Att.3-DHA Cybersecurity-Service Maintenance Agreement Contracting Requirements.pdf

Defense Health Agency (DHA) Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF)

Updated: January 16, 2024

DHA MDE Cybersecurity/RMF Contract/ordering Requirements Version 01-16-2024 ii | P a g e

Version Matrix

Version Date Author Description

1.0 16 January 2024 Completed initial draft of Cybersecurity

Language for SMAs.

DHA CyberLOG MDE Cybersecurity/RMF Contracting Requirements Version 10-03-2023 iii | P a g e

Table of Contents

1. Warranty and Post-Warranty Service Maintenance Agreement RMF/Cybersecurity

Requirements/Continuous Monitoring/Risk Management

DHA MDE Cybersecurity/RMF Service Maintenance Agreement Contracting Requirements

4 | P a g e

All requirements in this document will be referenced by a single Not Separately Priced (NSP) Contract Line Item (CLIN) in the contract/order and shall be included in vendor’s pricing with no additional or separate charges.

The government will not enter into a Non-Disclosure Agreement (NDA) with the vendor.

Federal law provides criminal prosecution of any Government employee disclosing confidential information, with or without an NDA (see 18 USC §1905).

If the vendor receives a delivery or task order under an ordering contract or a call order under a blanket purchase agreement, the vendor shall ensure that all devices provided under the scope of said contract maintain the appropriate security posture; the vendor shall not change versions without proper notification to both the program office responsible for device management, the contract agency, and the cyber security analysts. The vendor shall not make any delivery, nor receive payment prior to RMF approval on the updated version.

1. Warranty and Post-Warranty Service Maintenance Agreement RMF/Cybersecurity Requirements/Continuous Monitoring/Risk Management.

During the initial warranty period of the device, the vendor is responsible for ensuring a continued positive security posture through DHA mandated Continuous Monitoring activities. Continuous Monitoring requires software updates/upgrades, patch management, application of DoD required security configurations via Security Technical Implementation Guides (STIGs), vulnerability scanning, and remediation of discovered vulnerabilities.

Post warranty cybersecurity maintenance will be covered in subsequent Service Maintenance Agreements.

1.1. In accordance with SEC. 524B. of the ‘Consolidated Appropriations Act, 2023’ titled ENSURING CYBERSECURITY OF DEVICES, the vendor shall design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available post-market updates and patches to the device and related systems on a reasonably justified regular cycle, or as soon as possible for critical vulnerabilities that could cause uncontrolled risks. The vendor shall disclose if patching can be accomplished by the government, or if a specialized support is required to maintain a compliant cybersecurity posture.

1.2. The vendor shall establish and maintain a test/laboratory environment that includes all contract/ordered equipment, to include 3rd party components that fall under the authorization boundary, and/or included in this contract/order, to support the RMF/Cybersecurity requirements. The vendor test lab shall be used for all self-assessment activities, Independent Verification and Validation (IV&V) compliance testing, and post Authority to Operate (ATO), or RMF Approval (herein referred to as Approval) actions for as long as the system is supportable by the vendor. Supportable is defined as serviceable by a qualified Service

Version 01-16-2024

5 | P a g e

Engineer or Original Equipment Manufacturer (OEM).

1.3. The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical, or technical change to the system or device.

1.4. The vendor shall maintain the authorized security configuration and notify the government for approval prior to instituting changes to devices installed within the DHA network. A major upgrade such as major software or hardware revision must be reassessed for RMF Compliance, or addition to the approved products list. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The vendor shall support reauthorizations due to both major and minor upgrades.

1.5. The vendor shall ensure its device or system is in compliance with the DoD IAVM program upon each deployment.

1.6. The vendor shall ensure any deployment post acceptance (including rebuilds) deploys with a fully-patched, approved version. Prior to final acceptance and installation, the vendor shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration shall require the vendor to bring the system into compliance prior to final acceptance and putting the system in operation.

1.7. The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

1.8. The vendor shall provide vulnerability and configuration scan results using Nessus and the DHA policy to the Government monthly, providing raw scan results and administrative reports no later than the tenth (10th) calendar day of each month.

1.9. The vendor shall close all discovered vulnerabilities or shall submit to the Government for approval POA&Ms outlining mitigation and timelines for closing any open vulnerabilities within one (1) month of discovery.

1.10. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

1.11. The vendor shall use the Government-approved method for remote access administration (DHA B2B) of the system or device.

6 | P a g e