1 - PWS REVERSE OSMOSIS MAINTENANCE.pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

Reverse Osmosis (RO) Device Preventive Maintenance (PM) Contract NMC/NMRTC- San Diego

Directorate of Medical Services/Department of Internal Medicine

Nephrology Clinic/Dialysis Unit

Solicitation Number: HT941024Q2082 Version: Rev 2

Date: 29 August 2024

16, 2021

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Preventive maintenance for Centurion Reverse Osmosis (RO) Devices.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform maintenance and repair services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: Perform preventive maintenance and repair services for the following equipment:

AmeriWater Product ID: #103453

• S/N CEN210041 ECN162758

• S/N CEN210043 ECN162756

• S/N CEN210047 ECN162757

The Nephrology Clinic utilizes the RO devices to supply purified water suitable for hemodialysis procedures performed at patient bedside in the ICU or in the wards when treatment in the Dialysis Unit is not an option. These devices require scheduled Preventative Maintenance and repair as recommended by the manufacturer (AmeriWater LLC) as well as as-needed services to upkeep their operational condition. The previous contract HT941023P0104 expired 19 June 2024.

1.4 Objectives:

1.4.1 NMCSD PREVENTIVE MAINTENANCE REQUIREMENTS:

Ensure that only FULLY QUALIFIED FIELD ENGINEERS and TECHNICIANS who have gone through original equipment manufacturer (OEM) or comparable third-party service schools for the above-mentioned equipment, shall be employed in the performance of all work performed under this contract. Upon request, contractor shall provide training certificates (or notarized copies) to the Material Management Department, Biomed Repair Department division for verification. The highest standard of professional capability and electrical/mechanical workmanship is to be maintained throughout the life of this contract.

Make repairs to the extent necessary (as determined by inspection tests or disassembly) to ensure a functional system that will efficiently serve its intended purpose.

Installation of system update changes to resolve specific product reliability problems.

Hardware and software changes to resolve specific product reliability problems. Hardware and software upgrades, defined as those changes that enhance or add product features, are not included.

1.4.2 NMCSD CORRECTIVE MAINTENANCE REQUIREMENTS:

Immediately upon contract award, the contractor will provide Material Management

Department BIOMED division, Naval Medical Center San Diego, an emergency telephone number. Contractor will respond no later than two (2) hours after telephone notification Monday-Friday, hours of 0800–1600.

Provide only the work necessary to restore the equipment to a serviceable/operating condition by adjustments, replacement parts, or minor repairs when it is determined that extensive repairs and parts replacements are not necessary.

Notify the Material Management Department, Naval Medical Center San Diego, Biomed Repair Department immediately upon receipt of OEM or replacement parts/equipment safety recalls notices.

Ensure that original design and functional capabilities will not be changed, modified, or altered unless the Material Management Department, Biomed Repair Department, Naval Medical Center, San Diego authorizes such changes in writing.

Provide suitable OEM recommended repair equipment/tools required for the satisfactory execution of all repairs made.

Furnish manufacturer OEM approved lubricants and lubricate wear points within the equipment.

Extend to the Government all commercial warranties on replacement parts consistent with standard industry inventory.

1.5 Scope:

• The contractor shall perform Preventative Maintenance on all reverse osmosis machines annually as stated in the Centurion by AmeriWater Operation & Maintenance Manual.

• Ensure that only FULLY QUALIFIED FIELD ENGINEERS and TECHNICIANS who have gone through original equipment manufacturer (OEM) or comparable third-party service schools for the above-mentioned equipment, shall be employed in the performance of all work performed under this contract. The contractor shall provide training certificates (or notarized copies) to the Material Management Department, Biomed Repair Department Division for verification.

• Make repairs to the extent necessary (as determined by inspection tests or disassembly) to ensure a functional system that will efficiently serve its intended purpose.

• Installation of system update changes to resolve specific product reliability problems.

Hardware and software changes to resolve specific product reliability problems. Hardware and software upgrades, defined as those changes that enhance or add product features, are not included.

• Contractor shall perform all scheduled preventative maintenance IAW the Performance Work Statement

“Repair” means any (a) modification, adjustment, or replacement of the hardware that corrects a malfunction by bringing the hardware into material conformity with the technical specifications for the hardware or (b) a procedure or routine that, when observed in the regular operation of the hardware, avoids the material adverse effect of the applicable nonconformity. As a result, ensures dependable and reliable equipment operation. The scope of work performed under these

16, 2021 specifications includes the furnishing of all labor and parts to perform all repairs on equipment listed to assure continued operation at their designed efficiency and capacity.

1.6 Period of Performance (POP): One year from date of Award

1.6.1 . Transition-in/transition-out period: NA

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at NMCSD Nephrology/Dialysis Clinic:

Bldg 1, Floor 3, Rm 3D-18H1-CD.

Naval Medical Center San Diego

34800 BOB WILSON DRIVE

SAN DIEGO, CA. 92134-5000

1.7.2 Recognized Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Contractor travel: NA

RESPONSE TIME: Contractor shall use commercially reasonable efforts to:

Respond by telephone to any report of a malfunction requiring repair within two (2) hours of notification by NMCSD Monday – Friday, 0800-1600.

Provide on-site support within one (1) business day of notification by NMCSD Biomed Repair Department personnel.

1.9 Other Direct Costs (ODC): NA

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.1 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available)

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. (Insert the following sentence, if performing in a government facility.) At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the

CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor.

In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.11.4.2 The contractor shall prohibit the use of Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: The contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the contractor’s

QCP.

1.12 Key personnel (Contractor): The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between [8:00 a.m. to 4:30 p.m.], Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.12.1 Contract Manager and Alternate. The Contract Manager and Alternate must have 24 semester hours in mathematical, engineering, and/or quantitative analysis courses; 15 or more years cost analysis experience; and familiarity with Defense Department Data Sources (e.g., cost and software data reporting, Earned Value Management (EVM)).

1.12.2 Systems Administrator. The Systems Administrator must have a high degree of expertise with the following systems/protocols: Microsoft Server 2000 and XP operation and administration, and Network Administration. However, in accordance with FAR 39.104, 16, 2021 minimum experience or education requirements for IT services contracts must not be specified without first consulting with the CO.

1.13 Data Rights: Reserved

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): NA.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel.

Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

16, 2021

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015, as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List CIO Chief Information Officer

16, 2021

CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal

16, 2021

IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication SPRS Supplier Performance Risk System

16, 2021

SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc. NONE

16, 2021

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders.

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract/task orders.

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders.

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Contractor Furnished Services required in support of this contract/task orders.

These Services are described below:

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: NA

4.4 Materials: NA

4.5 Equipment: NA

4.6 Facilities: NA

16, 2021

PART 5

5.0 SPECIFIC TASKS

5.1 Machine Maintenance:

The contractor shall perform Preventative Maintenance on reverse osmosis machines annually as stated in the Centurion by AmeriWater Operation & Maintenance Manual.

The contractor is required to provide all services, materials, and equipment necessary for the repair/preventive maintenance of three (3) Reverse Osmosis Machines by AmeriWater LLC.

AmeriWater Product ID: #103453

S/N CEN210041 ECN162758

S/N CEN210043 ECN162756

S/N CEN210047 ECN162757

5.1.1 NMCSD PREVENTIVE MAINTENANCE REQUIREMENTS:

Ensure that only FULLY QUALIFIED FIELD ENGINEERS and TECHNICIANS who have gone through original equipment manufacturer (OEM) or comparable third-party service schools for the above-mentioned equipment, shall be employed in the performance of all work performed under this contract. Upon request, contractor shall provide training certificates (or notarized copies) to the Material Management Department, Biomed Repair Department division for verification. The highest standard of professional capability and electrical/mechanical workmanship is to be maintained throughout the life of this contract.

Make repairs to the extent necessary (as determined by inspection tests or disassembly) to ensure a functional system that will efficiently serve its intended purpose.

Installation of system update changes to resolve specific product reliability problems.

Hardware and software changes to resolve specific product reliability problems. Hardware

5.1.2 NMCSD CORRECTIVE MAINTENANCE REQUIREMENTS:

Immediately upon contract award, the contractor will provide Material Management

Department BIOMED division, Naval Medical Center San Diego, an emergency telephone number. Contractor will respond no later than two (2) hours after telephone notification Monday-Friday, hours of 0800–1600.

Provide only the work necessary to restore the equipment to a serviceable/operating condition by adjustments, replacement parts, or minor repairs when it is determined that extensive repairs and parts replacements are not necessary.

Equipment improvements/modifications shall be made only upon Material Management Department, Biomed Repair Department written approval and direction.

16, 2021

Notify the Material Management Department, Naval Medical Center San Diego, Biomed Repair Department immediately upon receipt of OEM or replacement parts/equipment safety recalls notices.

Ensure that original design and functional capabilities will not be changed, modified, or altered unless the Material Management Department, Biomed Repair Department, Naval Medical Center, San Diego authorizes such changes in writing.

Provide suitable OEM recommended repair equipment/tools required for the satisfactory execution of all repairs made.

Furnish manufacturer OEM approved lubricants and lubricate wear points within the equipment.

Extend to the Government all commercial warranties on replacement parts consistent with standard industry inventory.

5.2 AAMI Water Testing:

The contractor shall provide and perform AAMI water testing kits for all reverse osmosis machines annually to adhere to AAMI water standards, as well as manufacturer's protocol.

The contractor shall provide AAMI water testing for all reverse osmosis machines to ensure proper working order of all units as detailed below:

AmeriWater Product ID: #103453

S/N CEN210041 ECN162758

S/N CEN210043 ECN162756

S/N CEN210047 ECN162757

5.2.1 NMCSD PREVENTIVE MAINTENANCE REQUIREMENTS:

Perform AAMI standard water test kit to equipment manufacturer and AAMI industry standards.

Ensure that only FULLY QUALIFIED FIELD ENGINEERS and TECHNICIANS who have gone through original equipment manufacturer (OEM) or comparable third-party service schools for the above-mentioned equipment, shall be employed in the performance of all work performed under this contract. Upon request, contractor shall provide training certificates (or notarized copies) to the Material Management Department, Biomed Repair Department division for verification. The highest standard of professional capability and electrical/mechanical workmanship is to be maintained throughout the life of this contract.

Make repairs to the extent necessary (as determined by inspection tests or disassembly) to ensure a functional system that will efficiently serve its intended purpose.

Installation of system update changes to resolve specific product reliability problems.

Hardware and software changes to resolve specific product reliability problems. Hardware

5.2.2 NMCSD CORRECTIVE MAINTENANCE REQUIREMENTS: NONE

16, 2021

NMCSD does not imply requirements following the corrective maintenance of a pass or fail AAMI quality standard test kit. If a device fails AAMI water standards it is immediately pulled from use. If the device needs to be replaced, it is a separate purchase rather than a corrective action from the contractor.

If a machine does not meet AAMI standards, it is the obligation of the Nephrology Clinic to discontinue use of the reverse osmosis device.

5.3 Special Qualifications/Considerations: The contractor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system such that OEM warranty and service are provided and maintained by the OEM. All software licensing, warranty, and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

5.3.1 Title To Equipment: Contractor shall not assume possession or control of any part of the equipment. The government retains ownership to title thereof.

5.3.2 Liability: The Contractor shall not be liable for any loss, damage, or delay due to any cause beyond reasonable control including but not limited to, acts of government, strikes, lockouts, fire, explosion, theft, floods, riot, civil commotion, war, malicious mischief or acts of God.

5.3.3 Shipment: The contractor shall not exceed two (2) business days of shipment for all equipment coming and/or going to Material Management Department, Biomed Repair Department, Naval Medical Center San Diego.

5.3.4 Access To Equipment: Contractor shall be provided reasonable access to all equipment that is to be serviced and utility outlets required to do the service. The contractor shall be free to start and stop all primary equipment incidentals to the operation of the maintained equipment after permission is received from Laboratory on-duty personnel responsible for such equipment.

5.3.5 Government Personnel: NMCSD employees will not perform maintenance or attempt repairs to equipment while such equipment is under the purview of this contract unless agreed to in writing by the contractor.

5.3.6 Parts Availability: To ensure minimal equipment downtime, contractor shall maintain replacement repair parts and materials necessary to perform each repair within two (2) business days.

5.3.7 Labor: All compensation for labor from the hours of 0800-1600. Local PST time is included in the contract price. Any labor performed outside of this timeframe is not included in the contract pricing. If service becomes necessary to be performed between 1600-0800, NMCSD Biomedical Repair Division shall be notified prior to performance.

5.3.8 Parts/Supplies Quality: Parts and Supplies provided under this contract shall be new. All compensation for parts and materials is included in contract price.

5.3.9 Contractor Check-In/Check-Out: Contractor is required to report to the Material Management Department, Biomed Repair Department, Build 1, Ground Floor, Room GD-18H1 Naval Medical Center San Diego, for Visitor Badges during the hours of 0800-1600, Monday through Friday, prior to and upon completion of any service/repair performed.

5.3.10 Field Service Reports: Contractor shall furnish a written or electronic vendor supplied Field Service Report (FSR) to the Duty Staff at:

Naval Medical Center, San Diego Bio Medical Repair Building 1, Ground Floor, Room GD-18H1 Phone: 619-532-8010 Fax: 619-532-8013

Or electronically at: dha.san-diego.san-diego-nmc.list.nmcsd-biomed-contract@health.mil

The contractor, or his representative, shall complete the vendor supplied Field Service Report to include the following:

Contractor Name Technician’s Printed Name, Telephone Number and Signature Date and Time of Arrival ECN (Equipment Code Number) and Serial Number Time Expended Repairing/Service; Labor Hours, Rate and Materials Summary of Work Performed and Accepted by End-User (Government Representative’s Printed Name and Signature)

All Field Service Reports shall be submitted within 72 hours of completion of service.

Completed Field Service Reports are Required Prior to Acceptance of any Invoice.

5.4 Preventive Maintenance And Repair Service Schedules

Services shall be required based upon the following agreed schedules:

Preventive Maintenance: (Check One)

X One (1) Time Per Fiscal Year

__ Two (2) Times Per Fiscal Year

Aami Water Testing:

X One (1) time per fiscal year

__ Two (2) times per fiscal year

REPAIR: (Check One)

X Monday - Friday, 0800-1600

_ Seven (7) days per week, 24-hour coverage

16, 2021

PART 6 6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The TIER level and position sensitivity designation for positions under this contract is:

6.2.1 TIER II: Non-critical sensitive position

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: NA - Contractor has no access to

PHI/PII.

6.4 Training:

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements: NA – Contractor is not performing Cybersecurity/Cyberspace functions.

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Reserved

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800171), in accordance with DFARS clause 252.204-7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This

16, 2021 requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC) : The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoD that federal contract information (FCI) and DoD Controlled Unclassified Information (CUI) is protected at a level commensurate with the risk. The CMMC requirement flows down to subcontractors.

6.5.4.1 The contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization (3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

16, 2021

6.5.7 Cloud Computing: If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support; and

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUISpecific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the contractor or subcontractor shall have or acquire a DoDapproved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/

16, 2021

6.5.9 Malicious software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: N/A, IT is not needed for these devices

6.7. Facility Related Control Systems: Reserved

6.8. System Communications: Reserved

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Businessto- Business (B2B) Gateway: NA

6.9.1 If there is an external system connection to a DoD IS required, then the contractor shall, in accordance with contract requirements, connect to the DHA B2B Gateway via a contractor procured Internet Service Provider (ISP) connection.

16, 2021

NA

6.9.2 The contractor shall assume all responsibilities for establishing and maintaining their connectivity to the B2B Gateway. This shall include acquiring and maintaining the circuit used to connect to the B2B Gateway and the acquisition of a Virtual Private Network (VPN) device maintenance agreement and license compatible with the MHS VPN device. The list of compatible devices are detailed in the DHA B2B/MedCOI Gateway questionnaire.

NA

6.9.3 The contractor shall submit a completed current version of the DHA B2B Gateway questionnaire to their Contracting Officer or COR within 10 calendar days after new requirements have been provided to the contractor. NA

6.9.4 The contractor shall provide information specific to their connectivity requirements, proposed path for the connection and last mile diagram. NA

6.10 Contractor Provided IT Infrastructure NA – Contractor is not accessing Government systems.

6.10.1 Platforms shall support HyperText Transfer (Transport) Protocol (HTTP), HyperText Transfer (Transport) Protocol Secure (HTTPS), web-derived Java Applets, and Secure File Transfer Protocols (SFTPs) (e.g., STFP, Secure Socket Layer/Transport Layer Security), and all software that the contractor proposes to use to interconnect with DoD facilities. NA

6.10.2 The contractor shall configure their networks to support access to Government systems (e.g., configure ports and protocols for access). NA

6.10.3 The contractor shall provide full time connections to a TIER 1 or TIER 2 ISP. Dial-up ISP connections are not acceptable. All IP addresses need to be publicly routable. Private address space using Network Address Translation will not be permitted. NA

6.10.4 The contractor shall maintain a valid maintenance contract and pertinent licenses for all devices connecting to the MHS B2B Gateway. NA

6.11 System Authorization Acess Request (SAAR), Defense Department (DD) Form 2875

6.11.1 The contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with CO guidance for all contractors that use the DoD Gateways to access Government IT systems and/or DoD applications shall. A DD Form 2875 shall be completed for each contractor employee who will access any system and/or application on a DoD network. The DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application. NA

6.11.2 The contractor shall submit the completed DD Form 2875 to the DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has the appropriate background investigation completed or a request for

16, 2021 background investigation has been submitted to the Office of Personal Management (OPM).

Acknowledgment from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved. NA

6.11.3 Upon approval, DHA will notify the user of the ID and password via secure/encrypted email upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoD application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account. NA

6.11.4 The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoD IS’/networks to verify that continued access is required. NA

6.11.5 The contractor shall provide the DHA DPCLO with a report of the findings of…