or matured to a certain level, though a successful track record of developing technologies similar to those in scope will be considered as evidence of the capabilities of a given performer. See the ARPA-H-MAI-24-01 Section 4.2, Evaluation Criteria for Award. 

Discovery and remediation of vulnerabilities in devices and systems currently deployed in hospitals is in scope for this program. However, analysis and remediation of ongoing or past attacks is not considered in scope for this program. Please refer to the Section E of the ARPA-H UPGRADE Draft Modular Announcement for information and requirements of the Technical Areas.

The primary focus of UPGRADE is software, but hardware solutions are not out of scope.

If the proposed TA3 solution involves active study of expert hackers then this may be considered human subjects research and an IRB may be required. If a proposed TA3 solution is reviewing past research of expert hacker behavior, that would not be considered human subjects research.

There are no specific restrictions on how TA3 performers design and implement their solutions, to include interaction with external providers.  

As stated in Section O, Proposal Content and format, (1)(h), data storage and analysis costs estimates and assumptions should be provided within the Stage 1, Volume 1 proposal submission, but should not be included in the total Basis of Estimate. Please refer to the Attachment 1, OT Bundle, BOE template, section 9, Data Storage and Analysis Costs. Note that NIH has pre-negotiated agreements with the major commercial cloud providers that are intended to be leveraged for the UPGRADE program.  

If proposers anticipate that the government-provided cloud resources are not sufficient than a justification should be provided within the Stage 1, Volume 1 proposal submission regarding why a proposer will be leveraging their own resources.

It is envisioned that some TA2 emulators will more broadly cover hospital equipment while some will offer narrow solutions. We anticipate multiple awards and solutions, that may address each TA in a different way. This might include both software and hardware. Please refer to the Section 2B of the ARPA-H UPGRADE final module announcement for information on a description of the Technical Areas and requirements for the TA1 Vulnerability Mitigation Platform and TA2 Hospital Equipment Emulation.